Table of Contents

User groups

A user group is a named set of publisher accounts kept in Tenant Management. It configures the publishers of tenants: a group is picked each time its members are added to a tenant, and they are added in one action, instead of being picked one by one. Adding them to a tenant never makes them client administrators.

A group is a container only. It carries no role and no right: roles stay on the user accounts.

Managing groups

Groups are managed from Users > User groups.

Property Description
Name Name of the group. Required and unique, 100 characters.
Description Optional description, 500 characters.
Members Publisher accounts of the group. An account can be in several groups.
  • Only publisher accounts can be members. The user lookup of the members grid offers publisher accounts only, and the server refuses any other account, also through the API.
  • The members grid shows the login, first name, last name, type and active state of each account. A deactivated account stays a member.
  • The user lookup of the members grid does not offer accounts that are already members.
  • Deleting a group asks for confirmation and names the groups about to be deleted. It removes their memberships only: the user accounts, and the users already added to tenants, stay.
  • Deleting a user account removes it from its groups. The groups are kept.
  • A client user only sees the client members of a group, as in the user list. Publisher members are visible to publisher users only, and only a publisher user can add members to a group.
  • The user list can be filtered by group: add the User group criterion from the filter menu.

Permissions

The function User groups (UserGroupAdministration) gives read, creation, update and deletion rights on groups. It is distinct from the users and roles functions. At startup, Tenant Management grants it to its administrator role.

The function Tenants administration (TenantAdministration) can read the group list, so that the group pickers of the tenant screens work for a tenant administrator who does not manage groups.

Publisher administrator group of a tenant

The tenant screens split the users of a tenant in two tabs, between General and Clusters:

  • Publisher administrators: the Publisher administrator group box, then the tenant's publisher users.
  • Client administrator (creation) or Client administrators (existing tenant): the tenant's client users only.

Each tab caption shows its count. The publisher administrator group is not saved with the tenant: it is picked each time its members are to be added.

At tenant creation

The Publisher administrators tab holds the group box and the single publisher user, which can still be typed by hand, without a group. The single publisher user becomes a client administrator of the tenant. The Client administrator tab holds the client administrator. Picking a group lists, read-only and below the single publisher user, its publishers who will be added to the tenant when it is saved. The single publisher user is not listed again. When nobody is left to add, a warning says so and names the publishers already in the list, and the group is not added at the save. When the tenant is saved with a group, the group's members are added to the new tenant (see Adding the group members). The single publisher user and the creation contract do not change: the group is added after the tenant is created. If that fails, the tenant stays created, and the message gives the error. To recover, add the group members again from the tenant's Publisher administrators tab.

On an existing tenant

The Publisher administrators tab shows the group box, with the group's description and the Add the group members action, then the grid of the tenant's publishers, where a single publisher administrator is still added by hand, with Add. The Client administrators tab shows the grid of the tenant's client users. Each grid offers only its own account type, and shows in bold the rows not saved yet.

Picking a group opens a confirmation that names its publishers who are not yet on the tenant, those already in the list and the members that are not publishers: OK adds them, Cancel adds nothing. Add the group members adds them again without the confirmation, for instance after a cancel or after rows were removed. Either way, the group's publishers who are not yet on the tenant go to the grid as new rows, like any other change of the tenant. Nothing is written until the tenant is saved. Until then, a row can be removed from the grid, and closing without saving drops them all. Picking another group, or emptying the group box, keeps the rows already added. A new row adds the publisher to the tenant only: its Client administrator box shows whether the account already is one. An account without any tenant role gets the tenant resolution role when the tenant is saved, whether it is added from a group or by hand. After the button, a message names the added publishers, those already in the list and the members that are not publishers. When nobody is left to add, a warning says so, without the confirmation.

Adding the group members

Add the group members adds the current members of the group that are not yet users of the tenant:

  • Only publisher accounts are added. Another member, from before the publisher-only rule, is ignored, and the message names it.
  • No member gets the client administrator role, at creation or on an existing tenant. Only the single publisher user of the creation screen becomes one, and Set as applications administrator makes one on an existing tenant.
  • Members already on the tenant are kept as they are, so adding them again changes nothing.
  • Adding never removes a user or a role.
  • Deactivated members are added like the others.
  • The messages name the accounts of each kind, and leave out a kind without any account: one to three accounts as a bulleted list, four or five separated by commas, more than five as the first three followed by the number of the others.
  • A message is an information when at least one account was added, and a warning when none was, for instance when every publisher of the group was already on the tenant.

The new users of the tenant reach its clusters through the usual synchronization: each new tenant user is published to the tenant's clusters, and a cluster added to the tenant later receives all its users.

Important

Adding the group members is a copy, not a link. A user added to the group later is not added to the tenant, and a user removed from the group stays on the tenant. Add the group members again to add the newcomers, and remove a user from the tenant by hand.

Note

Roles are global per account in Tenant Management. Making an account a client administrator, with Set as applications administrator or as the single publisher user of a new tenant, makes it a client administrator on every tenant it belongs to, not only on this one.

Not covered

  • A live link between a group and the users of a tenant, or a group saved with the tenant.
  • Propagating removals to the clusters: a user removed from a tenant is not removed from its clusters.
  • Disabling a group, nested groups, rights carried by a group, translated group names.