The User Management is a Dogu for managing the users and groups of the Cloudogu EcoSystem. In addition to your own personal data, you can create, edit and delete users and groups, depending on the rights you have.
\nThe User Management can be accessed via the Warp Menu in the \"Administration\" area.
\nAs a user of the Cloudogu EcoSystem you can change your personal data in the account area.
\nThe personal account area is displayed directly when you open the User Management. Via the\nform you can adjust your personal data like your e-mail address or your password. The adjustments you make will only be updated by clicking on the save button. The username cannot be changed.
\nIn the lower part of the account area you can see your assigned groups.
\nTo remove the filter again, click on the \"X\" symbol inside the search field.
\nTo change the data of an account, first click on the pencil icon in the row of the account you want to change.
\nTo create a new account for the Cloudogu EcoSystem, first call up the \"Users\" tab and click on the \"Create user\" button.
\nA form will open where you can enter the following attributes of the new account:
\n* A user's email address and username are unique properties and may therefore only be used for one account. When creating an account, the system validates whether email address and username are unique. If this is not the case, you will receive a meaningful error message and you will be able to edit the account details.
\n\n\nNote that the username is unchangeable after the account has been created.
\n
You create the account by clicking on the \"Save\" button.
\nAfter you have saved, the newly created account will be displayed on the \"Users\" page.\nIf you want to make further changes, click on the pencil icon in the last column.
\nIn the Cloudogu EcoSystem configuration, password policies can be configured to be validated when passwords are entered.\nBy creating reasonable password policies, the security of passwords can be controlled globally.
\nWhen you create a password, you will always see the password policies that are not satisfied. Once a password policy is satisfied, it will disappear.
\nYou can't save the password until all password policies are satisfied.
\nIf all password policies are fulfilled, the input field will be marked green and the new password can be saved.
\nAs an administrator, the User Management gives you the ability to create, edit, or delete groups, as well as manage the members of groups.
\nGroups can be used to manage different permission configurations for different permission configuration. More information about this can be found in the section Permission concept in the Cloudogu EcoSystem.
\nIn the User Management you will find two predefined groups. Members of these groups have special permissions in the Cloudogu EcoSystem Dogus.
\nManager Group
\nMembers of the Manager Group have full access to the User Management of the Cloudogu EcoSystem.\nThis gives users the authorization to create and manage additional users and groups.\nBeyond that, no other permissions are associated with the *Manager Group**.
\nYou can change the Manager group to be used by changing the entry /config/_global/manager_group in the configuration of the Cloudogu EcoSystem to the desired group:
etcdctl set /config/_global/manager_group newManagerGroupThe User Management Dogu needs to be restarted to take the change into account.
\nAdmin Group
\nMembers of this group have administrative rights in all Dogus of the Cloudogu EcoSystem.\nThese users can use the administrative functions in the individual Dogus and thus, for example, install plug-ins or make application settings.
\nThe usage of the Backup & Restore Dogu is restricted to the administrators.\nConsequently, only users who are members of the Admin group have access to the Backup & Restore Dogu.
\nYou can change the Admin group to be used by changing the entry\n/config/_global/admin_group in the configuration of the Cloudogu EcoSystem to the desired group:
etcdctl set /config/_global/admin_group newAdminGroupAll Dogus needs to be restarted for the change to take effect.
\nTo avoid assigning individual permissions for all accounts in the Dogus, you can create groups as described below:
\nSelect the \"Groups\" tab in User Management.
\nClick on the \"Create group\" button.
\nTo delete a group, click on the trash can icon of the respective group in the \"Groups\" area and confirm the security prompt.
\nSystem groups cannot be deleted.
\nNote that groups deleted in the User Management are not automatically deleted in the Dogus. However, the assignment of accounts to groups is synchronized.
\nThe permission concept of the Cloudogu EcoSystem is based on a central user management and a decentralized permission configuration: Accounts and groups can be stored in the User Management. These are propagated to the other Dogus of the Cloudogu EcoSystem, allowing you to assign permissions for groups or individual users decentralized in each Dogu.
\nThe User Management is used to manage accounts and groups. In doing so, the User Management uses an internal LDAP as directory service.
\nIn addition to using the User Management provided by us, you have the option of using an external directory service for the Cloudogu EcoSystem. In this case, user management would not be done via the Dogu User Management presented here, but via the external directory service you have connected.
\nYou can create the accounts for users of the Cloudogu EcoSystem centrally in the User Management. To simplify the permission configuration, you can create groups for different user purposes. A user can belong to more than one group. A group can have more than one member.
