Enportal/old/provisioning: Difference between revisions

imported>Andy.hopper
No edit summary
imported>Jason.nicholls
 
(40 intermediate revisions by 4 users not shown)
Line 1: Line 1:
{{DISPLAYTITLE:enPortal Provisioning}}
{{DISPLAYTITLE:enPortal Provisioning}}
This topic details how the enPortal administrator can configure each element of User management. First, we present the concepts of establishing the basic User organization. Then we detail usage of the specific administration tools and interfaces. The primary elements of the User management are Domains, Users, Roles and Actors.
[[Category:enPortal old]]
 
This topic details how the enPortal administrator can configure each element of User management. First, we present the concepts of establishing the basic User organization. Then we detail usage of the specific administration tools and interfaces. The primary elements of the User management are Domains, Users, and Roles.
 
{{Note|enPortal 5.0 and above shares the same install bundle and runs within the same tomcat instance as AppBoard. Please also refer to the latest [[appboard/2.4/admin/provisioning|Users, Roles, Domains and Content Provisioning]] documentation which applies equally for enPortal only installs.}}


== Basic Provisioning Concepts ==
== Basic Provisioning Concepts ==


Provisioning is how you create Users and Roles in AppBoard, and then provide the appropriate targeted information to them.  For an overview of basic provisioning concepts, see the article: [[Provisioning_Basics|Provisioning Basics]]
Provisioning is how you create Users and Roles in enPortal, and then provide the appropriate targeted information to them.  For an overview of basic provisioning concepts, see the article: [[appboard/old/provisioning_basics|Provisioning Basics]]


== Provisioning in the enPortal Administration User Interface ==
== Provisioning in the enPortal Administration User Interface ==
Line 34: Line 32:


# Log in to enPortal as an administrator.
# Log in to enPortal as an administrator.
# Select the <b>Users</b> tab. The Domain <b>Explorer</b> panel is displayed.
# Mouse over the '''Provisioning''' tab and click on '''Users'''. The Domain <b>Explorer</b> panel is displayed.
# In the Domain <b>Explorer</b> panel, right-click on the <b>Domains</b> folder and select <b>New Domain</b>.
# In the Domain <b>Explorer</b> panel, right-click on the <b>Domains</b> folder and select <b>New Domain</b>.
# Enter a name for the Domain and click <b>Save</b>.
# Enter a name for the Domain and click <b>Save</b>.
Line 43: Line 41:


# Log in to enPortal as an administrator.
# Log in to enPortal as an administrator.
# Select the <b>Users</b> tab. The Domain <b>Explorer</b> panel is displayed.
# Mouse over the '''Provisioning''' tab and click on '''Users'''. The Domain <b>Explorer</b> panel is displayed.
# In the Domain <b>Explorer</b> panel, click on the Domain that you wish to modify.
# In the Domain <b>Explorer</b> panel, click on the Domain that you wish to modify.
# Click the <b>General</b> sub-tab to modify the general properties of the Domain.
# Click the <b>General</b> sub-tab to modify the general properties of the Domain.
Line 61: Line 59:


# Log in to enPortal as an administrator.
# Log in to enPortal as an administrator.
# Select the <b>Users</b> tab. The Domain <b>Explorer</b> panel is displayed.
# Mouse over the '''Provisioning''' tab and click on '''Users'''. The Domain <b>Explorer</b> panel is displayed.
# In the Domain <b>Explorer</b> panel, right-click on the <b>Domains</b> folder and select <b>Delete</b>.
# In the Domain <b>Explorer</b> panel, right-click on the <b>Domains</b> folder and select <b>Delete</b>.
# Click <b>Ok</b> to confirm deletion.
# Click <b>Ok</b> to confirm deletion.
# Confirm that the Domain is no longer displayed as a folder in the Domain <b>Explorer</b> panel.
# Confirm that the Domain is no longer displayed as a folder in the Domain <b>Explorer</b> panel.


