...
Related pages:
| Page Tree | ||||||
|---|---|---|---|---|---|---|
|
Users Management Overview
User Management section in the Setup menu allows you to manage users and their permissions associated to your account.
Introduction to User Management
In this section, let's review Permissions Management, Access Policy, and all the security-related issues of the Kiuwan account.
| Info | ||
|---|---|---|
| ||
If your Kiuwan account is Single Sign-On (SSO) enabled, please visit How to integrate Kiuwan with SAML SSO - SSO login vs username-password login |
The User Management module can be selected at the top-left drop-down menu.
The Users Management module contains 3 tabs that allow managing
...
...
...
...
...
...
...
...
Permissioning Model
Users Management
The User Management section in the Setup menu allows you to manage the users and their permissions associated to your account.
At CSV option menu you can export to a CSV file a full listing of users and permissions.
Add a new user
Clicking on the Add button you get access to the New User form.
Username field is the unique identifier of a Kiuwan user. The user needs to specify this username whenever accessing Kiuwan. Username must be unique so it’s recommended to use a suffix that identifies all users in your organization.
Email field is the email address of the user so any Kiuwan notification will be sent to that email address. Email does not need to be unique, so there might be users with the same email address.
Name and Lastname fields are descriptive fields to further identify the user.
Enabled check allows to enable/disable the user to access the Kiuwan account.
By checking the Generate password checkbox, Kiuwan will send a new password to the user. New users can not access Kiuwan until they receive their new password.
Set user as owner
In the dropdown menu of each user, you can select Set user as owner to change the account owner.
Any Kiuwan account has a unique “account owner”. The account owner is granted full permissions on account administration, applications and portfolios.
Any user can be set as Account Owner by the current owner, and by assigning this role to a new user the current owner will cease to be the current owner. Once a new user is set as owner, the old owner will be set with default permissions (none).
...
The use of these sections is straightforward if you clearly understand the concepts. So, in this document, we will focus on explaining the concepts.
Permission Model
Role-based Access Control (RBAC)
Kiuwan implements a role-based access control approach that allows you to fully define the permissions of your Kiuwan installation.
| Info |
|---|
The Permission model is based in the tuple: Subject - Role - Object
|
A common misconception is to think that somebody can be assigned a role (John has Read role) that applies to all the objects. It does not work like this.
The three components of the tuple (Subject, Role, and Object) are always needed.
This permission model lets you define your access policy at a very fine-grain level.
Permissions
Kiuwan provides a set of permissions that you can grant to any user (or user group) over any portfolio or application.
Permission | Meaning |
|---|---|
View deliveries | To view data of delivery analyses (defects, audit results, etc) |
Delete deliveries | To delete delivery analyses |
Execute deliveries | To execute delivery analyses |
View application data | To view analysis data (defects, metrics, action plans, etc) |
Execute analyses | To execute baseline analyses (CS, CA and IS) |
Execute analyses in the cloud | To execute baseline analyses uploading the code to the Kiuwan cloud Saas |
Delete analyses | To remove baseline analyses |
Mute defects | To mute defects on baseline and delivery analyses |
| Change defect status | To change the status of a defect on baseline and delivery analyses |
Save action plans | To create and edit actions plans |
Delete action plans | To remove existing action plans |
Export action plans to JIRA | To use the Jira plugin to create issue from action plans |
View analyzed source code | To view the defects together with the complete source code (this option is sold separately) |
Upload analyzed source code | To upload the complete source code to Kiuwan so the defects could be inspected in the full source code |
Upload source code fragments | To upload only the code line where the defect is found. |
Roles
Kiuwan provides several built-in roles. These predefined roles are commonly used and can serve as templates to create your own custom roles.
Built-in role | Common use |
|---|---|
None | An empty set of permissions. It means no access at all. |
Readonly | Users that should only be granted read-only access to analysis data (baselines and deliveries) |
Readonly deliveries | Similar to Read only, but restricted to data coming from deliveries analyses, not granted to see baseline data |
Write | Suitable for users that should have full access to an application (execute analyses, delete them, etc) |
Write deliveries | For users that should only be allowed to execute (and view) delivery analyses, not being permitted to access baseline data. |
Built-in roles cannot be modified but you can create as many custom roles as you need, selecting among the available permissions.
Keep in mind that roles are assigned to Portfolios or Applications. There are not global roles: a role always applies to some object.
Administration privileges
Admin privileges | Description |
|---|---|
Manage applications | Any user with this privilege is allowed to create, edit, and delete Applications and Portfolios. |
Set a new password
In the dropdown menu of each user, you can also select New password for the selected user.
Selecting this option will generate a new password and sent to the user’s email address.
Set administration privileges
Administration privileges can be granted to any users, which enable them to manage applications, users, quality models and/or audits as if they were the account owner.
There exist the following administration privileges:
...
...
...
...
...
Following sections will describe in details these functionalities.
...
...
...
...
Grant this privilege to a user will allow full access to Audit Management module where that user will be able to create and manage Audits.
...
...
...
...
...
...
- Support enabled
Grant this privilege to a user will allow full access to Online access (chat) to Kiuwan Technical Support .
