Users

User Management

User management within Skyve applications is accessed from the Admin -> Security Admin -> Users menu. This allows new users to be added, existing users to be marked inactive or deleted, and user permissions to be updated.

Security Implementation

In Skyve, security is implemented within Roles and Groups. Groups are used to combine roles into a defined collection of permissions which is useful for structuring Roles for multiple Users. Roles on the other hand allow for more control over an individual User’s Roles within an application.

Users can have multiple groups assigned to them which cover their Roles to use the application, additional Roles can then be added to that User if it doesn’t make sense to define a new Group.

Security groups

A group is a combination of module-specific roles typically combined to represent a user access profile related to a business access profile.

Typically (not always) users will require a combination of roles to be able to access Skyve applications, for example, a back-end (staff) user may require:

• basic user privileges to the admin module to be able to manage their own user account, change password and contact details and view contact details of other back end users
• a role declared in the module(s) for your custom application.

The roles configured by default for the Skyve admin module are as follows:

Role	Explanation	Description
Anonymous		Access anonymous (not signed in) public features
AppUser	The App User role is intended for retail and public users interacting through the “front office”. These users are assumed to operate within their own scope and have only visibility to their own data. App Users can create their own contacts, and change their own passwords.	Manage own contact details and password
AuditManager		Manage the activity audit log
BasicUser	The intention of Basic User role is to provide basic capability to back-office users. The role is for a typical office situation where users collaborate within the “Customer” scope on key application areas. For example, shared contact management, common document number serials and the ability to use Skyve’s basic personal efficiency and automation capabilities, Tags, Snapshots, Communication and view dashboards.	General access to the administration module
ContactManager	Allows atomic control over management of, and interaction with, contacts.	Manage contact details and interactions
ContactViewer	Allows atomic control over visibility of contacts.	View-only access to contact details
DevOps		Generate Skyve designs and metadata and administer technical aspects of the Skyve runtime
JobMaintainer	Allows atomic control over the ability to schedule jobs and review job progress.	Maintain Jobs
SecurityAdministrator	Administration of users and permissions.	Allows administration of Users and Groups
ViewUser	The view user is intended as a read-only office user, with visibility as per Basic User role.	View-only access to the administration module

Groups can be further combined on a per user basis and user creation provides for selection of groups.

Groups can also be combined for customer-specific combinations, however these combinations are set at design-time by the developer. For more information see the developer guide.

Adding a new group

1. Login with a user which has the SecurityAdministrator role
2. Navigate to the Admin module, and select Groups under Security Admin
3. From the group list, click the + button to open the new group view

1. Enter a Group Name and Description
2. Add the desired combination of roles to the group by selecting them in the Available Roles list and clicking the right arrow (>) to move them to Assigned Roles

Once a group has been saved, zooming into it also provides a Users in Group tab — a quick way to audit which users hold a particular set of permissions.

Adding a new User

Prerequisites: You have at least one group created for user permissions (see above) — or you can create one inline during the wizard’s group step by choosing the New group option.

1. Login with a user which has the SecurityAdministrator role
2. Navigate to the Admin module, and select Users under Security Admin
3. From the user list, click the + button to open the new user view

1. Click New Contact
   1. (alternatively, you can enter a name or email address of an existing Contact in the system and click Search to create a User for a Contact)
2. Enter the full name and email address of the new user and click Next

1. Change the generated username if required
2. Enter a matching password and confirm password, then click Next
3. Select the groups the new user will be added to by selecting them in the Available Groups list then clicking the right arrow (>) to move them to Assigned Groups (or choose New group to create a group inline)
4. Click OK to save the user

When editing an existing user, Security Administrators can also click Generate UserName to generate a unique username for the user.

Inviting new users and bulk user creation

To have the system send an invitation email to one or multiple new users, you can use the invitation feature. Invited users will receive an email with a link to the application, allowing them to choose their own password on first login.