==== Password Policy For A Domain ====
<br>
The password policy can be set for individual domain by specifying a custom password policy for the domain. The password policy specified for a domain takes precedence over the [[enportal/5.4/admin/system_administration/System_Settings#System_Password_Policy|system policy]].
The setting in the domain password policy will affect only the users in the domain. If domain's users are managed by external ldap and you allow for passwords to be changed (subject to limitation in the note below), it is strongly recommended that the domain policy matches that of LDAP because most of the LDAPs do not give good error messages when user's password failed its policy.
===== Assigning a Domain Password Policy =====
Perform the following steps to assign a domain password policy.
# Log in to enPortal as an administrator.
# Mouse over the '''Provisioning''' tab and click on '''Users'''. The Domain <b>Explorer</b> panel is displayed.
# In the Domain <b>Explorer</b> panel, right click on the Domain that you wish to set password policy on.
# Click the <b>Password Policy</b> context menu.
# Make the desired changes in the three sections: '''Password''', '''Syntax''', and '''Lockout'''
# Click the ''Save'' button.
# Confirm that the correct policy is applied by changing a test user's password.
{{Note|In order to change password for users that are managed by ldap, you must specified a [[enportal/old/ldap_configuration#Configuring_LDAP_Managed_Domains|Pluggable Authenticator]] in the domains managed by this ldap and with [[enportal/old/ldap_configuration#Configuring_LDAP_Repositories|Repository URL]] starts with <tt>ldaps://</tt> and <tt>secured port #</tt> (default 636).<br/><br/>Additionally some ldaps like MS Active Directory and OpenLDAP requires ldap server's SSL certificate to be imported into java cert library running portal. Please read this [[enportal/old/ldap_configuration#LDAP_With_SSL|section]] on how to set it up. Additional example for importing MS Active Directory SSL certificate into java cert lib can be found [https://confluence.atlassian.com/display/CROWD/Configuring+an+SSL+Certificate+for+Microsoft+Active+Directory here].<br/><br/>Currently portal is delivered with two authenticators that allowed for ldap user password changes: '''Microsoft Active Directory''' and '''OpenDS'''.}}


=== Users ===
=== Users ===
Line 79: Line 96:


# Log in to enPortal as an administrator.
# Log in to enPortal as an administrator.
# Select the <b>Users</b> tab. The Domain <b>Explorer</b> panel is displayed.
# Mouse over the '''Provisioning''' tab and click on '''Users'''. The Domain <b>Explorer</b> panel is displayed.
# In the Domain <b>Explorer</b> panel, right-click on the folder for the Domain into which you are adding the User and select <b>New User</b>.
# In the Domain <b>Explorer</b> panel, right-click on the folder for the Domain into which you are adding the User and select <b>New User</b>.
# Enter a User name and password for the User and click <b>Save</b>.
# Enter a User name and password for the User and click <b>Save</b>.
Line 88: Line 105:


# Log in to enPortal as an administrator.
# Log in to enPortal as an administrator.
# Select the <b>Users</b> tab. The Domain <b>Explorer</b> panel is displayed.
# Mouse over the '''Provisioning''' tab and click on '''Users'''. The Domain <b>Explorer</b> panel is displayed.
# In the Domain <b>Explorer</b> panel, expand the folder for the Domain of the User.
# In the Domain <b>Explorer</b> panel, expand the folder for the Domain of the User.
# Click on the User that you wish to modify.
# Click on the User that you wish to modify.
Line 101: Line 118:


# Log in to enPortal as an administrator.
# Log in to enPortal as an administrator.
# Select the <b>Users</b> tab. The Domain <b>Explorer</b> panel is displayed.
# Mouse over the '''Provisioning''' tab and click on '''Users'''. The Domain <b>Explorer</b> panel is displayed.
# In the Domain <b>Explorer</b> panel, expand the folder for the Domain of the User.
# In the Domain <b>Explorer</b> panel, expand the folder for the Domain of the User.
# Right-click on the User and select <b>Delete</b>.
# Right-click on the User and select <b>Delete</b>.


=== Roles ===
=== Roles ===
Line 112: Line 128:




Perform the following steps to create an AppBoard Role:
Perform the following steps to create an enPortal Role:


# Log in to enPortal as an administrator.
# Log in to enPortal as an administrator.
# Select the <b>Roles</b> tab. The Role <b>Provisioning</b> panel is displayed.
# Mouse over the '''Provisioning''' tab and click on '''Roles'''. The Role <b>Provisioning</b> panel is displayed.
# In the Role <b>Provisioning</b> panel, right-click on the top-level <b>Roles</b> folder and select <b>New Role</b>.
# In the Role <b>Provisioning</b> panel, right-click on the top-level <b>Roles</b> folder and select <b>New Role</b>.
# Enter a name for the Role and click <b>Save</b>.
# Enter a name for the Role and click <b>Save</b>.
# Confirm that the new Role is displayed under the Roles folder in the Role <b>Provisioning</b> panel.
# Confirm that the new Role is displayed under the Roles folder in the Role <b>Provisioning</b> panel.


