...

This section will show you how to manage users and user groups in your Kiuwan Account. 

Contents: 

Related pages:

Kiuwan Users Management

In this section, let's review

By “Users Management” we will refer also to Permissions Management, Access Policy, and all the security-related issues of the Kiuwan account.User Management module can be selected at the top-left drop-down menu.

Image Removed

The User Management module can be selected at the top-left drop-down menu.

Image Added

The Users Management module contains 3 tabs that allow to manage managing different aspects of users and permissions.

...

• Allows to manage Users (creation, modification and deletion) as well as different Users: create, modify, and delete users; and also perform actions on selected users (such as password setting, permissions granting, etc.)

• User Groups Allows to manage Users Groups, i.e. to create sets Groups:  create sets of users that shares share the same privileges.Roles 

• Allows to manage Roles, i.e. named groupings of permissions that Roles: manage named groupings of permissions that can be further used to grant privileges to users and user groups.

Use The use of these sections is straightforward if you clearly understand the concepts. So, in these this document, we will focus on explaining the concepts.

...

Permission Model

Role-based Access Control (RBAC)

Kiuwan implements a role-based access control approach that allows you to fully define the permissions of your Kiuwan installation.

 A common misconception is A common misconception is to think that somebody can be assigned a role (John has Read role) that applies to all the objects.  This It does not work solike this.

 The The three components of the tuple (Subject, Role, and Object) are always needed.

This permission model lets you to define  your access policy at a very fine-grain level your access policy.

Permissions

...

Kiuwan provides a set of permissions that you can grant to any user (or user group) over any portfolio or application.

...

Roles

...

InfoA Role is a concrete set of permissions. 

Kiuwan provides several built-in roles. These predefined roles are commonly used and can serve as templates to create your own custom roles.

...

Built-in role	Common use
None

Empty

An empty set of permissions. It means no

-

access at all.
Readonly	Users that should only

should

be granted read-only access to analysis data (baselines and deliveries)
Readonly deliveries	Similar to

Readonly

Read only, but restricted to data coming from deliveries analyses, not granted to see

baseline’s

baseline data
Write	Suitable for users that should have full access to an application (execute analyses, delete them, etc)
Write deliveries	For users that should only be allowed to execute (and view) delivery analyses, not being permitted to access

baseline’s

baseline data.

 

Built-in roles cannot be modified but you can create as many custom roles as you need, selecting among the available permissions.

Image Removed

 

Image Added

Keep Bear always in mind that roles are assigned to Portfolios or Applications. There are not global roles, : a role always applies to some object.

 

 

Administration privileges

 

InfoAdditionally In addition to permissions and roles, there are some Administration privileges that can be granted to users or group groups of users. 

Image Added

Image Removed

 

Admin privileges

Meaning

Description
Manage applications	Any user with this privilege is allowed to create, edit, and delete Applications and Portfolios. Granting this privilege to a user will allow full access to the Application Management module where that user will be able to create and manage Kiuwan apps (to classify the app on portfolios, to assign a quality model and audits, etc).

Please, see 

See Applications management

 section for

for further

info

information on this subject.
Manage users	Granting this privilege to a user will allow full access to Users Management module where that user will be able to: Create and delete account users Change the account owner Grant Admin privileges to users Additionally, combined with “Manage applications”, the user will be able to: Create user groups and new roles Assign permissions on portfolios or applications to users (or group of users)

 

Manage models	To create, modify, publish, and delete Models, as well as to configure the Default Model.

 

Granting this privilege to a user will allow full access to the Models Management module where the user will be able to create and manage Quality Models.

 

Please, see 

See Models Manager User Guide

 section for

for further

info

information on this subject.

 

Manage audits	To create, modify, publish, and delete Audits as well as to configure the Default Audit.

Please, see 

See Audits Management

 section for

for further

info

information on this subject.
Manage reports	To create, modify, publish

an

, and delete Custom Reports.

Please, see 

See Custom Reports

 section for

for further

info

information on this subject.

