| Panel | ||||
|---|---|---|---|---|
|
...
You can create any number of users and user groups for Universal Controller, and you can assign any user to any user group.
The roles and permissions that you assign each user and group determines the level of access to Universal Controller functions.
You can assign any role and permission to any user or any user group. If you assign a user to a group, the user inherits all roles and permissions assigned to that group.
See LDAP Settings for information on how to set up Universal Controller to use LDAP authentication for:
Default Users and Groups
Default User
...
Administrator Group has access to all Controller functions; by default, it is assigned the ops.admin role, which has permissions on all Controller functions.Anchor Administrator Group Administrator Group - Everything Group has access to all functions that do not require the ops.admin role.
| Anchor | ||||
|---|---|---|---|---|
|
...
By default, a new user has no permissions. Until permissions are granted, a user can log into the Universal Controller user interface and view options in the Services, but cannot perform any tasks.
Step 1 | From the Administration navigation pane, select Security > Users. The Users list displays a list of all currently defined users. |
|---|---|
Step 2 | Enter/select Details for a new user, using the field descriptions below as a guide.
To display more of the Details fields on the screen, you can either:
|
Step 3 | Optionally, assign one or more roles to the user, assign the user to a group, or assign permissions to this user. |
Step 4 | Click a Save button. The user is added to the database, and all buttons and tabs in the User Details are enabled. |
| Note | ||
|---|---|---|
| ||
To open an existing record on the list, either:
|
| Anchor | ||||
|---|---|---|---|---|
|
...
The following User Details is for an existing user. See the field descriptions, below, for a description of all fields that display in the User Details.
| Anchor | ||||
|---|---|---|---|---|
|
...
Field Name | Description | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
Details | This section contains detailed information about the user. | |||||||||||
| Log in ID for this user. | |||||||||||
| Password of this user.
| |||||||||||
| First name of this user. | |||||||||||
| Middle name of this user. | |||||||||||
| Last name of this user. | |||||||||||
| Automatically generated from the First Name and Last Name of this user. | |||||||||||
| Email address of this user. | |||||||||||
| If enabled, the user will be prompted to reset the password at next login. | |||||||||||
| If enabled, locks out the user. This field is enabled automatically if the maximum number of successive failed login attempts has been reached by the user. | |||||||||||
| Login method(s) that the user can authenticate with. ( You can use the Ctrl key to select both multiple methods. Only one of Standard or Standard / Authenticator App (TOTP)can be selected, not both.
| |||||||||||
| Time zone of this user. When this user logs in, all scheduling times will be shown in the user's time zone, unless the trigger specifies a different time zone. | |||||||||||
| Business title of this user. | |||||||||||
| Business department of this user. | |||||||||||
| Business manager of this user. | |||||||||||
| Business phone number of this user. | |||||||||||
| Mobile phone number of this user. | |||||||||||
| Specifies whether or not the user can log in to the user interface.
| |||||||||||
| Specifies whether or not the user can log in to the Universal Controller Command Line Interface (CLI).
| |||||||||||
| Specifies whether or not the user can log in to the Universal Controller RESTful Web Services API.
| |||||||||||
| If enabled, the user ID is active and the user can log in. If disabled, the user is deactivated; the user will not appear in user lists and cannot be used for access to the Controller. | |||||||||||
| Personal Access Tokens | This section contains assorted detailed information about the applications that will access the Universal Controller Web Service APIs using the personal access token. | |||||||||||
| Expiration | Specifies when the personal access token expires. If left unspecified, the token never expires. | |||||||||||
| This section specifies the users that can be impersonated by this user on Universal Controller Web Service requests. | |||||||||||
| Allowed Impersonation Users | Specifies the users that can be impersonated by this user using the X-Impersonate-User HTTP header on Web Service requests. User impersonation requires the ops_user_impersonate role. Users with the ops_admin role can impersonate any user and do not need to specify Allowed Impersonation Users. | |||||||||||
Metadata | This section contains Metadata information about this record. | |||||||||||
UUID | Universally Unique Identifier of this record. | |||||||||||
Updated By | Name of the user that last updated this record. | |||||||||||
Updated | Date and time that this record was last updated. | |||||||||||
Created By | Name of the user that created this record. | |||||||||||
Created | Date and time that this record was created. | |||||||||||
Buttons | This section identifies the buttons displayed above and below the User Details that let you perform various actions. | |||||||||||
Save | Saves a new user record in the Controller database. | |||||||||||
Save & New | Saves a new record in the Controller database and redisplays empty Details so that you can create another new record. | |||||||||||
Save & View | Saves a new record in the Controller database and continues to display that record. | |||||||||||
New | Displays empty (except for default values) Details for creating a new record. | |||||||||||
Update |
| |||||||||||
Delete |
| |||||||||||
Refresh | Refreshes any dynamic data displayed in the Details. | |||||||||||
Close | For pop-up view only; closes the pop-up view of this user. | |||||||||||
Tabs | This section identifies the tabs across the top of the User Details that provide access to additional information about the user. | |||||||||||
User Roles | Allows you to assign roles to this user. | |||||||||||
Member of Groups | Allows you to assign this user to one or more groups.
| |||||||||||
Permissions | Allows you to assign permissions to this user. |
| Anchor | ||||
|---|---|---|---|---|
|
...
Any user assigned to a group inherits all roles and permissions assigned to that group.
Step 1 | From the Administration navigation pane, select Security > Groups. The Groups list displays a list of all currently defined groups. |
|---|---|
Step 2 | Enter/select Details for a new group, using the field descriptions below as a guide.
