Authroization Setup

Introduction

This comprehensive guide outlines the roles, permissions, and processes involved in managing user access and privileges within our application. Whether you are a Superadmin, Project Admin, or a regular user, this documentation will equip you with the necessary knowledge to effectively control access to projects and dashboards.

In this documentation, you will discover step-by-step instructions on how to request access to the application and projects, as well as the approval process undertaken by the Superadmins. Additionally, you will learn how Superadmins and Project Admins can efficiently manage user permissions, granting or revoking access as needed.

We also delve into the Auto Approval feature, which simplifies the access request process for certain roles, enabling a seamless experience for both users and administrators.

We understand the criticality of managing user permissions securely and efficiently, and this documentation empowers you to do just that. Whether you are a new user seeking to understand your access privileges or an administrator aiming to streamline permission management, this guide will serve as your go-to resource.

System Roles

	Project Role	Permissions
1	ROLE_VIEWER	Any new user registration will be assigned ROLE_VIEWER. The user will not be able to view data for any project unless given permission of the project/s. Users can request access to any project with any role. Users can add a new project and the user will be project admin on added project/s.
2	ROLE_PROJECT_VIEWER	Any user can be assigned ROLE_PROJECT_VIEWER on one or more projects. Users can view dashboard/s having ROLE_PROJECT_VIEWER access on the project/s but will not be able to modify any configuration, and cannot run processor User can create their own project and modify configuration, run processor, after creating a project user becomes PROJECT_ADMIN of that project and possesses all the rules of ROLE_PROJECT_ADMIN
3	ROLE_PROJECT_ADMIN	Any user can be a project admin on one or more projects. User with ROLE_PROJECT_ADMIN access will be able to view the dashboard/s and will be able to edit the configuration of the project/s. Can grant/reject the access request to the project the ROLE_PROJECT_ADMIN rolled user has access. They have the permission to delete processor’s data, refer Processor Execution to delete processor’s data
4	ROLE_SUPERADMIN	The user of this group will have all the permission. They can view all the configured projects and can change the configuration at the instance level including adding new projects. Only users with ROLE_SUPERADMIN will be able to approve access requests of login raised by users. Can grant/reject the access request of any project raised by users. They can see/modify the role of other users. They can change the projects access. They have the permission to delete processor’s data, refer Processor Execution to delete processor’s data
5	ROLE_GUEST	Any user can be assigned ROLE_GUEST on one or more projects. Users can view dashboard/s having ROLE_GUEST access on the project/s but will not be able to access the setting section.

How to Request for Permission

There are two types of requests:

To Get access to the application, which can be seen under User Access Request.

Whenever a user registers in the application, its request get notified to the Superadmin users of the instance, until any of the Superadmin user approves the request the user won’t be able to login to the application.

The SUPERADMIN user has the permission to approve or reject a request to access dashboard, whose notification is sent to the user’s registered email.

Note: AD Login user do not require any approval to access dashboard.

To get access for the project requested, which can be seen under Project Access Request

After being approved from SUPERADMIN to access dashboard, user needs to get access to required project to see KPIs loaded.

The user should select the required projects along with the roles.

Note: if a user select option from parent level hierarchy, all the child level items will automatically get selected. User can select multiple options from drop down.

How to Approve/Decline Request

The Superadmin user can grant or reject the user’s request for dashboard access, after clicking on the notification, and on Grant User Access option under Profile Mgmt. tab.

The Superadmin/ Project Admin user can grant or reject the project’s access request, after clicking on the notification, and on Grant Project Access option under Profile Mgmt. tab.

The approver can even modify the role requested by the user.

How to Manage User Permissions ( No request needed)

The Superadmin / Project admin user has a right to alter or modify the role or access level of any project which will get notified to the user through email.

To alter the request no request is required, the admin can add/ remove the project by clicking on the “+” icon to alter the access levels.

to add/ remove the project or change the access level of the hierarchy, the admin can add and save the options as shown below.

to change the the Role, the admin can opt any role from the edit role drop down, or can even remove the row, to revoke any accessibility to any project to that user and save from the window as shown.

How to Enable Auto Approval of Permission Request

SUPERADMIN has a feature to automatically approve the projects access request from other set of users possessing Project Viewer, Project Admin or Guest Role.

If the Auto Approval toggle is enabled, then those requests will get auto approved automatically and user can directly access the requested project.