User Access Control

Introduction

Via the 1CX console, it is possible to provide varying levels of access and control (permission rights) for specific users on the system.

Concepts

Getting Access

When CamlinConnect is installed, the process will setup the nuamedia base account, the initial roles and an initial user with username 'superuser@nuamedia' with 'superuser' role. This also adds an administrator role and/or a number of other predefined roles with public scope. Each organisation can create its own users and roles which will only be visible and can be assigned to users in that organisation. However superuser users are able to create roles which have public scope and which will be available to all organisations.

Logging In

To login to the console you need to enter your username and password which were provided to you by Nuamedia or your CamlinConnect assigned administrator. If you don't have a CamlinConnect account yet, please request one from an administrator.

Account States

A Camlin user account will go through a series of states caused by normal or automated actions. Once a user is created, the system will put the user account into an active state and will force the user to change the default password on first login. This initial password is setup by the administrator who created the account and will be passed on the user. The default user state after a user is created can be changed by the administrator, for example it could be possible for an administrator to create a user account that does not need to change its password on first login or that is created as inactive from the start.

Figure 1: User states

Reset Password

Users are able to reset their passwords once they have logged in for the first time at anytime through the user account menu which also allows to edit general user information. Username is not modifiable by the user unless it has an administrator level role.

Figure 2: User account menu

Setting Up

If you are an administrator or your user account has an administrator role, the Settings module will be available and will allow access to manage users and roles for the current organisation. Public roles already setup will be available immediately to use in the Users tab but these roles are read-only and will not be appear in the Roles tab for maintenance.

Access Control System

Camlin has a basic but flexible user access control system that allows administrators to allow or reject access to several areas or Camlin functionality. Essentially, the access control system focuses on two main elements:

• Targets: which include modules, main tabs, second level tabs, menu items and third level tabs and actions.
• Actions: which include all buttons anywhere in the system.

Camlin allows administrators to define roles with refined control records that can restrict access to several targets at the same time and restrict the ability of a user to trigger button actions. All validations on user permissions are checked and resolved in the server.

Roles

Roles in Camlin are the basis for access control definition. Users can be assigned multiple roles at the same time and each role is able to target several access control records which allow or restrict overlapping resources. As a consequence it pays to learn how Camlin processed these definitions so that proper access is maintained. The relationship between users, roles and access control records are depicted below:

Figure 3: Role configuration

In the example shown, User 1 has Administrator role which has been configured to allow all targets and all actions; this will allow the user to have no restrictions in Camlin. User 2 has 'Report Operator' role which allows access for Camlin Reporting module only and 'Developer' role which allows access to Camlin 1CX and Camlin Biometrics modules only. User 3 has 'Biometrics Operator' role with access to Camlin Biometrics module only and finally User 4 with roles 'Report Operator', 'Developer' and 'Biometrics Operator'.

Camlin wil start with considering all targets and all actions as restricted and by default, if a role does not explicitly allow either, it will be restricted. From then on, role configuration will obey the order of the access control record defined within. When multiple roles are assigned to a user, the system will only allow new targets or actions, that is it will not restrict a target or action already allowed by another role. Therefore care should be taken to ensure the access of a particular user is configured with the correct set of control records. These example combinations will result in the following consolidated permissions resolved by the system:

Figure 4: Consolidation of permissions

Default restriction policies will apply to all targets by making them unavailable and invisible to the user. For explicitly restricted targets, the administrator is able to define whether the user may see the restricted items in the page but they will be greyed out as disabled components and stripped of any functionality. This feature for restricted components may in some cases apply to actions in the form of disbled buttons but for the most part it will drive the viewing of target pages and tabs.

CamlinConnect organises access policies in roles that can be assigned to individual users as the administrator sees fit. The roles in turn are configured as per the security requirements of the organisation and are the responsibility of the designated administrator to setup, manage and apply to users. CamlinConnect will install a number of built-in public roles. Public roles are generic off the shelf and ready to use available to all organisations in CamlinConnect. These public roles are pre-configured with most well-known access profiles such as administrator, developer, reports operator, etc. Nuamedia may change the number and definition of these public roles at any time. Each organisation nevertheless can and should review whether the available public roles are sufficient for the particular access requirements and create any additional roles that satisfy those requirements. Roles created by each organisation will always be private, local to the organisation and will only be visible to the organisation that created it.

Access Control Records

Roles in CamlinConnect are configured using access control records. These define what is allowed and what is restricted in the system, and whether the restricted or allowed item is a target or an action. In the case of targets the administrator can also define whether the restricted item is disabled or invisible. CamlinConnect uses a matching expression for each control record which may match multiple targets at the same time. All matching items will be affected by the control record and a single role may have any number of control records. CamlinConnect will honour the order of the access control records and the administrator can change the order of the records at any time. This is crucially important because if some item is allowed first but restricted later then it will not be available.

Figure 5: Access control record configuration for a role

An empty expression equates to matching all items. A name is always required but a description is optional.

First Project

Test Numbers