To display more of the Details fields on the screen, you can either:
|
Step 3 | Optionally, assign one or more roles to the group, assign members (users) to the group, assign other groups to this group, or assign permissions to this group. |
Step 4 | Click a Save button. The group is added to the database, and all buttons and tabs in the Group Details are enabled. |
| Note | ||
|---|---|---|
| ||
To open an existing record on the list, either:
|
| Anchor | ||||
|---|---|---|---|---|
|
The following Group Details is for an existing group. See the field descriptions, below, for a description of all fields that display in the Group Details.
...
Field Name | Description | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
Details | This section contains detailed information about the group. | |||||||||||
| Name of this group. | |||||||||||
Parent | Name of this group's parent group, if any. | |||||||||||
Description |
| |||||||||||
Email address for this group. | ||||||||||||
Manager | Universal Controller user that is the manager of this group. | |||||||||||
| Indication of whether or not to control the visibility of navigation pane entries in the Controller Services, via the Navigation Visibility field, for members of this Group. If Control Navigation Visibility is not checked (the default selection), all entries are visible. | |||||||||||
| If Control Navigation Visibility is enabled; Drop-down list of all Navigator entries.
| |||||||||||
Metadata | This section contains Metadata information about this record. | |||||||||||
UUID | Universally Unique Identifier of this record. | |||||||||||
Updated By | Name of the user that last updated this record. | |||||||||||
Updated | Date and time that this record was last updated. | |||||||||||
Created By | Name of the user that created this record. | |||||||||||
Created | Date and time that this record was created. | |||||||||||
Buttons | This section identifies the buttons displayed above and below the Group Details that let you perform various actions. | |||||||||||
Save | Saves a new group record in the Controller database. | |||||||||||
Save & New | Saves a new record in the Controller database and redisplays empty Details so that you can create another new record. | |||||||||||
Save & View | Saves a new record in the Controller database and continues to display that record. | |||||||||||
New | Displays empty (except for default values) Details for creating a new record. | |||||||||||
Update |
| |||||||||||
| Copy | Creates a copy of this Group, which you are prompted to rename. | |||||||||||
Delete |
| |||||||||||
Refresh | Refreshes any dynamic data displayed in the Details. | |||||||||||
Close | For pop-up view only; closes the pop-up view of this group. | |||||||||||
Tabs | This section identifies the tabs across the top of the Group Details that provide access to additional information about the user. | |||||||||||
Group Roles | Allows you to assign roles to this group. | |||||||||||
Group Members | Allows you to assign users to this group.
| |||||||||||
Child Groups | Allows you to assign other groups to this group. | |||||||||||
Permissions | Allows you to assign permissions to this group. |
| Anchor | ||||
|---|---|---|---|---|
|
For information on how to access additional details - such as Metadata and complete database Details - for Users and Groups (or any type of record), see Records.
| Anchor | ||||
|---|---|---|---|---|
|
...
Step 1 | Open the User or Group record. |
|---|---|
Step 2 | Click the Group Members tab. |
Step 3 | For a User, either:
|
Step 4 | To filter the Users/Groups listed in the Collection window, enter characters in the text field above the Name column. Only Users/Groups containing that sequence of characters will display in the list. |
Step 5 | To assign a User to a Group, move the User/Group from the Collection window to the List window:
To unassign the User to a Group, move the User/Group from the List window to the Collection window:
|
Step 6 | Click Save. |
| Anchor | ||||
|---|---|---|---|---|
|
Users with the ops.admin role or the ops_user_admin role can control, via the Control Navigation Visibility and Navigation Visibility fields in the Group Details for a Group, which entries in the Controller Services are visible to users in that Group.
...
User in Multiple Groups | If a user belongs to multiple Groups, and for any of those Groups the Control Navigation Visibility is not enabled, Navigator visibility for that user is not controlled. |
|---|---|
User in Multiple Groups | If a user belongs to multiple Groups, and for all of those Groups navigation visibility has been deselected for one or more entries, the visible entries from all Groups will be merged. That is, if an entry is not visible to users in Group A, but the entry is visible to users in Group B, the entry will be visible to any user belonging to both Groups. |
Navigation Pane | If all entries in a folder of a navigation pane (for example, the Tasks folder in the Automation Center navigation pane) are not visible to a Group, that folder does not display for any user in that Group. |
Navigation Pane | If all entries in a navigation pane are not visible to a Group, that navigation pane does not display for any user in that Group. |
Automation Center Navigation Pane | If a Group does not have visibility to one or more entries in the configurable Automation Center navigation pane, those entries are not available for configuration for any user in that Group. |
Trigger Types / Task Types | If a Group does not have visibility to a specific Trigger type or Task type, that Trigger type or Task type does not display in the New drop-down menu on the All Triggers list or the All Tasks list for any user in that Group. |
Universal Task Types | Dynamically created Universal Task type entries are available for selection / deselection in the Navigation Visibility field. |
User Roles | The role selections for any user override any navigation visibility selections for any Group in which that user is a member. |
User Roles | Navigation visibility selections for a Group do not apply to any users in the Group with the ops_admin role. |
| Anchor | ||||
|---|---|---|---|---|
|
...
Impersonating a User
Users with the ops_admin role, the ops_user_admin role, or the ops_user_impersonate role are able to specify an X-Impersonate-User HTTP header, in additional to their authentication header/parameter, when invoking Universal Controller Web Service APIs.
The X-Impersonate-User HTTP header is specified as the User Id of the user to be impersonated.
Users with the ops_admin role can impersonate any user.
Users with only the ops_user_admin role or the ops_user_impersonate role must explicitly declare which users can be impersonated in the Allowed Impersonation Users field.