Manage users
Users always belong to and are created within a particular realm or imported to a realm from an external identity or storage provider.
To manage users, associated groups, and roles, you must have the MANAGE_USERS permission in Control Tower and such roles as manage-users, view-clients, query-groups, view-realm in the realm-management client of Keycloak.
To access the list of existing users, follow the steps below:
In the top right corner of the user management console, select a realm.
Click Users. On the right, you can see a list of the realm's users (if any).
Create users
To create a user, follow the steps below:
Navigate to Users and click the Add user button.
In the window that follows, type in Username. Optionally, add the user's first and last names in the respective fields.
In the Require User Action drop-down box, select an additional action that the user must complete when logging in.
- Update Password: change the initial password.
- Configure OTP: install and configure a password generator (Free OTP or Google Authenticator) on a mobile device.
- Update Profile: add or edit personal information, such as name, address, phone number, and so on.
- Update User Locale: change their present locale for correct internationalization.
- Verify User Email: at the first login, confirm the availability of a valid email account.
Set the Email verified toggle:
When the toggle is on, the user is assumed to have verified the address specified in the Email field and can receive notifications to the address or use it for authentication.
When the toggle is off, set up the user's email verification by selecting Verify User Email in the Require User Action box.
infoVerifying user emails is essential for the WorkFusion email notification functionality to work correctly.
Click the Save button.
A new user is created and assigned a unique ID with a Created At timestamp. Also, a page opens where you can configure the user's settings.
Configure user settings
To access the settings page for a particular user, select Users and click the ID of the user or Edit next to the username. This brings you to the Details tab of the settings page.
On the Details tab, you can do the following:
Edit the user data (for example, name, surname, and so on) and actions that the user is required to complete when logging in.
Enable or disable the user.
Disable or enable users
To disable or enable a user, go to the Details tab, turn off or on the User Enabled toggle, and click the Save button. By default, users are created with the toggle on.
Note that if a user is disabled or deleted on the IdP side, they are not disabled or deleted automatically in the User Management UI. Hence, you need to manually disable the user by turning the toggle off.
This ensures consistency with your IdP user lists. After a user is disabled in the User Management UI, they can no longer authenticate via REST API with default Control Tower (CT) credentials.
Maintain the same consistency with LDAP. The recommended approach is to disable those WorkFusion users that don't exist on the LDAP side.
For Microsoft Active Directory, it is also possible to enable automatic user synchronization:
Go to User Federation and choose your LDAP provider.
Open Mappers and add MSAD account controls the msad-user-account-control-mapper type.
The mapper integrates a MSAD user account state (account enabled, password expired, and so on) into the WorkFusion one using the
userAccountControlandpwdLastSetMSAD attributes. For example, ifuserAccountControlis 514, which indicates a disabled account, then the user in the WorkFusion User Management UI is disabled as well. The mapper can also handle exception codes for the LDAP user authentication.
If a user has both LDAP and IdP set up, the user is stored on the LDAP side. Hence, if a user gets either deleted or disabled on the LDAP side, make sure this state is properly mapped to WorkFusion User Management: for MSAD, the MSAD account controls mapper is set.
Group users
For instructions on adding users to groups, refer to Create groups| Add user to group.
Assign role to user
You can assign client- or realm-level roles. Without an assigned role, users cannot access the WorkFusion resources associated with the role. For instance, without the wf-control-tower client-level role, users won't be able to use the Control Tower functionality.
For instructions on assigning roles, refer to Manage and assign realm and client roles.
Set user attributes
Attributes are additional user data (apart from basic data, such as names and emails) that you can store in WorkFusion User Management. To create and add an attribute for a particular user, follow the steps below:
Go to the Attributes tab of the user settings page.
In the Key field, type in a name for the attribute and specify the attribute value in the Value field.
Click Save to add the attribute.
To specify more attributes, click Add.
Configure credentials
Configuring user credentials is essential to onboard users, in particular those that are not migrated from IdP or a storage provider but created in the WorkFusion User Management UI from scratch.
A user can have only one credential of the password type. Managing credentials other than passwords is the responsibility of the user. Admins can only delete user-defined credentials from the list on the Credentials tab (for example, when those were compromised).
If there is an IdP integrated and a user sets a password in the WorkFusion User Management, this does not affect login because the IdP password has not changed. However, the password change affects the REST API login.
If LDAP is configured and a user defines a password, it affects both the UI login and REST API login. However, the defined password is stored only locally in WorkFusion User Management.
There are two ways to configure credentials:
Set temporary password
When you use the method for configuring credentials, new users log in with the temporary password but are then requested to reset it. In this case, you must set up temporary passwords for each user individually. To do that, follow the steps below:
Go to Users. In the list on the right, click the user's ID or Edit to open the settings page.