 
 
 

Info
Important : Any user granted with ALL admin privileges becomes an “admin” Account The account owner is the full “admin” of the account and can create additional admins by granting all the admin privileges.

 

Global permissions	Meaning
View governance	Access to the Governance module. Even with

these

this privilege, the user will only see aggregated data from “allowed” applications (i.e. at least with Readonly role)

Please, see 

See Kiuwan Governance Doc

 section for

for further info on this subject.
Support Enabled	Access to Kiuwan Technical Support (chat or ticket-based)

 

Users and User Groups 

 

Kiuwan allows to

Groups

You can create single Users

 as

 as well as User Groups, and

consequently to

assign permissions to single Users or to User Groups.

• If a User a user belongs to one User Group, the permissions granted to that user will be those granted to the User Groups he belongs to.

• If a User a user belongs to more than one User Group, the resulting set of granted permissions is the the union (OR)  of of every user group’s permissions, i.e. the user will have permissions from one group plus the permissions from the others groupother groups.

 

 

Info
If you want to avoid this “user group’s inheritance”, select “Override User Group” and that user will be granted only with the permissions exclusively assigned to him, regardless of his/her membership to any user group.

 

Permissions on Portfolios and Applications

Any Application application can be classified according to the available Groups of Portfolios.

There are two built-in group groups of portfolios: Business Value and Provider

...

 Business Value and Provider

Group of Portfolio	Meaning	Values
Business Value	Classification of the app according to this value from a business point of view	Fixed and not-modifiable set: Critical, High, Medium, Low and Very Low
Provider	Company in charge of developing/maintaining the application	Empty by default

,

: custom values can be defined

 

Besides these built-in groups, you can create as many custom groups of portfolios as you need. 

Any application will always have a value for each of the existing groups of portfolios:

• either a concrete value

• or “Unassigned” unassigned (if that app has not been explicitly classified into that group

 

Then, if you want to grant permissions based on Portfolios, just select the option “: Permissions on portfolios”.

 

Image RemovedImage Added

 

Then, you will be able to select the can select the specific access Role (i.e. the set of permissions) to every portfolio of the available groups.

 Image AddedImage Removed

Note
IMPORTANT: If some application is

...

unassigned in some group, None role is assumed (i.e. no-access)

...

...

Info
As Since any application can be classified in several portfolio groups, the final permissions set for the app is the union of allowed actions for every role assigned to every portfolio group.

 

Let see with  Here is an example.:

• You define a user with “ReadOnly” ReadOnly permissions on apps with portfolio value “High” in “Business Value” High in a Business Value portfolio. 
  • This means that for any application classified as such, that user will have the allowed actions defined in “ReadOnly” ReadOnly role.
• Also, you define for the same user “None” None as the role for apps with value “South Africa” in “Provider” South Africa in the Provider portfolio group.

What would be the permissions for an app that is “High” High (in Business Value) and “South Africa” South Africa (in Provider)?

As said above, it would be the union set, being in this case equal to the ReadOnly role. 

Another example.

• You define a Role “Mute defects” with only “Mute defects” Mute defects role with only Mute defects action, and a Create Notes role “Create Notes” with only “Create Note” Create Note action. 
• You associate “Mute defects” Mute defects to High and “Create Notes” to “South Africa”Create Notes to South Africa. 

What would be the resulting set for any app classified as such?

The user will be able to “Mute defects” AND “Create Notes”.

 

 Mute defects AND Create Notes.

Info

Because every application is always classified into every group of the portfolio, permissions on portfolios take precedence to permissions on applications. If you need to override this behaviour  this behavior and grant permissions directly to the application (regardless of its classification): select “Permissions on applications”, select the Role and  be sure to sure to check “Override” Override (otherwise, the portfolios permissions will apply).

Image RemovedImage Added

Users Management

The User Management section in the Setup menu The User Management section allows you to manage the users and their permissions associated to with your account. 

Image Modified

At CSV option menu you can export to a CSV file a full listing Open the hamburger menu and select CSV to export a full list of users and permissions to a CSV file. 