- View governance
Grant this privilege to a user will allow full access to Governance module
...
...
Set permissions on portfolios
The account owner (or any user with “Manage User” privilege) can assign application permissions based on the app classification in portfolio groups.
...
Support Enabled | Access to Kiuwan Technical Support (chat or ticket-based) |
Users and User Groups
You can create single Users as well as User Groups, and assign permissions to single Users or to User Groups.
If a user belongs to one User Group, the permissions granted to that user will be those granted to the User Groups he belongs to.
If a user belongs to more than one User Group, the resulting set of granted permissions is the union (OR) of every user group’s permissions, i.e. the user will have permissions from one group plus the permissions from the other groups.
| Info |
|---|
If you want to avoid this “user group’s inheritance”, select “Override User Group” and that user will be granted only with the permissions exclusively assigned to him, regardless of his/her membership to any user group. |
Permissions on Portfolios and Applications
Any application can be classified according to the available Groups of Portfolios.
There are two built-in groups of portfolios: Business Value and Provider
Group of Portfolio | Meaning | Values |
|---|---|---|
Business Value | Classification of the app according to this value from a business point of view | Fixed and not-modifiable set:
|
Provider | Company in charge of developing/maintaining the application | Empty by default:
|
Besides these built-in groups, you can create as many custom groups of portfolios as you need.
Any application will always have a value for each of the existing groups of portfolios:
either a concrete value
or unassigned (if that app has not been explicitly classified into that group
Then, if you want to grant permissions based on Portfolios, just select the option: Permissions on portfolios.
Then, you can select the specific access Role (i.e.
...
...
...
...
of the available groups.
| Note |
|---|
| IMPORTANT: If some application is unassigned in some group, None role is assumed (i.e. no-access) |
| Info |
|---|
Since |
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
Mute defects AND Create Notes.
| Info |
|---|
Because every application is always classified into every group of the portfolio, permissions on portfolios take precedence to permissions on applications. If you need to override this behavior and grant permissions directly to the application (regardless of its classification):
|
Users Management
The User Management section allows you to manage the users and their permissions associated with your account.
Open the hamburger menu and select CSV to export a full list of users and permissions to a CSV file.
Add a new user
Click Add to open the New User form.
| Name | Description |
|---|---|
| Username | This is the unique identifier of a Kiuwan user. The user must specify this username whenever accessing Kiuwan. The username must be unique so it’s recommended to use a suffix that identifies all users in your organization. |
| This is the email address of the user so any Kiuwan notification will be sent to that email address. Email does not need to be unique, so there can be users with the same email address. | |
| Name & Lastname | These are descriptive fields to further identify the user. |
Enabled | This checkbox allows enabling/disabling the user to access the Kiuwan account. |
| Generate Password | If this checkbox is checked, Kiuwan will send a new password to the user. New users cannot access Kiuwan until they receive their password. |
Set user as owner
In the dropdown menu of each user, select Set user as owner to change the account owner.
Every Kiuwan account has a unique account owner. The account owner is granted full permissions on account administration, applications, and portfolios.
| Info |
|---|
| Any user can be set as Account Owner by the current owner, and by assigning this role to a new user the current owner will cease to be the current owner. |
Once a new user is set as the owner, the old owner will be set with default permissions (none).
Confirm this action in the pop-up window that shows up once you have selected the Set as owner option for any user:
Set a new password
In the dropdown menu of each user, you can also select New password for the selected user.
Selecting this option will generate a new password and send it to the user’s email address.
Set administration privileges
Administration privileges can be granted to any users, which enable them to manage applications, users, quality models and/or audits as if they were the account owner.
For a full explanation of admin privileges, see Administration privileges
Set permissions on portfolios
The account owner (or any user with Manage Users privilege) can assign application permissions based on the app classification in portfolio groups.
Permissions can be assigned to portfolio values by selecting a Role (i.e. a defined set of allowed actions) for every portfolio value.
Please see Permissions on Portfolios and Applications to fully understand the permissions assignment.
| Note |
|---|
Important: Permissions based on portfolio values take precedence over app permissions. In case you want app permissions to take precedence over portfolios permissions, you should check |
...
...
...
...
...
...
...
...
...
...
...
...
User groups
A User Group is a set of users that shares the same permissions (admin privileges and/or permissions on apps and portfolios).
...
When you need to assign the same permissions on the same
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
Roles
You can manage the different user roles by clicking on the namesake button
...
A Role is a grouping of specific set of permissions that will be applied to selected entities (apps and portfolios).
Kiuwan provides the following set of available permissions:
Kiuwan provides 5 preconfigured roles in Kiuwan:
- None: no permissions
- ReadOnly : permissions to view app data (including data on deliveries)
- ReadOnly deliveries: permissions to only view delivery data (not app data)
- Write : full access permissions on selected entities
- Write deliveries: execution access only to app deliveries
Whenever you create a user, by default that user will be assigned the role “None” to all apps and portfolios, i.e. no access.
These preconfigured roles are ready for use and cannot be modified.
In case you need to define different sets of permissions you can do it by creating new Roles.
...
...
...
You can manage the actions the different roles can perform by selecting the appropriate checkboxes for each role.
...
...