==== Sub-roles ====
==== Sub-roles ====
Line 126: Line 141:
permitted to log in to the system in his/her sub-role -- a User is not permitted to log in to the system in the
permitted to log in to the system in his/her sub-role -- a User is not permitted to log in to the system in the
parent Role(s).
parent Role(s).


==== The portalAdministration Role ====
==== The portalAdministration Role ====


The portalAdministration Role is the only Role in enPortal that provides full administrative
The portalAdministration Role is the only Role in enPortal that provides full administrative
privileges. When you install enPortal, a User called Administrator in domain System is the only User
privileges. When you install enPortal, a User called administrator in domain System is the only User
assigned to this Role. This Role can be assigned to one or more additional Users by any member of the
assigned to this Role. This Role can be assigned to one or more additional Users by any member of the
portalAdministration Role.
portalAdministration Role.
Line 138: Line 152:
have full administrative privileges.
have full administrative privileges.


=== Content ===


=== Views / Content ===


Once you have created a Role, you must assign content to the Role. This will provide information to any User who logs in to enPortal under that Role. To create content please follow the instruction specified in this [[enportal/old/creating_content|Creating Content in enPortal]] page.


Once you have created a Role, you must assign [[Creating_Content|content]] to the Role. This will provide information to any User who logs in to enPortal under that Role.


 
Folders present tabs of information to Users when they log in to enPortal. The enPortal administrator provides Folders to Users by provisioning them to Roles. Perform the following steps to assign one or more Folders to a Role:
Views present tabs of information to Users when they log in to enPortal. The enPortal administrator provides Views to Users by provisioning them to Roles. Perform the following steps to assign one or more Views to a Role:


# Log in to enPortal as an administrator.
# Log in to enPortal as an administrator.
# Select the <b>Roles</b> tab. The Role <b>Provisioning</b> panel is displayed.
# Mouse over the '''Provisioning''' tab and click on '''Roles'''. The Role <b>Provisioning</b> panel is displayed.
# In the Role <b>Provisioning</b> panel, click on the Role name to which you would like to assign content. The <b>Content</b> label is selected in the panel on the right. A directory tree of all content in the system is displayed, with a check box next to each item.
# In the Role <b>Provisioning</b> panel, click on the Role name to which you would like to assign content. The <b>Content</b> label is selected in the panel on the right. A directory tree of all content in the system is displayed, with a check box next to each item.
# Check the box next to each item to be assigned to the selected Role. If you select a folder, all current and future items in that folder will be visible to that Role, and any changes to the content in that folder will also be seen by that Role. If you select an individual item, and not the entire folder, new content added to that folder will not be seen by the Role.
# Check the box next to each item to be assigned to the selected Role. If you select a folder, all current and future items in that folder will be visible to that Role, and any changes to the content in that folder will also be seen by that Role. If you select an individual item, and not the entire folder, new content added to that folder will not be seen by the Role.
# Click <b>Save</b>.
# Click <b>Save</b>.
# Log in to enPortal as a User with the selected Role. Confirm that the assigned content is presented to the User.
# Log in to enPortal as a User with the selected Role. Confirm that the assigned content is presented to the User.


=== Assigning Roles to Users ===
=== Assigning Roles to Users ===




Once you have created a User and a Role, and assigned content to the Role, the final step is to assign the Role to the User. The User will then be presented the appropriate views when logging in to the system under that Role. You can assign Roles to either Users or Domains, using the same process. The only difference is that assigning the Role to the Domain will assign it to all current and future Users in the Domain.
Once you have created a User and a Role, and assigned content to the Role, the final step is to assign the Role to the User. The User will then be presented the appropriate folders when logging in to the system under that Role. You can assign Roles to either Users or Domains, using the same process. The only difference is that assigning the Role to the Domain will assign it to all current and future Users in the Domain.