\nAccounts and groups are synchronized with the Dogus, meaning in each Dogu you will find the accounts and groups created in the User Management.
\nSince Dogus may be applications developed outside of the Cloudogu EcoSystem, the permission concept in the Dogus may differ - as you can see in the following diagram exemplary.
\nAs can be seen in the following diagram, the CAS passes the required user information to the Dogu after successful authentication. The Dogu then validates whether the user's account and groups already exist. If this is not the case, the account and groups are created and assigned if the Dogu supports this procedure.
\nIn Dogus that do not manage groups or accounts, no groups or accounts will be created. For other Dogus, the creation of accounts and groups is often done by a CAS plugin that has been designed for this purpose.
\n
If a user's account has already been created internally in a Dogu, the internal account will be linked to the external CAS account if the internal user name matches the external user name. This usually overwrites the internal data in the Dogu with the data from the User Management and the account is marked as an external account in the Dogu, if possible.
\nWhen creating accounts and groups in the User Management, please note that modified or newly created accounts, groups and group assignments are not directly known in other dogus, but will be made known the next time the user logs in to the respective Dogu.
\nThere are exceptions for the Dogus Jira and Confluence: A synchronization of the user data is triggered every 60 minutes by default; this setting can be reduced in etcd via the key ldap/sync_interval.\nAlternatively, a user can log in to CAS and then log in again to Jira / Confluence so that the synchronization for the user is completed in this Dogu.\nAnother alternative is that the administrative user triggers a synchronization manually via: \"Settings (gear)\" > \"User management\" > \"User directories\" > \"CES LDAP mapper dogu\" > \"Synchronize\".\nSynchronization by time or manually by the administrative user only needs to be carried out for one of the two dogus, the other dogu is also synchronized.
If you as administrator want to create a new group and configure it directly in different Dogus, the procedure shown in the following diagram can be recommended.
\n
With the help of a test account you can log into the Dogus where you want to configure the newly created group. After you have configured the group with your account in the Dogu, you can additionally use the test account to test the configuration.
\nUser Management provides the option of importing any number of user accounts in just one step via the interface.\nFor this purpose, a CSV file must be created that contains all accounts to be imported.
\nCSV according to RFC 4180 is used as import format. The header of the file must be the following\n7 defined columns:
\nusername,displayname,givenname,surname,mail,pwdReset,externalThe order of the columns can vary, but the names of the columns must be kept.
\nThe columns describe the following information:
\nusername - username of the account
\npwdReset - Indicates whether the password must be reset at the next login
\nexternal - Specifies whether the account has been imported from an external service
\nAn example of a working CSV file:
\ndisplayname,external,mail,pwdreset,surname,username,givenname\nMax Mustermann,TRUE,max@mustermann.de,TRUE,Mustermann,mmustermann,Max\nMaria Musterfrau,TRUE,maria@musterfrau.de,TRUE,Musterfrau,mmusterfrau,Maria\nMark Muster,TRUE,mark@muster.de,TRUE,Muster,mmuster,Mark\nClaus,TRUE,claus@c.de,TRUE,Claus,,Claus\nClaus,TRUE,max@mustermann.de,TRUE,Claus,Claus,Carl\nMark Muster,TRUE,mark@muster.de,TRUE,Muster,mmuster,MarkTo import this file, you need to navigate to the 'User Import' item via the navigation bar in User Management.\nThe page should then look like this:
\nIn the file input field that can be seen there, the previously created CSV file must be selected.\nIf a CSV file was selected, the view of the page changes and the content of the CSV file is displayed in tabular form.
\nBy clicking on 'Import' the CSV file is sent and the user accounts are imported.
\nAfterward the result page is displayed. There you can see if the import was successful.\nIt is possible that new user accounts will be created, existing accounts will be updated or lines from the CSV file will be ignored\nbecause they contains invalid values. This can be the case, for example, if necessary columns were not present\nor a condition such as unique mails was not met.
\nOn the results page the results are displayed as follows:
\nBy clicking on the respective rows, more details about the added / updated user accounts as well as the\nskipped lines can be displayed.
\nAlso, by clicking on 'Download Import Summary' the result can be downloaded.
\nPast imports are stored in the file system that they can be retrieved again.\nThe import overview is used for this purpose. Therefore, click in the navigation bar on the entry\n'Import overviews'. There, all past imports are displayed in tabular form with the name of the CSV file as well as the exact date.
\nBy clicking on the selection field 'Functions' of the respective line a small submenu opened. There you can download the respective overview directly, delete it from the system or display it in detail with a click on 'Details'.
\n