.. /* * This file is part of the SavaPage project . * Copyright (c) 2026 Datraverse B.V. * Author: Rijk Ravestein. * * SPDX-FileCopyrightText: (c) 2020 Datraverse B.V. * SPDX-License-Identifier: CC-BY-SA-4.0 * * For more information, please contact Datraverse B.V. at this * address: info@datraverse.com */ .. _ch-webapp-admin-user-groups: Groups ------ .. contents:: |RST_TABLE_OF_CONTENTS| :depth: 2 :local: .. _ch-webapp-admin-user-groups-intro: Introduction ~~~~~~~~~~~~ Groups are collections of users. You can :ref:`Add and Remove ` groups as present in the external :ref:`User Source ` or :ref:`Internal Group ` definition. .. note:: SavaPage caches group members for performance reasons. Therefore, when group membership changes at the source, it may not be immediately known in |PRODUCT_NAME|. The membership cache is updated automatically according to the *“Import new users overnight”* option in the :ref:`User Creation ` section, but can be also be refreshed manually at any time by a push on a button in the same section. .. _ch-webapp-admin-user-groups-built-in: Built-in Groups ~~~~~~~~~~~~~~~ There are three built-in groups: - *All Users* : all users in the system. - *External Users* : all users synchronized from the external :ref:`User Source `. - *Internal Users* : all users created inside |PRODUCT_NAME|. See :ref:`Internal Users `. .. _ch-webapp-admin-user-groups-list: Group List ~~~~~~~~~~ After a *tap* on the |RST_BUTTON_GROUPS| button in the main menu this panel is shown. See :ref:`Menu `. .. _ss-admin-user-group-list: .. figure:: ../images/manual/screenshots/admin/sp-01-03-user-group-list.png :alt: Admin Web App: User Group - List :width: 400 Admin Web App: User Group - List Built-in groups are depicted in orange. Press the |RST_BUTTON_ADD_AND_REMOVE| button to :ref:`add additional groups `. Each item in the list shows the number of members and has buttons to jump to other dialogs. From left to right, these buttons bring you to: - The :ref:`Edit Group ` dialog. - The :ref:`User List ` with the group preselected. *Note: the button is not visible when number of group members is zero.* - The :ref:`Account List ` with the Group Type and Name preselected. *Note: the button is not visible when the (lazy created) Group Account is not present yet.* .. note:: Due to :ref:`Admin Privileges ` certain buttons might *not* be visible. Also, some buttons are *not* visible if :ref:`System Status ` says |RST_GUILABEL_SETUP_IS_NEEDED| .. _ss-admin-user-group-select-and-sort: .. figure:: ../images/manual/screenshots/admin/sp-01-03-user-group-select-and-sort.png :alt: Admin Web App: Group - Select and Sort :width: 400 Admin Web App: Group - Select and Sort - Groups can be selected by entering a part (fragment) of their name. - The list can be sorted |RST_BUTTON_ASCENDING| or |RST_BUTTON_DESCENDING| on group name. - *Tap* the |RST_BUTTON_APPLY| button to (re)display the list. - A *tap* on the |RST_BUTTON_DEFAULT| button resets the selection and sort fields to their default values. - Use the |RST_BUTTON_MINUS_SYMBOL| button to collapse the Select and Sort section. .. _ch-webapp-admin-user-groups-list-item: Group List Item ^^^^^^^^^^^^^^^ Each Group List Item displays the number of enabled and disabled :ref:`Group Roles `, :ref:`User Privileges ` and :ref:`Admin Privileges ` objects with their respective icon. A green color means that the objects are enabled, a red color means they are disabled. Additionally, the |image24| icon is shown with the number of :ref:`Shared Accounts ` the User Group has access to. A description of the objects is displayed as a tooltip when pointed to with the mouse. An example item is shown below. .. figure:: ../images/manual/screenshots/admin/sp-01-03-user-group-list-item.png :alt: Admin Web App: Group - List Item :width: 400 Admin Web App: Group - List Item .. note:: Roles and Privileges that are resolved by User Group membership are shown in the :ref:`User List Item ` of a member. .. _ch-webapp-admin-user-groups-add-remove: Add & Remove Groups ~~~~~~~~~~~~~~~~~~~ .. _ss-admin-user-groups-add-remove: .. figure:: ../images/manual/screenshots/admin/sp-01-03-user-groups-add-remove.png :alt: Admin Web App: User Groups - Add & Remove :width: 400 Admin Web App: User Groups - Add & Remove Select the groups to add and to remove and press the |RST_BUTTON_OK| button to commit the selection. .. note:: The group list is a mix from the ones present in the