Skip to main content
tiCrypt 2.18.1

Onboarding

Prerequisites

User Role:

Sub-admin, Admin, Super-admin

Permission Requirements

  • User Administration
    • Create and edit user profiles
    • View all users, not only those in their teams, groups and projects

The Onboarding table, its overlay, and every action on a template require only Create and edit user profiles. Applying a template to users starts from the Users table, which requires View all users, not only those in their teams, groups and projects. Each step of the template then runs with your own permissions: a step you lack the permission for fails and is logged in the task, and the remaining steps still run.

Onboarding templates automate user provisioning by pre-assigning a user profile, team memberships, project memberships, certifications, and VM configurations in a single action. Instead of manually configuring each new user (assign profile, add to teams, add to projects, grant certifications), apply an onboarding template to handle all steps at once.

tip

For a step-by-step onboarding checklist that maps institutional roles to tiCrypt profiles, teams, and projects, see Institutional Role Mapping.

When to use onboarding templates:

  • You regularly onboard users with the same role and access requirements (e.g., "new researcher in Lab A")
  • You want consistent provisioning: every user who receives the template gets the same permissions, teams, and project access
  • You need to onboard multiple users quickly using bulk actions

Create one template per user archetype in your organization. For example: "Standard Researcher" (basic Vault and VM access, Team Alpha, no project restrictions), "CUI Researcher" (full access, CUI project membership, required certifications), "Lab Manager" (Sub-admin role, team management permissions).

What a template defines:

ElementWhat it sets
ProfileThe role and permission set copied onto the user
StateThe account state given to the user: Inactive, Active, Active and escrow on next login, or not set
TeamsWhich teams the user joins
ProjectsWhich projects the user gets access to, with role and expiration
CertificationsRequired security certifications and their renewal periods
VM ConfigurationsVM configurations created for the user when the template is applied

A template is never applied automatically. Registering does not match a new user to a template; an administrator applies one to selected users with the Onboard action, as described in Onboard Users with a Template. tiCrypt then runs the steps in order: profile, state, teams, projects, certifications, and VM configurations.

The Onboarding Table​

Location: Management > Users > Onboarding

The table shows the Name, Added, Modified, User, Profile, Status, Teams, Projects, Certifications, and VM Configs of each template.

The following table describes the actions available when you select templates in the Onboarding table. Open overlay and Delete onboard template(s) appear as toolbar buttons; the others are in the Open full menu.

ActionDescription
Open overlayOpens the template, with its Profile (<profile name>), State, Teams, Projects, Certifications, and Virtual Machine Configurations sections. Single selection only.
Edit onboard profileSets the profile the template applies. Single selection only.
Change onboard stateSets the account state the template applies. Single selection only.
Add team, Add project, Add certification, Add VM configurationAdds an item to the template, as described in the sections below. Single selection only.
Delete onboard template(s)Deletes the selected templates. Available for any selection.

Create an Onboarding Template​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Onboarding in the top left panel.
  4. Click the Create new onboarding template button in the top right panel.
  5. In the Create a new onboard template dialog, enter the Name. It can be up to 80 characters, cannot contain / \ | " : * ? < > { }, and must differ from the other template names.
  6. Click Create.

Set the Account State Applied by a Template​

The state of a template is not an on and off switch for the template. It is the account state that the template gives every user it is applied to. Choose Do not set to leave each user's current state unchanged.

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Onboarding in the top left panel.
  4. Select the onboarding template for which you want to change the state.
  5. Click the Open Overlay button in the top right panel.
  6. In the window, click State in the top left panel.
  7. In the prompt, choose Do not set, Inactive, Active, or Active and escrow on next login.
  8. Click the button, which reads Activate, Deactivate, Require escrow, or Do not set in profile to match your choice.
tip

Set the state to Active in templates for new users, so that applying the template also activates their account.

note

Active and escrow on next login appears only when the escrow service is enabled. Choosing Inactive asks for a reason for deactivation.

Set the Profile of an Onboarding Template​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Onboarding in the top left panel.
  4. Select the onboarding template for which you want to set the profile.
  5. Click the Open Overlay button in the top right panel.
  6. In the window, click Profile in the top left panel.
  7. In the Select profile for onboarding template dialog, select the profile. The dialog lists every user profile, including profiles you cannot apply yourself.
  8. Click Set.
note

Set a profile on every template you use. Applying a template that has no profile always logs Failed to apply user profile in the onboarding task.