Navigate to the Credentials tab.
In the Set password section, turn the Temporary toggle on.
Type in and confirm the password, click the Set password button.
Once the password is set, you see the Reset password section instead of the Set password one.
Configure without temporary password
This is the recommended way to onboard local users. When you use the method for configuring credentials, new users get verification emails from where they can proceed to set credentials on their own for accessing the Work.AI platform.
Before the configuration, make sure to set up the SMTP server.
To enable users to set credentials without a temporary password, follow the steps below:
Go to Realm settings > Login. Make sure the Duplicate emails toggle is off.
Turn on Forgot password toggle. As a result, the screen to log in to Work.AI will include a link to reset the password.
Navigate to Authentication > Required Actions. For the Update Password action, select both Enabled and Default.
As a result, the Update Password action will appear in the Required User Actions field on the Details tab for each new user you create. Thus, you will not have to set up the same action for the new users.
Go to Users and click the user's ID or Edit to open the user settings page.
Navigate to the Credentials tab. In the Credentials Reset section, do the following:
In the Reset Actions field, select Verify email.
In the Expires In field, set for how long the reset action will remain valid.
Click Send email. The user gets an automatically generated onboarding email:
Clicking the Verify Email button will bring the user to the Update password screen where the user sets the credentials to access Work.AI.
Manage user accounts
Once you configured the credentials, the rest of user account management is on users. For details on how users can manage their accounts, read the guide.
Configure user authentication settings
Configure two-factor authentication
Two-factor authentication is an optional means to enhance access security. You can do this right after installation or any time later. For detailed instructions, refer to Configure two-factor authentication.
Set password policy
By default, all WorkFusion user passwords are required to meet the following criteria:
- Minimum length of eight (8) symbols
- At least one (1) uppercase letter
- At least one (1) lowercase letter
- At least one (1) special character
- At least one (1) digit
- Not identical to the username
- Not in the password history
- Not in the 5,000,000 of most popular passwords
However, admin users can set a custom password policy to match their organization's requirements:
On the left menu, click Authentication and navigate to the Password policy tab.
In the Add policy... drop-down box, choose one or more policy types. The chosen policies appear in the table at the centre of the page.
Configure each chosen policy type by changing the parameter in the Policy Value field:
Digits: set the number of digits required in the password string.
Expire Password: define the number of days for which the password is valid. After the period expires, the user is required to change their password.
Hashing Algorithm: instead of being stored as clear text, passwords are hashed using standard hashing algorithms prior to storing or validation.
Hashing Iterations: specify the number of times a password will be hashed prior to storing or validation. Note that a high hashing iteration value can take more CPU power, thus impacting performance.
Lowercase Characters: specify the number of lowercase letters required in the password string.
Maximum length: set the maximum number of characters that can be used in the password string.
Minimum length: set the minimum number of characters that can be used in the password string.
Not Email: when set, the password is not allowed to be the same as an email address.
Not Recently Used: set the number of old passwords that the policy saves as history. When a user changes their password, they cannot use the stored passwords.
Not Username: when set, the password is not allowed to be the same as the username.
Password Blacklist: add those passwords that are not allowed to be used (like the default Not in the 5,000,000 of most popular passwords setting).
Regular Expression: specify one or more Perl regular expression patterns that passwords must match.
Special Characters: define the number of special characters like '?!#%$' required in the password string.
Uppercase Characters: specify the number of uppercase letters required in the password string.
Click the Save button to apply the custom password policies. After that, the user registration and the Update Password required action will enforce the new policy.
If the password policy is updated, set an Update Password action for every user.
Configure security lockouts
The lockout settings are configured for each particular realm and applied to anyone attempting to log into the realm. WorkFusion User Management allows you to configure two types of lockouts:
A permanent lockout disables a user account after an attack until the administrator decides otherwise.
A timeout-based lockout disables a suspicious user account for a limited period. The longer the attack continues, the longer the period becomes.
To configure the settings, complete the steps below:
Make sure you are in the right realm.
Select Realm Settings > Security Defenses > Brute Force Detection.
As the Brute Force Detection feature is disabled by default, click the Enable toggle to proceed. A configuration window appears on the screen with default brute force settings.
To enable a timeout-based lockout, leave the default settings as shown above or change them as appropriate. To enable a permanent lockout, turn on the Permanent lockout toggle and either change the default values or leave them as they are.
Click Save.
Delete users
To remove a user permanently, follow the instructions below:
On the Users list, find the user you want to delete. When needed, use the search functionality.
Click Delete next to the user and confirm the deletion.
After a user is deleted, they are no longer available on the Users list.
Deactivate users
You can lock a user's account after a predefined period of inactivity, for example, three months. For more information, see the Deactivate users guide.