Open topic with navigation

Creating and editing user groups

As described in the security overview topic, access rights in OEDQ are controlled via groups. Permissions for applications, and project and functional point access are assigned to groups. Users belong to groups, and inherit their permissions from the groups to which they belong.

Several default groups with pre-configured permissions are provided with a new installation of OEDQ. These are detailed below (see Default groups and permissions). It is also possible to create new groups and to assign permissions to those groups.

If you have configured OEDQ to integrate with Active Directory (see Integrating OEDQ with Active Directory or another LDAP server),you must also map the external user groups, defined in the LDAP directory, onto the OEDQ user groups.

This topic describes:

• Adding a user group;
• Editing an existing user group;
• Deleting a user group, and
• Mapping external user groups.

It also provides a table showing the default user groups and the permissions assigned to them that are created in a new OEDQ installation.

Creating user groups

Generally speaking, a user group should correspond to a role that an individual might have as a user of your OEDQ implementation. You may wish to maintain many groups with a small number of permissions each, or it may be simpler to use a small number of groups, each with a larger range of permissions.

Next, click on the Groups button at the bottom of the page:

The Groups page lists all the groups that are currently defined, along with their associated permissions. Scroll to the bottom of the page to find the Add Group button:

The Add Group page allows you to define a name for your new group, and add functional permissions to it from a list:

A full list of functional permissions supplied with OEDQ can be found in the Functional permissions topic. To associate a permission with the group, click on it to select it in the left hand list and then press the right-arrow button to move the selected permission (or permissions) to the right hand list. You can select multiple permissions at once by holding down the Ctrl button on your keyboard as you click on the permission names.

To remove a permission from a group, select it in the right hand list and press the left-arrow button to return it to the left hand list.

Once you have made the changes you require, press the 'Apply' button to save them.

Editing a user group

To edit a group, navigate to the Groups page as described in Creating user groups. Click on the name of the group you want to edit:

The Edit Group page will appear, populated with the details of the group you have selected:

You can rename the group and change its associated permissions on this page as described in Creating user groups above. Press the 'Apply' button to save your changes when you have finished.

A full list of functional permissions supplied with OEDQ can be found in the Functional permissions topic.

Deleting a user group

To delete a group, navigate to the Groups page as described in Creating user groups. Click on the delete button next to the name of the group you want to delete:

You will be prompted to confirm the deletion before it is finalized.

Default Groups and Permissions

On a new installation of OEDQ, the following groups and permissions are created by default. Note that upgrades from previous versions will preserve the configuration of groups and users before the upgrade, meaning these groups may not exist.

Mapping External User Groups 

Once an OEDQ server has been configured to connect to an LDAP server, an External Groups link appears on the User Administration pages:

This lists all the groups available in the configured realm(s). Internal OEDQ groups are assigned to external groups to pass the associated permissions through to the users.

Click on an external group name to assign internal OEDQ groups to it. Assigning an internal group to an external group automatically grants all users in the external group the complete set of permissions allocated to the internal group.

For example, the following screenshot shows the standard internal group 'Match Reviewers' being assigned to the external group 'Domain Users'. All users in the Domain Users group will now be granted the Match Reviewer permissions:

It may be useful and desirable to create some external groups on the domain that can be mapped precisely to internal OEDQ groups, to ensure optimal permission assignment.

Note: In installations with a large number of external user groups, the optional groupsearchfilter can be used to narrow down the results returned. For further information, see Filtering the external group list.