Groups
Create and manage groups in the XPLG console: members, nested and administered groups, the policy a group carries, the built-in All and Administrators groups, and groups that mirror your directory for automatic role inheritance.
What you will do: build the groups that carry permissions, so that a user — local or federated — gets the right policy by belonging to the right group.
Groups are the role containers of the authorization model: users with identical duties share a group, the group carries a policy, and resource permissions are granted to groups. A group can contain users and other groups. Every XPLG system has at least an Administrators group and an All group; both can be viewed but not modified or removed. Local users must belong to at least one group.
Create a group
- Open Security > Groups and choose Add Group.
- Enter the Group name (fixed once saved), the Display Name and an optional Description.
- Under Groups List, move the groups this new group is associated with — its parent groups — from Available to Associated.
- Under Administered Groups List, move the groups this group may administer.
- Under Group Members, move the users and groups that belong to it.
- Under Policy Settings choose Use the policy of the selected groups (inherit from the associated groups) or Use the following Policy; see Policies.
- Save.
Everyday operations
| Task | Where | Notes |
|---|---|---|
| Find a group | Security > Groups, filter by group | |
| View All or Administrators | View on the row | Read-only |
| Modify a group | Edit on the row: display name, description, associated groups, administered groups, members, group administrators, policy | The group name cannot change |
| Remove a group | Delete on the row, confirm | Only a group that is no longer in use; never All or Administrators |
Groups that mirror your directory
When users authenticate against Active Directory or LDAP — or a gateway that asserts groups — create a group in XPLG with exactly the name the group has in the directory, assign it a policy and leave it empty: at sign-in XPLG retrieves the user's directory groups, matches them to groups of the same name and applies the matched group's policy automatically. If no policy is set on the matched group, the default policy applies. The groups retrieved are recorded in the audit log, so sign in once and read the list there to know which groups to create. See Active Directory and LDAP.
Segregate data by group
Resource permissions are granted to groups: remove the All group from the top-level folders (and from other folders and logs), then grant each group explicit visibility on its own folders, logs and apps — the way to separate business units, applications or customers on one deployment. See Folder, log, app and AppTag permissions.
Next: Policies
Source: XPLG wiki, pages 1594133428, 1594133443, 1594133432, 1594133434, 1594133455, 1594133513, 3161489438 (https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/1594133428).