Image Modified

Add a new user

Clicking on the Add button you get access to the New User form.

Image Removed

...

Click Add to open the New User form.

Image Added

Name	Description
Username	This is the unique identifier of a Kiuwan user. The user

...

must specify this username whenever accessing Kiuwan.

...

The username must be unique so it’s recommended to use a suffix that identifies all users in your organization.

Email

...

This is the email address of the user so any Kiuwan notification will be sent to that email address.

...

Email does not need to be unique, so there

...

can be users with the same email address.

Name

...

& Lastname	These are descriptive fields to further identify the user.
Enabled

...

This checkbox allows enabling/disabling the user to access the Kiuwan account.

...

Generate Password

If this checkbox is checked, Kiuwan will send a new password to the user. New users

...

cannot access Kiuwan until they receive their

...

password.

 

Set user as owner

In the dropdown menu of each user, you can select Set user as owner to owner to change the account owner.

Any Every Kiuwan account has a unique “account owner”account owner. The account owner is granted full permissions on account administration, applications, and portfolios.

Once a new user is set as the owner, the old owner will be set with default permissions (none).

Image Modified

Confirm this action in the pop-up window that will show shows up once you have selected the the Set as owner option for any user:

Set a new password

In the dropdown menu of each user, you can also select New password for the selected user.

Selecting this option will generate a new password and sent send it to the user’s email address. 

Set administration privileges

Administration privileges can be granted to any users, which enable them to manage applications, users, quality models and/or audits as if they were the account owner.

Image Modified 

For a full explantion explanation of admin privileges, see Administration privileges  

Set permissions on portfolios

The account owner (or any user with “Manage Users” Manage Users privilege) can assign application permissions based application permissions based on the app classification in portfolio groups.

Permissions can be assigned to portfolio values by selecting a Role (i.e. a defined set of allowed actions) for every portfolio value. 

Please , see Permissions on Portfolios and Applications section to  to fully understand the permissions assignment.

Image RemovedImage Added

...

Set permissions on applications

The account owner (or any user with “Manage User” Manage User privilege) is entitled to assign specific application permissionsapplication permissions.

Image Modified

Refer to the section Please, see Permissions on Portfolios and Applications section to  to fully understand permissions the permission assignment. 

Bulk actions

If you want to set the same option for several users at once, you can do it by selecting those users and, then, choosing . Then, choose the corresponding option on Bulk actions dropdown on Bulk actions dropdown menu, as showed shown below:

Image Modified

User groups

A User Group is a set of users that shares the same permissions (admin privileges and/or permissions on apps and portfolios).

Image Modified

Whenever you need When you need to assign the same permissions on the same entities entities (apps and portfolios), you can define create a User Group, define and then define the set of privileges and assign users to that User Group.

Doing this way, with one click you you will be able to grant all the users of that group the same permissions instead of granting one by one.

For example, you can divide users in into development teams, so the users in the same user group will be able to manage the applications they are working with the same set of privileges. 

Any user can be assigned to many user groups. In this case, a union of all user group's permissions will be granted to that user.

• If a User a user belongs to one User Group, the permissions granted to that user will be those granted to the User Groups he belongs to.

• If a User a user belongs to more than one User Group, the resulting set of granted permissions is the union (OR) of every user group’s permissions, i.e. the user will have permissions from one group plus the permissions from the others group.

In case of conflicting permissions on the same entities (apps and portfolios), the most permissive set is applied. 

Create a new User Group

To create a new User Group, click on Add button  button and drag&drop users from Not Members Member Users to Group Members.

Image Modified

Roles

You can manage the different user roles by clicking on the namesake button in User Management sectionin User Management.

Image Modified

Please visit Roles section for  for details. 

Create a new Role

You can add new roles and select their enabled actions by clicking on “Create Create New Role” buttonRole.  

Image Removed

 Image Added

You can manage the actions the different roles can perform by selecting the appropriate checkboxes for each role.