Line 167: Line 179:


# Log in to enPortal as an administrator.
# Log in to enPortal as an administrator.
# Select the <b>Roles</b> tab. The Role <b>Provisioning</b> panel is displayed.
# Mouse over the '''Provisioning''' tab and click on '''Roles'''. The Role <b>Provisioning</b> panel is displayed.
# In the Role <b>Provisioning</b> panel, click on the Role name that you would like to assign.
# In the Role <b>Provisioning</b> panel, click on the Role name that you would like to assign.
# Select the <b>Users</b> label in the panel on the right. The list of Users and Domains assigned to the selected Role is displayed.
# Select the <b>Users</b> label in the panel on the right. The list of Users and Domains assigned to the selected Role is displayed.
Line 175: Line 187:




{{Tip|The above procedure selects a Role and assigns a User or Domain to that Role. You can also select a User or Domain under the <b>Users</b> tab, and assign the Role to that Domain or User. Either procedure creates the same result.}}
{{Tip|The above procedure selects a Role and assigns a User or Domain to that Role. You can also select a User or Domain by mousing over the '''Provisioning''' tab and selecting '''Users''', and assign the Role to that Domain or User. Either procedure creates the same result.}}
 


=== Direct vs. Inherited Role Assignments ===
=== Direct vs. Inherited Role Assignments ===
Line 187: Line 198:
# Log in to enPortal as an administrator.
# Log in to enPortal as an administrator.
# Assign a Role to a Domain or User as outlined under "Assigning Roles to Users".
# Assign a Role to a Domain or User as outlined under "Assigning Roles to Users".
# Select the <b>Users</b> tab. The Domain <b>Explorer</b> panel is displayed.
# Mouse over the '''Provisioning''' tab and click on '''Users'''. The Domain <b>Explorer</b> panel is displayed.
# In the Domain <b>Explorer</b> panel, expand the folder for the Domain of the User.
# In the Domain <b>Explorer</b> panel, expand the folder for the Domain of the User.
# Click on the User for which you wish to examine the Role assignment.
# Click on the User for which you wish to examine the Role assignment.
# Select the <b>Roles</b> label in the panel on the right. The list of Roles assigned to the selected User is displayed.
# Select the <b>Roles</b> label in the panel on the right. The list of Roles assigned to the selected User is displayed.
# Obesrve the <b>Inherited</b> column.
# Observe the <b>Inherited</b> column.
#* <b>Yes</b> - This means that the Role is assigned to the User's Domain, and inherited by the User. Observe that you cannot click the <b>Unassign</b> button for this Role. It can only be unassigned by selecting the Domain.
#* <b>Yes</b> - This means that the Role is assigned to the User's Domain, and inherited by the User. Observe that you cannot click the <b>Unassign</b> button for this Role. It can only be unassigned by selecting the Domain.
#* <b>No</b> - This means that the Role is assigned directly to the User. Observe that you can click the <b>Unassign</b> button for this Role and it will be removed from the list.
#* <b>No</b> - This means that the Role is assigned directly to the User. Observe that you can click the <b>Unassign</b> button for this Role and it will be removed from the list.
=== Actor Properties ===
Some Users may have more than one Role assigned to them. In such cases, a User could have different settings in the system for different Roles. The properties assigned to a User in a specific Role are called Actor Properties.
Perform the following steps to observe the Actor Properties for a User:
# Log in to enPortal as an administrator.
# Select the <b>Users</b> tab. The Domain <b>Explorer</b> panel is displayed.
# In the Domain <b>Explorer</b> panel, expand the folder for the Domain of the User.
# Click on a User who has multiple Roles assigned, for which you wish to examine the Actor Properties.
# Select the <b>Roles</b> label in the panel on the right. The list of Roles assigned to the selected User is displayed.
# Click on the Role for which you wish to examine the Actor Properties. The properties shown will be for that User acing in that Role.
# Click the <b>Edit</b> menu above the Role list, and select one of the following properties:
#* <b>Actor Viewset</b> - A pop-up windows displays all of the content assigned to the User when acting in the selected Role.
#* <b>Actor LAF</b> - A pop-up windows displays the LAF assigned to the User when acting in the selected Role.


== Tutorial ==
== Tutorial ==


A tutorial walk-through of the the basic enPortal provisioning screens is available at [[Provisioning_Quick_Start|Provisioning Quick Start]].
A tutorial walk-through of the the basic enPortal provisioning screens is available at [[enportal/old/provisioning_quick_start|Provisioning Quick Start]].
 


