tiCrypt 2.18.1

User Profiles

Prerequisites

User Role:

Sub-admin, Admin, Super-admin

Permission Requirements

• User Administration
  • View all users, not only those in their teams, groups and projects
  • View user profiles (permission templates)
  • Create and edit user profiles
  • Delete user profiles

info

To learn how institutional roles (PI, Lab Manager, Graduate Researcher, etc.) map to tiCrypt profiles and permissions, see Institutional Role Mapping.

For what each permission in a profile allows, see Permissions.

Access User Profiles

1. Go to the Management icon in the top left taskbar.
2. Navigate to the Users section.
3. Click the User Profiles in the top left panel.
4. View all user profiles in the system.

The User Profiles table requires the View user profiles (permission templates) and View all users, not only those in their teams, groups and projects permissions. Creating, editing, cloning, and importing profiles requires Create and edit user profiles; deleting requires Delete user profiles.

A profile is not assigned to users. A user matches a profile when the user's role and permissions are exactly the profile's role and permissions, and the Users column counts the matching users. A user whose role or permissions differ from every profile shows Custom in the Users table.

View Basic Information of User Profiles

1. Go to the Management icon in the top left taskbar.
2. Navigate to the Users section.
3. Click the User Profiles in the top left panel.
4. Select the user profile whose details you want to view.
5. Click the View button in the top right panel.
6. View the user profile name, role, permissions, session downgrade approval, escrow approval, and creation and modification dates in the left panel, as well as the users associated with the profile.

Create a User Profile

1. Go to the Management icon in the top left taskbar.
2. Navigate to the Users section.
3. Click the User Profiles in the top left panel.
4. Click the Create new user profile button in the top right panel.
5. In the Create new user profile dialog, enter the user profile name.
6. Select the user role in profile and whether or not users can escrow their keys.
7. Click Save.

The following table describes the fields of the Create new user profile, Update <name>, and Clone <name> dialogs.

Field	Description
Name	Required. Up to 80 characters, without / \ | " : * ? < > { }, and different from the other profile names.
Permissions table	The permissions in the profile, with the columns Category, Permission, and Type. Click a category's chevron to expand or collapse it, and tick its checkbox to select all of its permissions. Permissions you do not hold yourself are disabled unless you are a Super-admin, and a category checkbox changes only the permissions you hold. Added permissions are highlighted green and removed permissions red.
User role	The role in the profile: User, Sub-administrator, Administrator, or Super-administrator.
Can users with this role place their keys into Escrow?	Required. Yes, they can be required to escrow their key on login. or No, their keys must never be escrowed.
Can user profiles be used for session downgrades?	Under Advanced Options. Yes lets admins assume the profile's reduced privileges for specific actions; No is the default.

Two profiles cannot have the same role and permissions. If another profile already has them, saving fails with The <name> profile already has the same permissions.

Create a Custom User Profile

1. Go to the Management icon in the top left taskbar.
2. Navigate to the Users section.
3. Click the User Profiles in the top left panel.
4. Click the Create new user profile button in the top right panel.
5. In the Create new user profile dialog, enter the user profile name.
6. In the permissions table, tick the appropriate user profile permissions.
7. Select the user role in profile and whether or not users can escrow their keys.
8. Click Save.

Apply User Profile

bulk-action

1. Go to the Management icon in the top left taskbar.
2. Navigate to the Users section.
3. Click the Users in the top left panel.
4. Select the user(s) to apply the user profile to.
5. Click the Open full menu button in the top right panel.
6. Select Apply profile.
7. In the pop-up, select the user profile.
8. Click Apply.

Edit User Profile

1. Go to the Management icon in the top left taskbar.
2. Navigate to the Users section.
3. Click the User Profiles in the top left panel.
4. Select the user profile to edit.
5. Click the Edit button in the top right panel.
6. In the Update <name> dialog, edit the user profile name.
7. Edit the user role in profile and whether or not users can escrow their keys.
8. Once done, click Save.
9. If you changed the role, the permissions, or the escrow setting, the dialog Please select which of the matching users you wish to apply the changes to opens. It lists every user who matches the profile as "Name (email)", all ticked. Untick the users who should keep their current role and permissions.
10. Click Apply changes to N users.

tiCrypt updates the profile and the ticked users in one task, Update <profile> and apply changes to N users. Users you unticked keep their old values and no longer match the profile, so they show as Custom. Changing only the name or the session downgrade setting does not open the second dialog.

