tiCrypt 2.18.1

VM User Management

A VM user is an account that exists inside a running virtual machine. A VM user is not a tiCrypt user. The two systems share names and can refer to the same person, but they are separate hierarchies with separate permissions, and neither inherits from the other.

Why VM users are separate from tiCrypt users

They are different trust domains. The main system governs accounts, teams, projects, and Vault encryption. A virtual machine governs the operating system, its drives, and the live sessions on it. A system administrator can activate accounts and configure hardware but cannot open a VM terminal or read its drives; a VM Owner has full authority over their machine but cannot promote users or change system settings. Access to a VM is granted by its Owner and is never inherited from an administrative role.

This is what makes the compliance claim provable. In regulated environments administrators must be able to demonstrate that they cannot reach research data. A single unified permission system would make that impossible to show. Splitting the hierarchies means the proof is structural rather than a matter of policy.

VM users persist on the home drive. The VM user database lives on the first attached drive, so roles and permissions survive restarts and travel with the drive if it is attached to another configuration as its home drive. Attaching it as an additional drive does not import the database.

Co-owner is the role that grants drive access. Managers can manage users without holding drive keys; co-owners hold the keys. Grant co-ownership only to people you intend to give the data to.

Before you begin

• The VM is running and you are its Owner, or a Co-owner or Manager with the relevant permission.
• To add users or run Sync user permissions from the Users section, you also need the system permission Share VMs with other users. The Manager role on the VM is not enough on its own.
• You cannot modify the VM Owner, and you cannot grant permissions that you do not hold yourself.

View the Users of a Virtual Machine

Location: Virtual Machines > VMs > select the virtual machine > VM Settings and Details > Users

The following table describes the columns of the Users table.

Column	Description
Name	The tiCrypt user. Click the name to open the VM user's detail page.
VM Username	The account name of the user inside the VM operating system.
Role	User, Manager, Co-owner, or Owner.
User profile	The profile whose role and permissions match the user's, or Custom when none matches.
Groups	The VM groups the user belongs to.
Added	When the user was added to the VM.
Last updated	When the user's role or permissions last changed.

A row is highlighted as a warning when the user's role on the VM does not match how tiCrypt has authorized them to connect, and as an error when tiCrypt has not authorized the user to connect at all. Sync user permissions and Re-authorize user(s) repair both cases.

Managers, Co-owners, and the Owner can select users and use these additional actions from Open full menu:

• Re-authorize user(s): Revokes and grants again each selected user's tiCrypt authorization to connect to the VM, with their current role. The task is named Re-authorize followed by the number of users.
• Repair user home(s): Asks the VM to repair the home directory of each selected user. The task is named Repair home of followed by the number of users.

VM user detail page

Click a user's name to open their detail page. It shows the following cards:

• Basic info: The user's tiCrypt account, their account name inside the VM, and when they were added.
• Profile info: The matching profile, or Custom followed by the number of permissions, the role, and when the profile was last modified.
• Permissions: Each VM permission the user holds, with its description, or "This user has no permissions".
• Access directories and Groups: The access directories and VM groups the user belongs to. These cards appear when you are a Manager or higher, or when you view your own page, and you hold the Access Directories or Groups permission.

On another user's page (not the Owner's), Managers, Co-owners, and the Owner can use Edit role/permissions and Remove from VM. They work the same way as Edit user access and Remove user access in the table.

Add Users to a Virtual Machine

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to add users to.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, select the Users section in the left panel.
6. Next, click the Add users button in the top-right panel.
7. In the pop-up, enter the user names to add, their profile, and their role in the VM.
8. For custom users, tick or untick permissions in the VM.
9. Click the Add button. Its label names what you selected, for example Add 2 users.

Result:

tiCrypt registers each user on the VM with the chosen role and permissions, authorizes them to connect, and shows the task Add followed by the user name or the number of users.

The following table describes the fields of the Add users to vm-name prompt.

Field	Description
Add Users, Teams, Groups	The users, teams, and tiCrypt groups to add. You can pick from the users and teams you can access and from all tiCrypt groups. People already on the VM are not offered. Teams and groups are expanded to their members when you click Add.
Profile	Custom (the default) or one of the VM's profiles. Choosing a profile applies its role and permissions and hides Role and Permissions.
Role	Co-owner, Manager, or User. If you are the VM Owner, no role is preselected and you must choose one. If you are not the VM Owner, the role is set to User and the prompt shows "Only the owner of a VM (owner-name in this case) can designate managers and co-owners."
Permissions	All permissions start ticked. Permissions you do not hold yourself are unticked and cannot be ticked. Unticking Files also unticks and disables VM to Vault transfer and Vault to VM transfer. With Co-owner selected, every permission is on and the prompt shows "Co-owners automatically have all permissions enabled."

If the VM is tagged with a project, the picker marks each user who has no active membership in that project with "No active membership in this VM's project". When the teams or groups you select include such users, a warning gives their number and states that they will be added but cannot access the VM until they join the project. You can still add them.