== LDAP Provisioning ==
== LDAP Provisioning ==


The sections above detail how to use enPortal's provisioning tools to manage Domains, Users, and Roles inside of enPortal. Some organizations already have an LDAP server in place to manage Users and Roles. In this case, enPortal can map to the existing LDAP configuration and rely on LDAP for externally managing this information. For instructions on configuring LDAP with enPortal, see [[EnPortal_LDAP_Configuration|enPortal LDAP Configuration]].
The sections above detail how to use enPortal's provisioning tools to manage Domains, Users, and Roles inside of enPortal. Some organizations already have an LDAP server in place to manage Users and Roles. In this case, enPortal can map to the existing LDAP configuration and rely on LDAP for externally managing this information. For instructions on configuring LDAP with enPortal, see [[enportal/old/ldap_configuration|enPortal LDAP Configuration]].

Latest revision as of 18:40, 17 July 2014

This topic details how the enPortal administrator can configure each element of User management. First, we present the concepts of establishing the basic User organization. Then we detail usage of the specific administration tools and interfaces. The primary elements of the User management are Domains, Users, and Roles.

Basic Provisioning Concepts

Provisioning is how you create Users and Roles in enPortal, and then provide the appropriate targeted information to them. For an overview of basic provisioning concepts, see the article: Provisioning Basics

Provisioning in the enPortal Administration User Interface

User management is made up of three elements: Domains, Users, and Roles. Used together, these elements provide a flexible means of organizing Users and provisioning the appropriate content to those Users. This User organization is the foundation upon which content management and other system features are built. In enPortal, provisioning is achieved by assigning Roles to Users and/or Domains.


Provisioning in enPortal is accomplished by performing the following steps:

  1. Create a Domain
  2. Create a User in the Domain
  3. Create a Role
  4. Assign Content to the Role
  5. Assign the Role to the User
  6. Assign a Look and Feel (LAF)


Domains

A Domain is a grouping of Users.


Perform the following steps to create an enPortal Domain:

  1. Log in to enPortal as an administrator.
  2. Mouse over the Provisioning tab and click on Users. The Domain Explorer panel is displayed.
  3. In the Domain Explorer panel, right-click on the Domains folder and select New Domain.
  4. Enter a name for the Domain and click Save.
  5. Confirm that the new Domain is displayed as a folder in the Domain Explorer panel.


Perform the following steps to modify an enPortal Domain:

  1. Log in to enPortal as an administrator.
  2. Mouse over the Provisioning tab and click on Users. The Domain Explorer panel is displayed.
  3. In the Domain Explorer panel, click on the Domain that you wish to modify.
  4. Click the General sub-tab to modify the general properties of the Domain.
    1. Default Login Page - You can assign a custom login page to a domain. To do so, perform the following:
      1. Create a custom login page JSP file and place it on the enPortal server in /server/webapps/enportal/login_pages/custom/customerName/loginPageName.jsp
      2. Enter the path and file name in the Default Login Page box. In the above example, you would enter "custom/customerName/loginPageName.jsp"
      3. Log in and log out of enPortal as a User in the Domain and confirm that the default login page for that Domain is displayed.
    2. Session Limit - You can specify a limit to how many licensed User sessions can be active simultaneously by the Users in a Domain. The following fields are displayed:
      1. Dedicated - The number of sessions currently dedicated to this domain. Modify the number of sessions, if desired. A value of -1 indicates that the selected domain can use unlimited sessions.
      2. Dedicated to other Domains - The number of sessions currently dedicated to all other Domains. This number cannot be modified.
      3. Licensed - The total number of sessions that can be allocated, as permitted by the system license file. A value of -1 indicates unlimited licenses. The number of sessions you allocate for this Domain plus the number already allocated to other Domains should not exceed the number in the Licensed field.
  5. Click the Roles sub-tab to assign or unassign Roles to the Domain.
  6. Click the LAF sub-tab to assign or un-assign a Look and Feel to the Domain.


Perform the following steps to delete an enPortal Domain:

  1. Log in to enPortal as an administrator.
  2. Mouse over the Provisioning tab and click on Users. The Domain Explorer panel is displayed.
  3. In the Domain Explorer panel, right-click on the Domains folder and select Delete.
  4. Click Ok to confirm deletion.
  5. Confirm that the Domain is no longer displayed as a folder in the Domain Explorer panel.