Remove Profile Settings in an Onboarding Template​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Onboarding in the top left panel.
  4. Select the onboarding template to remove the profile setting.
  5. Click the Open Overlay button in the top right panel.
  6. In the window, click Profile in the top left panel.
  7. In the prompt, click the Remove profile setting button in the bottom left.

Add Certification to an Onboarding Template​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Onboarding in the top left panel.
  4. Select the onboarding template to add the certification.
  5. Click the Open Overlay button in the top right panel.
  6. In the window, click Certifications in the top left panel.
  7. Click the Add certification button in the top right panel.
  8. In the Add certification to onboard dialog, select the security requirement.
  9. Set the Expiration as a duration: a number of days, weeks, months, or years, at least one day. It cannot be longer than the requirement's maximum lifespan ("The expiration time must not exceed ...").
  10. Click Certify.

When the template is applied, the certification expires at the start of the day reached by adding the duration, or the requirement's maximum lifespan if that is shorter, to the time of applying. A user who already holds the certification has it updated.

Edit Certification in an Onboarding Template​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Onboarding in the top left panel.
  4. Select the onboarding template to edit the certification.
  5. Click the Open Overlay button in the top right panel.
  6. In the window, click Certifications in the top left panel.
  7. Select the existing certification to edit.
  8. Click the Edit button in the top right panel.
  9. In the Edit certification dialog, edit the Expiration duration.
  10. Click Save.

Delete Certification(s) from an Onboarding Template​

bulk-action

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Onboarding in the top left panel.
  4. Select the onboarding template to delete the certification.
  5. Click the Open Overlay button in the top right panel.
  6. In the window, click Certifications in the top left panel.
  7. Select the existing certification(s) to delete.
  8. Click the Delete button in the top right panel.
  9. In the Delete 1 certification from the onboard template? dialog (or Delete N certifications from the onboard template?), click Delete 1 certification (or Delete N certifications).

The selected certifications are removed from the template only. Users who were already onboarded are not affected.

Add a Team to an Onboarding Template​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Onboarding in the top left panel.
  4. Select the onboarding template to add the team.
  5. Click the Open Overlay button in the top right panel.
  6. In the window, click Teams in the top left panel.
  7. Click the Add team button in the top right panel.
  8. In the Add team to onboard dialog, select the team. Teams already in the template are not listed.
  9. Click Select.

Remove Team(s) from an Onboarding Template​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Onboarding in the top left panel.
  4. Select the onboarding template to remove the team(s).
  5. Click the Open Overlay button in the top right panel.
  6. In the window, click Teams in the top left panel.
  7. Select the team(s) to remove from the onboarding template.
  8. Click the Delete onboard template(s) button in the top right panel.
  9. In the Delete 1 team from the onboard template? dialog (or Delete N teams from the onboard template?), click Delete 1 team (or Delete N teams).

Only the template changes: the team itself, and users who were already onboarded, are not affected.

Add a Project to an Onboarding Template​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Onboarding in the top left panel.
  4. Select the onboarding template to add the project.
  5. Click the Open Overlay button in the top right panel.
  6. In the window, click Projects in the top left panel.
  7. Click the Add project button in the top right panel.
  8. In the Add projects to onboard dialog, fill in the fields described in the table below. Projects already in the template are not listed.
  9. Click Save.

The following table describes the fields of the Add projects to onboard and Edit project dialogs.

FieldDescription
ProjectThe project, picked from the project tree.
Expiration (Optional)How long the membership lasts after the template is applied, as a number of days, weeks, months, or years.
Role in projectRegular member: can classify resources with this project (when active). Manager: can also declassify resources to parent projects or remove this project tag completely (when active).
RestrictionsNo restrictions, Cannot download, or Cannot download, cannot view, for files tagged with the project.
Existing membershipsSkip leaves users who are already members unchanged. Update updates their expiration and role; it is disabled when you lack permission to edit project memberships.

The dialog notes that users must be members of both parent and subproject. When the template is applied, the user is first added to every ancestor project of a subproject; ancestor projects the user already belongs to are skipped.

Edit a Project in an Onboarding Template​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Onboarding in the top left panel.
  4. Select the onboarding template to edit the project.
  5. Click the Open Overlay button in the top right panel.
  6. In the window, click Projects in the top left panel.
  7. Select the existing project to edit.
  8. Click the Edit button in the top right panel.
  9. In the Edit project dialog, edit the expiration, role, restrictions, and existing memberships setting.
  10. Click Save.

