title: User & Role Management category: Administration tags: users, roles, permissions, admin, management priority: Normal

User & Role Management

This guide covers managing IdentityCenter application users, roles, and permissions. Proper user and role management ensures that administrators have the access they need while following the principle of least privilege.

Overview

IdentityCenter has its own internal user management system, separate from the directory objects it manages. Application users are the people who log in to the IdentityCenter web portal to administer, audit, or operate the system.

The Users Page

Navigate to /admin/users to manage application user accounts.

Viewing Users

The Users page displays all registered application users with the following information:

Creating Admin Accounts

To create a new application user:

1. Navigate to /admin/users

2. Click Add User

3. Fill in the required fields:

   Field	Required	Description
   Username	Yes	Unique login identifier
   Display Name	Yes	Full name for display
   Email	Yes	Email address for notifications
   Password	Yes	Must meet password policy requirements
   Roles	Yes	One or more application roles
   Enabled	Yes	Whether the account is active

4. Assign one or more roles (see Application Roles below)

5. Click Save

Tip: For the initial setup, the QuickConfig wizard creates the first admin account. Additional accounts should be created through the Users page.

Enabling and Disabling Accounts

To disable a user account without deleting it:

1. Navigate to /admin/users
2. Click the user's name to open their profile
3. Toggle the Enabled switch to off
4. Click Save

Disabled accounts:

• Cannot log in to the web portal
• Retain their configuration and role assignments
• Can be re-enabled at any time
• Are preserved for audit trail purposes

Resetting Passwords

To reset a user's password:

1. Navigate to /admin/users
2. Click the user's name
3. Click Reset Password
4. Enter and confirm the new password
5. Click Save

The user will need to use the new password on their next login.

Viewing Login History

To review a user's login activity:

1. Navigate to /admin/users
2. Click the user's name
3. Select the Login History tab

Login history includes:

• Timestamp of each login attempt
• Success or failure status
• Source IP address
• Browser/client information

Application Roles

Built-in Roles

IdentityCenter includes three built-in roles:

Role Permissions Detail

Admin Role

Administrators have unrestricted access to all features:

User Role

Standard users have operational access without administrative control:

Auditor Role

Auditors have comprehensive read-only access for compliance purposes:

The Roles Page

Navigate to /admin/roles to manage application roles.

Viewing Roles

The Roles page displays all roles with their assigned permissions and member count.

Creating Custom Roles

To create a role with specific permissions:

1. Navigate to /admin/roles

2. Click Add Role

3. Enter the role name and description

4. Select permissions for each application area:

   Permission Type	Description
   View	Can see the feature and its data
   Create	Can create new items
   Edit	Can modify existing items
   Delete	Can remove items
   Execute	Can run operations (sync, evaluate, export)

5. Click Save

Example custom roles:

Editing Roles

1. Navigate to /admin/roles
2. Click the role name
3. Modify the permissions as needed
4. Click Save

Important: Changes to role permissions take effect immediately for all users assigned that role. Active sessions will reflect the new permissions on the next page navigation.

Assigning Roles to Users

Roles can be assigned in two places:

1. From the Users page: Edit a user and select roles in the Roles dropdown
2. From the Roles page: Open a role and add users to the Members list

A user can have multiple roles. Permissions are additive -- if any assigned role grants a permission, the user has that permission.

Session Management

Active Sessions

Navigate to /admin/users and select a user to view their active sessions. Each session shows:

Forced Logout

To forcibly end a user's session:

1. Navigate to the user's profile
2. Select the Sessions tab
3. Click Terminate next to the session you want to end

The user will be redirected to the login page on their next interaction.

When to force logout:

• Suspected unauthorized access
• After disabling an account
• After a security incident
• When a user reports a lost or stolen device

Admin Notifications

Configure notification preferences for administrators at Administration > Notifications:

Each administrator can customize which notifications they receive and their preferred delivery method (email or in-app).

Best Practices

Principle of Least Privilege

1. Start with minimal access -- Assign the least permissive role that allows the user to do their job
2. Use custom roles -- Create targeted roles instead of giving everyone the Admin role
3. Avoid shared accounts -- Each person should have their own account for audit trail purposes
4. Review access regularly -- Audit user accounts and role assignments quarterly

Account Management

1. Separate admin and daily-use accounts -- Administrators should have a standard User account for daily work and a separate Admin account for administrative tasks
2. Disable rather than delete -- When a user leaves, disable their account rather than deleting it to preserve audit history
3. Use strong passwords -- Enforce password complexity through SecuritySettings
4. Monitor login failures -- Review login history for signs of unauthorized access attempts

Quarterly Access Review

Conduct a quarterly review of application user access:

1. Export the current user list with roles from /admin/users
2. Verify each user still needs their assigned roles
3. Remove roles that are no longer needed
4. Disable accounts for users who have left the organization
5. Document the review for compliance records

Next Steps

• Configuration Reference
• Security Hardening
• Dashboard & Reporting
• Log Analysis & Diagnostics
• Email Template Variables Reference