Password Policy For A Domain


The password policy can be set for individual domain by specifying a custom password policy for the domain. The password policy specified for a domain takes precedence over the system policy.

The setting in the domain password policy will affect only the users in the domain. If domain's users are managed by external ldap and you allow for passwords to be changed (subject to limitation in the note below), it is strongly recommended that the domain policy matches that of LDAP because most of the LDAPs do not give good error messages when user's password failed its policy.

Assigning a Domain Password Policy

Perform the following steps to assign a domain password policy.

  1. Log in to enPortal as an administrator.
  2. Mouse over the Provisioning tab and click on Users. The Domain Explorer panel is displayed.
  3. In the Domain Explorer panel, right click on the Domain that you wish to set password policy on.
  4. Click the Password Policy context menu.
  5. Make the desired changes in the three sections: Password, Syntax, and Lockout
  6. Click the Save button.
  7. Confirm that the correct policy is applied by changing a test user's password.
Template-note.png
In order to change password for users that are managed by ldap, you must specified a Pluggable Authenticator in the domains managed by this ldap and with Repository URL starts with ldaps:// and secured port # (default 636).

Additionally some ldaps like MS Active Directory and OpenLDAP requires ldap server's SSL certificate to be imported into java cert library running portal. Please read this section on how to set it up. Additional example for importing MS Active Directory SSL certificate into java cert lib can be found here.

Currently portal is delivered with two authenticators that allowed for ldap user password changes: Microsoft Active Directory and OpenDS.

Users

Once you have created a Domain, you must create a User in the Domain.


A User is a named member of a Domain who has unique credentials for logging in to enPortal.


Perform the following steps to create an enPortal User:

  1. Log in to enPortal as an administrator.
  2. Mouse over the Provisioning tab and click on Users. The Domain Explorer panel is displayed.
  3. In the Domain Explorer panel, right-click on the folder for the Domain into which you are adding the User and select New User.
  4. Enter a User name and password for the User and click Save.
  5. Confirm that the new User is displayed under the Domain folder in the Domain Explorer panel.


Perform the following steps to modify an enPortal User:

  1. Log in to enPortal as an administrator.
  2. Mouse over the Provisioning tab and click on Users. The Domain Explorer panel is displayed.
  3. In the Domain Explorer panel, expand the folder for the Domain of the User.
  4. Click on the User that you wish to modify.
  5. Click the General sub-tab to modify the general properties of the User.
    1. Password - As an administrator, you can reset a User's password.
    2. Lock Account - If you would like to lock the User’s account, select the Lock Account check box and, optionally, enter a reason in the Lock Reason field.
  6. Click the Roles sub-tab to assign or unassign Roles to the User. Note: it is typically recommended that you assign Roles to Domains, and not to individual Users.
  7. Click the LAF sub-tab to assign or un-assign a Look and Feel to the User. Note: it is typically recommended that you assign LAFs to Domains or Roles, and not to individual Users.


Perform the following steps to delete an enPortal User:

  1. Log in to enPortal as an administrator.
  2. Mouse over the Provisioning tab and click on Users. The Domain Explorer panel is displayed.
  3. In the Domain Explorer panel, expand the folder for the Domain of the User.
  4. Right-click on the User and select Delete.

Roles

Roles are the mechanism through which content in enPortal is assigned to Users.


Perform the following steps to create an enPortal Role:

  1. Log in to enPortal as an administrator.
  2. Mouse over the Provisioning tab and click on Roles. The Role Provisioning panel is displayed.
  3. In the Role Provisioning panel, right-click on the top-level Roles folder and select New Role.
  4. Enter a name for the Role and click Save.
  5. Confirm that the new Role is displayed under the Roles folder in the Role Provisioning panel.

Sub-roles

Roles are hierarchical in enPortal. In addition to creating Roles, you can also create sub-roles. The terms parent and child are used when referring to the relationship between roles. All Roles with sub-roles are parent Roles. Sub-roles are considered child Roles of their parent Role(s). If a sub-role is assigned to a Domain or User, the Domain or User will inherit the assignments and security of the parent Roles. However, the User(s) is only permitted to log in to the system in his/her sub-role -- a User is not permitted to log in to the system in the parent Role(s).