Remove Project(s) from an Onboarding Template​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Onboarding in the top left panel.
  4. Select the onboarding template to remove the project(s).
  5. Click the Open Overlay button in the top right panel.
  6. In the window, click Projects in the top left panel.
  7. Select the existing project(s) to remove.
  8. Click the Delete button in the top right panel.
  9. In the Delete 1 project from the onboard template? dialog (or Delete N projects from the onboard template?), click Delete 1 project (or Delete N projects).

Only the template changes: users who were already onboarded are not affected.

Add a Virtual Machine Configuration to an Onboarding Template​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Onboarding in the top left panel.
  4. Select the onboarding template to add the virtual machine configuration.
  5. Click the Open Overlay button in the top right panel.
  6. In the window, click Virtual Machine Configurations in the top left panel.
  7. Click the Add configuration button in the top right panel.
  8. In the Add VM configuration to onboard dialog, fill in the three sections described in the table below.
  9. Click Create.

The following table describes the fields of the Add VM configuration to onboard and Edit VM configuration dialogs.

SectionFieldDescription
1 Template InformationName templateThe name of the VM configuration. The keywords @username and @loginId insert the user's name and email; Name preview shows the result.
Description (optional)A description of the configuration.
TeamThe team the configuration and its home drive belong to. Only teams you are a member of are listed.
ProjectThe project of the configuration. Users whom you have authorized to access this VM will also need to meet this project to use it.
2 Hardware SetupHardware SetupDetermines what software gets loaded and what hardware resources the VM will have access to.
3 Home DriveNameThe name of the home drive. The same keywords and preview are available.
CapacityThe size of the home drive, in GB by default. It must fit the default realm's limits and the selected team's quota.
FormatEXT4 (Linux), BTRFS (Linux), or NTFS (Windows), limited to the formats the hardware setup supports. NTFS drive names cannot be changed after creation.

When the template is applied, tiCrypt creates the home drive in the default realm, owned by the user, and a VM configuration owned by the user with that drive attached read-write.

Edit a Virtual Machine Configuration in an Onboarding Template​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Onboarding in the top left panel.
  4. Select the onboarding template to edit the virtual machine configuration.
  5. Click the Open Overlay button in the top right panel.
  6. In the window, click Virtual Machine Configurations in the top left panel.
  7. Select the existing virtual machine configuration to edit.
  8. Click the Open full menu button in the top right panel.
  9. Select Edit.
  10. In the Edit VM configuration dialog, edit the fields described in the table above.
  11. Once done, click Save.

Remove Virtual Machine Configuration(s) from an Onboarding Template​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Onboarding in the top left panel.
  4. Select the onboarding template to remove the virtual machine configuration.
  5. Click the Open Overlay button in the top right panel.
  6. In the window, click Virtual Machine Configurations in the top left panel.
  7. Select the existing virtual machine configuration(s) to remove.
  8. Click the Open full menu button in the top right panel.
  9. Select Delete.
  10. In the Delete 1 VM config from the onboard template? dialog (or Delete N VM configs from the onboard template?), click Delete 1 VM config (or Delete N VM configs).

Only the template changes: VM configurations already created for onboarded users are not affected.

Onboard Users with a Template​

Apply a template from the Users table: select the users, open the full menu, choose Onboard, pick the template, and click Onboard. The full procedure is in Add User(s) to an Onboard Template.

The Onboard <name> dialog (or Onboard N users) lists the templates with the name of each template's profile. Onboard stays disabled until the templates have loaded.

tiCrypt runs one task per user, named Onboarding <user> with <template>. The task shows its progress as Step 1 of 7 Applying user profile, Step 2 of 7 Applying user state, Step 4 of 7 Adding to teams, Step 5 of 7 Adding to projects, Step 6 of 7 Granting certificates, and Step 7 of 7 Creating VM configurations. If a step fails, the task logs the error and continues with the next step.

caution

Unless you are a Super-admin, you cannot onboard a user who is inactive and not in a team yet. Add the user to a team first; the error message offers a shortcut when you hold the Add users to any team permission.

Delete an Onboarding Template​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Onboarding in the top left panel.
  4. Select the onboarding template you want to delete.
  5. Click the Delete onboard template(s) button in the top right panel.
  6. In the Delete onboard template(s)? dialog, click Yes.

The teams, projects, certifications, and VM configurations are removed from the template, but the objects themselves are not affected.