Skip to main content

People and access

One administrator exists. This session gives the others their place: a role is held in one environment, a person gets it directly or through a directory group, and a script gets a token instead of a password.

Before this session​

  • You are signed in as the first administrator, from First sign-in and the first environment.
  • For Active Directory: the team that runs the directory can give you a read-only service account, the controllers' addresses and the certificate of the authority that issued their certificates.

In this session​

  1. Read the four built-in roles and what each may do, on Users, roles and access. Editor is the role most people who publish APIs hold; Viewer reads and changes nothing.
  2. Create a local user on the Users tab and give them a role in the environment, as the same page shows.
The Users tab of Users and access, with the list of people, the New user button and Add from directory.
  1. Connect Active Directory on the Directory tab, test the connection, and map a directory group to a role in the environment. Connect Active Directory walks the form field by field and says what the server does with the directory. A person in the group signs in on the same form as everyone else, with their domain account.
The Directory tab with a connected Active Directory: the servers, the TLS mode, the CA, the bind account, the base DNs, the last bind and the group mappings below.
  1. Add one person from the directory without a group, with Add from directory, when a single person needs access before their group is mapped: Give one directory user a role.
  2. Create a service account on the Service accounts tab and copy its token once, for a script that will call the API. Service accounts and the API says how the token is used; the call itself is on the same page, under the API.

What you should see​

The users list shows the administrator, the local user and, once a directory person has signed in, their account with the role their group maps to. In our lab that was a person from a mapped group signing in for the first time, with the account created at that moment from the directory's own name and email. Each person's page says in its access table whether a role came directly or by group. A Viewer who signs in sees the lists and no buttons that change anything, as the last section of Users, roles and access describes.

Where this leads​

The environment has people in it. Your first API publishes the first route, as an Editor would.

G8 dev