The portalAdministration Role

The portalAdministration Role is the only Role in enPortal that provides full administrative privileges. When you install enPortal, a User called administrator in domain System is the only User assigned to this Role. This Role can be assigned to one or more additional Users by any member of the portalAdministration Role. All members of the portalAdministration Role are granted full permissions for all components and actions in enPortal. Any Users who are assigned sub-roles under the portalAdministration Role also have full administrative privileges.

Content

Once you have created a Role, you must assign content to the Role. This will provide information to any User who logs in to enPortal under that Role. To create content please follow the instruction specified in this Creating Content in enPortal page.


Folders present tabs of information to Users when they log in to enPortal. The enPortal administrator provides Folders to Users by provisioning them to Roles. Perform the following steps to assign one or more Folders to a Role:

  1. Log in to enPortal as an administrator.
  2. Mouse over the Provisioning tab and click on Roles. The Role Provisioning panel is displayed.
  3. In the Role Provisioning panel, click on the Role name to which you would like to assign content. The Content label is selected in the panel on the right. A directory tree of all content in the system is displayed, with a check box next to each item.
  4. Check the box next to each item to be assigned to the selected Role. If you select a folder, all current and future items in that folder will be visible to that Role, and any changes to the content in that folder will also be seen by that Role. If you select an individual item, and not the entire folder, new content added to that folder will not be seen by the Role.
  5. Click Save.
  6. Log in to enPortal as a User with the selected Role. Confirm that the assigned content is presented to the User.

Assigning Roles to Users

Once you have created a User and a Role, and assigned content to the Role, the final step is to assign the Role to the User. The User will then be presented the appropriate folders when logging in to the system under that Role. You can assign Roles to either Users or Domains, using the same process. The only difference is that assigning the Role to the Domain will assign it to all current and future Users in the Domain.


A User can have more than one Role assigned in enPortal. If a User has multiple Roles, the default Role will be assigned to the User after login. A Role chooser will be presented in the upper banner. The User can use the Role chooser to switch to a different Role. This effectively logs the User out of enPortal and logs the User back in under the new Role. A User can only have one Role selected at any current time, and will see only the content provisioned to that current Role.


Perform the following steps to assign Roles to a User or Domain:

  1. Log in to enPortal as an administrator.
  2. Mouse over the Provisioning tab and click on Roles. The Role Provisioning panel is displayed.
  3. In the Role Provisioning panel, click on the Role name that you would like to assign.
  4. Select the Users label in the panel on the right. The list of Users and Domains assigned to the selected Role is displayed.
  5. Click Assign... in the sub-nav bar. A pop-up window is displayed.
  6. In the pop-up window, select the User or Domain to which you want to assign the selected Role.
  7. In the pop-up window, click Ok. Observe that the selected User or Domain is now listed in the right panel.


Template-tip.png
The above procedure selects a Role and assigns a User or Domain to that Role. You can also select a User or Domain by mousing over the Provisioning tab and selecting Users, and assign the Role to that Domain or User. Either procedure creates the same result.

Direct vs. Inherited Role Assignments

When you assign a Role to a Domain, the Role is inherited by all Users in that Domain. When you assign a Role to a User, the Role is assigned directly to only that User.


Perform the following steps to see if a Role assignment is direct or inherited:

  1. Log in to enPortal as an administrator.
  2. Assign a Role to a Domain or User as outlined under "Assigning Roles to Users".
  3. Mouse over the Provisioning tab and click on Users. The Domain Explorer panel is displayed.
  4. In the Domain Explorer panel, expand the folder for the Domain of the User.
  5. Click on the User for which you wish to examine the Role assignment.
  6. Select the Roles label in the panel on the right. The list of Roles assigned to the selected User is displayed.
  7. Observe the Inherited column.
    • Yes - This means that the Role is assigned to the User's Domain, and inherited by the User. Observe that you cannot click the Unassign button for this Role. It can only be unassigned by selecting the Domain.
    • No - This means that the Role is assigned directly to the User. Observe that you can click the Unassign button for this Role and it will be removed from the list.

Tutorial

A tutorial walk-through of the the basic enPortal provisioning screens is available at Provisioning Quick Start.

LDAP Provisioning

The sections above detail how to use enPortal's provisioning tools to manage Domains, Users, and Roles inside of enPortal. Some organizations already have an LDAP server in place to manage Users and Roles. In this case, enPortal can map to the existing LDAP configuration and rely on LDAP for externally managing this information. For instructions on configuring LDAP with enPortal, see enPortal LDAP Configuration.