Prerequisites:

• Your application has its SMTP settings configured to enable sending email
• You have at least one group created for user permissions (see above)

1. Login with a user which has the SecurityAdministrator role
2. Navigate to the Admin module, and select Users under Security Admin
3. Select the Invite Users tab
4. From the list of Groups, assign any group permissions new users will have after they are invited by selecting the group(s) and clicking the right arrow (>) — at least one group must be selected or the invitation will not proceed
5. Optionally select the Default Module Name — the module invited users will see when they first sign in
6. Enter a list of email addresses to be sent invitations into the text area below, separated by spaces, commas, semicolons or new lines

If you have email configured:

• press the Create and Invite Users button.

This will initiate a Skyve Job (reviewable from the Admin->Jobs menu) to create each new user record and send each user a password reset token.

The wording of the invitation email can be customised by creating a Communication named SYSTEM User Invitation — the system’s default subject is “Invitation to join”.

If you have not yet configured email:

• use the Create Users (no invitation) button and advise the users another way.

This will initiate a Skyve Job to create the new user records, but without the email. When users access the Skyve application log in page, they can take advantage of the password reset function without a password reset token.

Adding a Group or Role to a User

Prerequisites: You have at least one user you wish to add permissions to

1. Login with a user which has the SecurityAdministrator role
2. Navigate to the Admin module, and select Users under Security Admin
3. Zoom into the user you wish to add a Group or Role to
   1. If you wish to add a Group to a user, navigate to the Groups tab, click the group you wish to add and click the > button to add it to the Assigned collection
   2. If you wish to add a Role to a user, navigate to the Roles tab, click the + button in the User Roles table, select the role you wish to add to the user, then click ‘Zoom Out’

Note: after changing permissions for a User, that user will need to log out and then log back in to apply the new permissions if they are already logged in.

Deactivating a User

• It is best practice to set a user inactive rather than delete them as there may be existing references to the user.
• Setting a user inactive prevents them from accessing the system while ensuring references to them within the system are not broken.

Prerequisites: You have at least one active user

1. Login with a user which has the SecurityAdministrator role
2. Navigate to the Admin module, and select Users under Security Admin
3. Zoom into the user you wish to deactivate
4. Click Inactive so that it is ticked
5. Click OK

Resetting a password

If a user has forgotten their password, or you need to reset it for any reason, an administrator can do so from the Users view.

1. Login with a user which has the SecurityAdministrator role
2. Navigate to the Admin module, and select Users under Security Admin
3. Zoom into the user you wish to reset the password for
4. Navigate to the Password tab
5. Either specify a new and confirm password for the user, or click the Generate Password button to generate a new password for the user (the password will be displayed in the Generated password field)
6. Tick Must change password so the user is required to set their own password the next time they sign in
7. Click OK
8. Notify the user of their new password

Activating a self-registered user

If User Self-Registration is enabled for your application, self-registered users activate their own account via the link in their activation email. An administrator can manage activation from the user’s record:

1. Login with a user which has the SecurityAdministrator role
2. Navigate to the Admin module, and select Users under Security Admin
3. Zoom into the user
4. On the Profile tab, tick Account Activated to activate the account manually (for example, if the user cannot receive the activation email)
5. Alternatively, click Resend Activation to send the user a fresh activation email — their previous activation link will no longer work

Data Groups

Data Groups partition data within an application — a user assigned to a data group only sees records belonging to that data group, while users with no data group assigned can see records across all data groups (subject to their other permissions). Data groups are separate from security groups: security groups control what a user can do, data groups control which records they can see.

To manage data groups:

1. Login with a user which has the SecurityAdministrator role
2. Navigate to the Admin module, and select Data Groups under Security Admin
3. Click the + button to add a data group, and give it a Name and Description

To assign a user to a data group, zoom into the user from Users under Security Admin and select the Data Group on the Profile tab. The Profile tab also provides the Home Module setting, which controls which module the user lands in when they first sign in.