external :ref:`User Source ` and the ones defined as :ref:`Internal Group `. When adding a user group from Microsoft Active Directory, members from nested groups are included. .. _ch-webapp-admin-user-group-edit: Edit Group ~~~~~~~~~~ The Group Edit Dialog has several sections. Press the |RST_BUTTON_OK| button at the bottom to commit all changes. .. _ch-webapp-admin-user-group-edit-roles: Group Roles ^^^^^^^^^^^ .. _ss-admin-user-group-edit: .. figure:: ../images/manual/screenshots/admin/sp-01-03-user-group-edit-roles.png :alt: Admin Web App: User Group - Edit - Roles :width: 400 Admin Web App: User Group - Edit - Roles In the |RST_GUILABEL_ROLES| section you can set the user roles for group members. See :ref:`User Roles ` for an explanation of the roles and how role based user access works. .. note:: A summary of enabled/disabled roles is displayed in the :ref:`Group List Item `. Roles that are resolved by User Group membership are shown in the :ref:`User List Item ` of a member. .. _ch-webapp-admin-user-group-edit-user-privileges: User Privileges ^^^^^^^^^^^^^^^ .. figure:: ../images/manual/screenshots/admin/sp-01-03-user-group-edit-privileges-user.png :alt: Admin Web App: User Group - Edit - User Privileges :width: 400 Admin Web App: User Group - Edit - User Privileges In the |RST_GUILABEL_USER_PRIVILEGES| section you can set group member access to :ref:`User Web App ` domain objects. Privileges are set by means three-state buttons. An unselected *grayed out* button means “indeterminate”, plain unselected means “non-privileged” and selected means “privileged”. When a privilege on a domain object is selected a role like |RST_BUTTON_READER| and |RST_BUTTON_EDITOR| might be selected, as well as extra actions like |RST_BUTTON_DOWNLOAD|, |RST_BUTTON_SEND| and |RST_BUTTON_SIGN|. The type of Roles and Actions offered depend on the type of domain object. This is how choices work out: - If |RST_BUTTON_SAFEPAGES| is non-privileged, the |image25| PDF and |image26| Sort buttons are *not* displayed in the :ref:`Main Page `. When privileged: - |RST_BUTTON_READER| role will display the |image25| PDF button if |RST_BUTTON_DOWNLOAD| or |RST_BUTTON_SEND| action is enabled. Reader role will *not* display the Sort button. - |RST_BUTTON_EDITOR| role will display both |image25| PDF and |image26| Sort buttons. - If |RST_BUTTON_DOWNLOAD| and |RST_BUTTON_SEND| actions are both *disabled* the |image25| PDF button will not show. - Enabled |RST_BUTTON_DOWNLOAD| and |RST_BUTTON_SEND| actions display the respective buttons in the :ref:`PDF ` dialog. The enabled |RST_BUTTON_SIGN| action displays the same option in the :ref:`PDF Security ` section. - If |RST_BUTTON_USER_DETAILS| is non-privileged the footer button for the :ref:`User Details ` dialog is replaced with a simple indicator holding the id of the authenticated user. - If |RST_BUTTON_PERSONAL_PRINT| is non-privileged, use of :ref:`Personal Account ` for printing is not allowed. User can use Shared Accounts though, when permitted by :ref:`Access Control `. When printing with Personal and Shared Account is *not* permitted, role :ref:`Print Job Creator ` is assumed, even when this role is explicitly selected. - If |RST_BUTTON_QUEUE_JOURNAL| is privileged a Print-in Job is journalled. Beware, that this function can be disabled for individual queues: see :ref:`Edit Queue `. When privileged: - |RST_BUTTON_READER| role will show the |RST_BUTTON_DOWNLOAD| and |RST_BUTTON_SELECT| privileges. - |RST_BUTTON_EDITOR| role will additionally show the |RST_BUTTON_DELETE| privilege. - Enabled |RST_BUTTON_DOWNLOAD|, |RST_BUTTON_SELECT| and |RST_BUTTON_DELETE| privileges will display the respective buttons in the :ref:`Document Log `. - If |RST_BUTTON_PRINT_JOURNAL| is privileged a Print Job will be silently journalled. If |RST_BUTTON_PRINT_ARCHIVE| is privileged, the :ref:`Print Job Archive ` option is active: if |RST_BUTTON_SELECT| is privileged, the user is allowed to (de) select the archive, when not, the Print Job will be silently archived. Beware, that these functions can be disabled for individual printers: see :ref:`Edit Proxy Printer `. - If |RST_BUTTON_FINANCIAL| is non-privileged, the account balance will not show in the :ref:`footer `, the Transactions button will not show in the :ref:`Log ` page, and Financial data will not show in the :ref:`User Details ` dialog. When selected, the Reader and Editor role will display all. However, only