Groups

Description

Groups are a convenient way to apply policies to a collection of users. Groups allow administrator users to specify permission for multiple users in a quick and easy way. Groups are managed in a hierarchical way. A user can belong to a group, and that user will be assigned the roles of this group and all the roles that this group inherits from its parent.

Companies are organized in different ways as business units, departments, or workgroups. In Soffid, they all are named as groups. 

Some systems, like Active Directory, use groups to control or restrict access to resources. A Soffid Group is more similar to an Active Directory organisational unit (ou) than to the group itself.

Screen overview

Related objects

• Group types : a group can be a group type.
• Hosts : a group can have a drive server.
• Users : users belong a one or more groups
• Roles : a group can have granted roles
• Authorizations : related to a manager

Standard attributes

Group table

Group attributes that you can select in the table:

• Name: short name to identify the group. The group name must be unique.
• Description: a brief description of the group.
• Drive letter: if specified, a shared folder for this user will be created. This shared folder can be mounted on ESSO hosts by using a startup script.
• Parent group: name of the parent within the hierarchy. Only the root group doesn't have value. Be in mind the groups have a tree structure.
• Type: a group can be categorized by organizational unit types. You have more information about Group Type page.
• Drive server name: the server where the shared folders can be located.
• Disabled: allows you to enable and to disable the group. When a group is disabled, the group's role hierarchy is no longer available to the group's users.
• Active since
• Active until
• Created on
• Created by
• Update on
• Updated by

Basic tab

On the basic group tab, you can view all the group attributes. It is allowed to add new groups, and update or delete existing groups.

The group attributes are the same than in the group table description.

💻 Image

Users tab

Administrator users can manage the users who belong to the group. These users will have assigned all the permissions granted to that group and permissions inherited from its parent.  

On the user's tab, you can add new users to the group, you must select the user to add, and select the membership properties.

It is also allowed to delete one or more users from a specific group, you can do it from the group membership details or by selecting one or more records from the list and clicking the delete user  button.

Additionally, you can download a CSV file with the user's information and you can also upload a CSV file to add new users or update existing users.

The attributes are same than in the user page:

• User :  userName
• Full name
• Group type
• Created on
• Created by
• Updated on
• Updated by
• Common attributes
• User name
• First name
• Last name
• Middle name
• Organiztion
• Type
• Primary group
• Home server
• Profile server
• Mail service
• Email
• Mail alias
• Mail server
• User status
• Enabled
• Multi session
• Comments
• Audit information
• Created by
• Created on
• Modified by
• Modified last on

💻 Image

Granted roles tab

Administrator users can manage the permissions to a group, this is the way to establish an access policy to a collection of users. The users who belong to a group will inherit all the permissions granted of that group.

On the granted roles tab, you can assign or revoke roles to the group. To assign a new role, you must click the button add new, then select the role,  in some cases specify the scope, and finally set membership properties. To revoke role, you can do it from the group membership detail or by selecting one or more records from the list and clicking the delete role button.

Additionally, you can download a CSV file with the granted roles information and you can also upload a CSV file to assign roles, modify or delete assigning roles.

The attributes:

• Role
• Domain
• System
• Information system
• Description

💻 Image

Managers tab

On the tab Managers, Soffid displays the Roles with Domain equals to Group and the proper authorization.

Here you can grant the role to one or more users. You can also assign the role to users on the Roles page or on the Users page. Users who have been assigned this role will be displayed in the Managers tab.

Be in mind, to query the information about the roles and users on the managers tab, it will be mandatory to give authorization to query users or groups, you must add the role to the authorization (user:query or group:query).

The attributes:

• Role / managers : role with domain type groups and assigned to this group
• Description :  description on the role

💻 Image

** Role

** Authorization

Actions

Group query actions

Historical view (addon backup)

Switch to current view	Allows you to come back to the current data view.
Apply changes	Once you have pickup the proper date at the date component, you can apply changes and Soffid will display all the group data at the selected date time. Then you can browse the Groups tree and check the information
Undo	Allows you to quit without applying any changes.

Group detail actions

Synchronize to a target systems	Allows you to propagate the group changes to the repository systems configured. It is only necessary when the task engine mode is configured as Manual, but you can also do it when the engine is in automatic mode. Visit the smart engine setting page for more information.
Refresh	Allows you to refresh all the group information.
Apply changes	Allows you to save the data of a new group or to update the data of a specific group. To save the data it will be mandatory to fill in the required fields
Delete group	Allows you to remove a specific group. To perform that action, Soffid will ask you for confirmation, you could confirm or cancel the operation.
Undo	Allows you to quit without applying any changes.

Users

Granted roles

Managers

Grant <ROLE_NAME> role

Allows you to grant the role, <ROLE_NAME>, to one or more users. You need to click on the "Grant <ROLE_NAME> role", under the role you want to grant. Then, Soffid will display a modal window that allows you to search for the users. Here you are able to write the user name and select it to grant the role. Finally, you need to accept by clicking on the "Accept" button. If you click on the "Cancel" button, no changes will be applied.