Edit Custom User Profile

1. Go to the Management icon in the top left taskbar.
2. Navigate to the Users section.
3. Click the User Profiles in the top left panel.
4. Select the user profile to edit.
5. Click the Edit button in the top right panel.
6. In the Update <name> dialog, edit the user profile name.
7. In the permissions table, tick or untick the user profile permissions.
8. Edit the user role in profile and whether or not users can escrow their keys.
9. Once done, click Save.
10. In the Please select which of the matching users you wish to apply the changes to dialog, untick the users who should keep their current permissions.
11. Click Apply changes to N users.

warning

Editing a profile's permissions changes access for every matching user you leave ticked in the second dialog. Review the list before you apply the changes.

Clone User Profile

1. Go to the Management icon in the top left taskbar.
2. Navigate to the Users section.
3. Click the User Profiles in the top left panel.
4. Select the user profile to clone.
5. Click the Clone button in the top right panel.
6. In the Clone <name> dialog, enter a different user profile name.
7. Change the role or the permissions.
8. Once done, click Save.

note

A clone must differ from the original in its name and in its role or permissions. Two profiles cannot share a name, and two profiles cannot have the same role and permissions: saving a clone that changes only the name fails with The <name> profile already has the same permissions.

Export and Import User Profiles

User profiles can be saved to a JSON file and created again from that file, on the same tiCrypt system or on another one. Use this to set up the same profiles on a new deployment, to keep a copy of your profiles outside tiCrypt, or to create several profiles at once from a file you write yourself.

Importing only creates new profiles. It never changes an existing profile, and it does not assign the new profiles to anyone; use Apply User Profile for that.

Export User Profiles to JSON

1. Go to the Management icon in the top left taskbar.
2. Navigate to the Users section.
3. Click the User Profiles in the top left panel.
4. Select the user profile(s) to export.
5. Click the Export JSON button in the bottom toolbar.
6. Select Export selected items, or Export all items to export every profile.

The file lists each profile's name, role, permissions and escrow setting, so it can be imported as it is.

Import User Profiles from JSON

1. Go to the Management icon in the top left taskbar.
2. Navigate to the Users section.
3. Click the User Profiles in the top left panel.
4. Click the Import user profiles button in the top right panel.
5. Drag and drop the JSON file into the window, or click Choose file and select it.
6. Review the list. Each profile shows its role and number of permissions, marked Importing or Will not import with the reason.
7. Optionally, click Download errors to save the reasons for the skipped profiles as a JSON file.
8. Click Import (the button shows how many profiles will be imported, for example Import 2 of 3).

note

Importing requires the Create and edit user profiles permission, and is available from version 2.17.13 of the tiCrypt web application.

JSON File Format

The file is a JSON array with one object per profile. An exported file can be imported unchanged; a file you write yourself needs only these fields:

Field	Required	Value
name	Yes	The profile name. It must not be used by an existing profile or by another profile in the file.
rankName	Yes	The role in the profile: User, Sub-admin, Admin or Super-admin.
permissionList	Yes	The profile's permissions, as permission IDs. The easiest way to get the IDs is to export a profile that has the permissions you need.
neverEscrow	Yes	true if users with this profile can never escrow their keys, otherwise false.
downgrade	No	true if the profile can be used for session downgrade. Defaults to false.

Any other fields, such as the IDs, dates and user counts in an exported file, are ignored. The imported profile gets a new ID.

A basic file with one profile for researchers who sign in, escrow their key, browse their files and connect to their VMs:

[
  {
    "name": "Basic Researcher",
    "rankName": "User",
    "neverEscrow": false,
    "permissionList": [
      "GetTeamInfo",
      "EscrowKey",
      "QueryOwnKeyEscrowed",
      "GetFileInfo",
      "GetDirInfo",
      "GetVMInfo",
      "ProxyToVM"
    ]
  }
]

Why a Profile Is Not Imported

A profile marked Will not import is skipped and the others are still imported. The reasons are:

• The name is missing or invalid, or another profile already has it, in the system or in the file.
• rankName is missing or is not one of the four roles.
• permissionList is missing, or contains a permission ID this tiCrypt system does not recognize.
• neverEscrow is missing or is not true or false.
• Another profile, in the system or in the file, already has the same role and permissions. tiCrypt does not allow two profiles with the same role and permissions.

Delete User Profile(s)

bulk-action

1. Go to the Management icon in the top left taskbar.
2. Navigate to the Users section.
3. Click the User Profiles in the top left panel.
4. Select the user profile(s) to delete.
5. Click the Open full menu button in the top center panel.
6. Select Delete.
7. In the Delete <name>? dialog (or Delete N user profiles?), click Delete <name> (or Delete N user profiles).

The dialog explains that deleting a profile is not dangerous, but that you lose the ability to manage the users with a matching role and permissions as a group until you create an effectively identical profile. If you lack the Create and edit user profiles permission, it also warns that you will not be able to undo the action.

info

Deleting user profiles does not delete any users from the system, and does not change any user's role or permissions.