the Editor role is allowed account transactions in the :ref:`User Details ` dialog. Editor role is also required to login to the :ref:`Payment Web App `. - If |RST_BUTTON_LETTERHEAD| is non-privileged, the |image27| Letterhead button is not displayed. When privileged the Reader and Editor role allows user to choose a Letterhead in the :ref:`PDF ` and :ref:`Print ` dialog. The Editor role allows users to add letterheads themselves. See :ref:`Letterheads `. - The open spots left by buttons that are not displayed are taken by: the Upload button (moved from the footer), a Browse button pointing to the :ref:`Browser `, and an Info button (pointing to the :ref:`About ` dialog), in that order. See :ref:`Footer `. This is how a privilege is evaluated on runtime: - To be compatible with existing installations the “indeterminate” state for top level group “All Users” is interpreted as fully “privileged”. Of course, privileges can also be set at "lower" group levels. When determining privileges for a domain object, |PRODUCT_NAME| looks at the lowest group first, and bubbles up to higher groups till a “non-indeterminate” privilege for the domain object is found. - A denial of access due to a privilege takes precedence over any other configuration property. .. note:: A summary of enabled/disabled privileges is displayed in the :ref:`Group List Item `. Privileges that are resolved by User Group membership are shown in the :ref:`User List Item ` of a member. .. _ch-webapp-admin-user-group-edit-admin-privileges: Admin Privileges ^^^^^^^^^^^^^^^^ In the |RST_GUILABEL_ADMINISTRATOR_PRIVILEGES| section you can set group member access to :ref:`Admin Web App ` domain objects. The objects correspond to the choices in the :ref:`main menu `. Any user with :ref:`Administrator Role ` is assigned privileges by group membership. .. figure:: ../images/manual/screenshots/admin/sp-01-03-user-group-edit-privileges-admin.png :alt: Admin Web App: User Group - Edit - Admin Privileges :width: 400 Admin Web App: User Group - Edit - Admin Privileges Privileges are set and evaluated by means three-state buttons, just as :ref:`User Privileges `. For most domain objects a |RST_BUTTON_READER| and |RST_BUTTON_EDITOR| role can be selected. Access to domain objects will be shown or hidden according to the privileges. .. note:: A summary of enabled/disabled privileges is displayed in the :ref:`Group List Item `. Privileges that are resolved by User Group membership are shown in the :ref:`User List Item ` of a member. .. _ch-webapp-admin-user-group-edit-new-user-settings: New User Settings ^^^^^^^^^^^^^^^^^ .. figure:: ../images/manual/screenshots/admin/sp-01-03-user-group-edit-new-user-settings.png :alt: Admin Web App: User Group - Edit - New User Settings :width: 400 Admin Web App: User Group - Edit - New User Settings If |RST_GUILABEL_NEW_USER_SETTINGS| are *enabled* they are automatically applied upon :ref:`User Creation ` for members of this group. Note that these settings do **not** affect existing user members. See the :ref:`Financial ` section of the :ref:`Edit User ` dialog for a description of the Balance and Credit Limit fields. When a user belongs to **multiple** groups, the |RST_GUILABEL_NEW_USER_SETTINGS| of these groups is applied as follows: - The user is assigned an initial Balance that is the *sum* of the Initial Balances of *all* matching groups (with the exception of the :ref:`Built-in Groups `). - If *any* of the matching groups has Initial Credit Limit “None” the user is assigned this status. - Since the New User Settings are applied in alphabetical group name order, the Initial Credit Limit “Default” and “Individual” are assigned from the *last* group. If a user does **not** belong to any group with New User Settings enabled, user is assigned the settings of the “External Users” or “Internal Users” :ref:`Built-in Group ` (depending on the type of :ref:`User Source `). .. note:: New User Settings are not shown for Built-in Group “All Users” because they are never used. .. /* * Images */ .. |image24| image:: ../images/manual/famfamfam-silk_tag_green-no-alpha.png :width: 16px .. |image25| image:: ../images/manual/screenshots/user/sp-01-00-user-main-button-pdf.png :width: 20px .. |image26| image:: ../images/manual/screenshots/user/sp-01-00-user-main-button-sort.png :width: 20px .. |image27| image:: ../images/manual/screenshots/user/sp-01-00-user-main-button-letterheads.png :width: 20px