Users and administrators¶

This page covers the three modules used to manage accounts in Bastion: users (of the portal and of the console), administration groups (which grant administrative rights to a group) and delegated administrators (nominative assignments). It is intended for an administrator who wants to create, edit or delete these accounts and assign the corresponding administration rights.

The three modules are accessible from the Authentication domains module, by first selecting a domain and then clicking on one of the Users, Administration groups or Delegated administrators buttons. The Users module is also accessible through a direct shortcut in the administration console.

Users¶

The Users module lists, creates, edits and deletes user accounts of a domain. Its behaviour depends on the domain type.

Domain type	Account management
Local directory	Manual create, edit and delete. Role and session options can be defined.
SAML (federation)	Manual create, edit and delete, but without password (authentication is handled by the identity provider). Accounts are mainly used to store metadata (email, group memberships).
LDAP and Anonymous directory	Not listed in the domain selector — accounts are managed on the directory side or do not apply.

Selection and filtering¶

Element	Description
Domain	Picks the domain whose accounts are listed. Only local and federation domains are offered.
Group	Filters the list by group. A synthetic All entry is added at the top to show every account.
Search field	Filters by account-name substring. The search fires 700 ms after the last keystroke, or immediately with the `Enter` key.
Grid columns	ID, Name (hidden for SAML domains), Email, Groups. With no account, the grid shows No available users.

Add a user — local domain¶

Input constraints and available fields:

Field	Description
User name	Mandatory. The `<` and `>` characters are forbidden. Must be unique within the domain.
Password / Confirm	Mandatory on creation. The password policy in force on the domain is applied.
Full name	Display label shown in place of the technical name in some views.
E-mail	Validated as a proper email address.
Phone	Validated as a phone number.
IP lock	List of IP addresses or ranges (with optional mask, comma-separated) from which the user is allowed to connect. This is the address seen by the Mediation Controller: in case of an intermediate NAT, enter the public address.
Role	See the roles table below.

Roles available on a local domain:

Role	Effect
User (default)	Access to the user portal only.
Administrator	Access to the administration console with full rights.
Delegated administrator	Access to the administration console with limited rights. Actual rights depend on a delegated administrator profile and on the administration groups the account belongs to.

Two expandable options cap the lifetime of the account:

Option	Description
Limited sessions	Caps the number of logons. When this number is reached, the chosen action applies: lock (default) or delete the account. Minimum is 1.
Temporary account	Limits the validity of the account by a start and end date + time. On the end date the chosen action applies: lock or delete. The end date must be strictly after the start date.

admin account of the default local domain

The built-in admin account of the default local domain is special. Its role is forced to Administrator and the Limited sessions and Temporary account options are hidden — these limitations cannot be applied to it.

The Groups tab assigns the account to one or more groups through drag-and-drop from the available list to the selected list. A search field filters the left-hand list.

Add a user — SAML domain¶

For a federation domain, the form is reduced: because authentication is delegated to the identity provider, no password is stored on the Bastion side.

Field	Description
User name	Mandatory. The `<` and `>` characters are forbidden. Must match the identifier returned by the identity provider.
Description	Free text.
E-mail	Validated as a proper email address.

The Groups tab shows a two-column list (available / selected) with search and a « select all » button.

Edit a user¶

To open the edit form, select an account in the list and click the Properties icon, or double-click the row. The same constraints as for creation apply, with three additional tabs specific to edition:

PropertiesApplicationsSecurity keys

Attaches free-form key/value pairs to the account. Enter a label and a value, then click Add. A label already used is rejected. Each entry can be deleted individually through the delete button on its row, with confirmation.

Lists the resources the account can access, computed from the access contracts.

For each resource the following information is shown:

the name and the icon of the service type (RDP, HTML5 RDP, SSH, VNC, SMB, VPN, ICA, etc.),
the applicable restrictions as icons: video or event recording, workflow lock, one-time access, remaining duration, date range, time window,
the available access: green icon if at least one site of the contract has an Edge Gateway online, red otherwise.

A search field and an expandable filter block narrow the list by application type (standard / privileged), by service type or by restriction state.

Lists the FIDO / WebAuthn keys registered by the account from the portal.

Columns: Display name, Creation date. Each key can be deleted individually, with confirmation. Adding a new key is done by the user from the portal.

Delete a user¶

Select one or more accounts in the list and click the × button. A confirmation prompt is shown.

Several safeguards apply:

The admin account of the default local domain can never be deleted.
A delegated administrator cannot delete an account whose role is not User (so they cannot delete another administrator or delegated administrator).

Administration groups¶

The Administration groups module declares that a group existing in a domain grants administration rights to its members. It is opened from the Authentication domains module through the Administration groups button.

Domain type	Availability
Default local directory	Available. Only delegated administrator groups can be declared (the checkbox is forced).
LDAP	Available. Choice between full administrator group and delegated administrator group.
SAML (federation)	Available. Choice between full administrator group and delegated administrator group.
Other local directories, anonymous directory	Not available.

Grid columns: Group name and Type (administrator or delegated administrator).

Add a group¶

Select the domain from the drop-down list.
Click the + button.
Fill in the fields and validate.

Field	Description
Group	Picks the group. Typing a few characters dynamically filters the list of groups retrieved from the domain. For a local domain, the value must correspond to a group that already exists in the domain (free text is rejected). For LDAP or federation domains, free text is accepted.
Delegated administrators group	Check-box that distinguishes a delegated administrators group (checked) from a full administrators group (unchecked). Hidden and forced to checked on local domains.

Delete a group¶

Select the group in the list and click the × button. The deletion prompts for confirmation. Multi-selection is supported.

Delegated administrators¶

The Delegated administrators module lists by name the accounts recognised as delegated administrators on an LDAP or SAML domain. It is opened from the Authentication domains module through the Delegated administrators button.

Domain type	Availability
LDAP	Available.
SAML (federation)	Available.
Other types	Not available.

Why a nominative registration?

For LDAP and SAML domains, belonging to an administration group may not be enough: this module lets you name an account explicitly as a delegated administrator. The registration becomes effective only if the account also belongs to a delegated administrators group declared in the previous module (chapter Administration groups).

Add a delegated administrator¶

Select the domain from the drop-down list.
Click the + button.
Enter the user name as it exists in the directory (the < and > characters are forbidden), then validate.

Delete a delegated administrator¶

Select one or more accounts in the list and click the × button. The deletion prompts for confirmation. The same safeguards as in the users list apply (a delegated administrator cannot delete another account whose role is not User).