Confirmations, Errors & Solutions

Failed to View Users Section in Virtual Machine

The Users section does not appear in the VM Settings and Details window.

Ask VM Users Permissions from VM Owner

Ask the VM owner to allow you to access the VM users section. The VM Settings and Details option itself only appears for Managers, Co-owners, and the Owner of the VM.

To Virtual Machine Owner
To allow VM users permissions to a VM user:  

1. In the VMs section, click the virtual machine where you want to update a user's viewing users permissions.
2. Click the VM Settings and Details option in the bottom center.
3. In the new window, select the Users section in the left panel.
4. Next, select the appropriate user, then click the Open full menu button in the top-right panel.
5. Select Edit user access.
6. In the pop-up, set the profile to Custom.
7. Scroll down under Permissions, and tick Users.
8. Click Save.

Did Not Select Users, Teams and/or Groups

You must select at least one user from the autocomplete.

Select Users, Teams and/or Groups

In the Add users to vm-name prompt, select existing users, teams and/or groups in the Add Users, Teams, Groups field.

Add Teams to a Virtual Machine

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to add teams to.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, select the Users section in the left panel.
6. Next, click the Add users button in the top-right panel.
7. In the pop-up, enter the team names to add, their profile, and their role in the VM.
8. For custom teams, tick or untick permissions in the VM.
9. Click the Add button. Its label names what you selected, for example Add 2 users.

note

• This adds all team members of the selected team(s) to the virtual machine.

Add Groups to a Virtual Machine

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to add groups to.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, select the Users section in the left panel.
6. Next, click the Add users button in the top-right panel.
7. In the pop-up, enter the group names to add, their profile, and their role in the VM.
8. For custom groups, tick or untick permissions in the VM.
9. Click the Add button. Its label names what you selected, for example Add 2 users.

note

This adds all group members of the selected group(s) to the virtual machine.

tip

You can add a combination of users, teams and groups to the VM simultaneously.

Confirmations, Errors & Solutions

Failed to View Groups Section in Virtual Machine

Failed to list groups: insufficient permissions: group:list: missing permission: {PermGroups}.

Failed to List Groups in Virtual Machine

Failed to list groups: insufficient role: group:list: insufficient role, need RoleManager.

Ask VM Groups Permissions from VM Owner

Ask the VM owner to allow you to access the VM groups section.

To Virtual Machine Owner
To allow group permissions to a VM user:  

1. In the VMs section, click the virtual machine where you want to update a user's group permissions.
2. Click the VM Settings and Details option in the bottom center.
3. In the new window, select the Users section in the left panel.
4. Next, select the appropriate user, then click the Open full menu button in the top-right panel.
5. Select Edit user access.
6. In the pop-up, set the profile to Custom and the role to Manager.
7. Scroll down under Permissions, and tick Groups List (all), create, delete, and modify groups.
8. Click Save.

Add Users, Teams and Groups as Managers to a Virtual Machine

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to add managers to.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, select the Users section in the left panel.
6. Next, click the Add users button in the top-right panel.
7. In the pop-up, enter the user, team and group names to add and their profiles.
8. Set their role to Manager.
9. For custom users, teams and groups tick or untick permissions in the VM.
10. Click the Add button. Its label names what you selected, for example Add 2 users.

note

• Adding a team or group as manager adds all users within the team or group as managers in the VM.
• Only the owner of a VM can designate managers and co-owners.

Confirmations, Errors & Solutions

Added Users, Teams and Groups Successfully

Add number-of-users users to vm-nametotal-adding-time.

Add Users, Teams and Groups as Co-owners to a Virtual Machine

bulk-action

Method One

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to add co-owners to.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, select the Users section in the left panel.
6. Next, click the Add users button in the top-right panel.
7. In the pop-up, enter the user, team and group names to add and their profiles.
8. Set their role to Co-owner.
9. For custom users, teams and groups tick or untick permissions in the VM.
10. Click the Add button. Its label names what you selected, for example Add 2 users.

Method Two

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Virtual Machines section on the top left panel.
3. In the left panel, click the menu next to the virtual machine to add co-owners to.
4. Select Add Co-owners (Add co-owners when the VM is stopped).
5. In the Edit who has access to configuration-name prompt, enter the user names to add as co-owners to the virtual machine.
6. Click Update followed by the configuration name.

tip

Updating the co-owner list also syncs user access on the running VM, so no separate sync is needed.

note

• You cannot add co-owners to a VM you do not own but that was shared with you. You must own or co-own the VM to add other co-owners with Method Two. With Method One, only the VM owner can designate co-owners.
• You may need to enter your password to perform this operation.
• The prompt does not list you. Other owners appear as chips, and removing a chip removes that user from the co-owners, the creator of the configuration included.

While the configuration is starting or running, the prompt shows one of these notices:

• VM not started by you: "This VM config is currently starting or running. However, the VM was not started by you so you will not be able to register managers on it."
• Missing drive permissions: "You do not have the permissions necessary to share" the configuration's drives "with any new owners (you need permission to share and add drive keys)."
• Otherwise: "Share VM config to automatically share associated drives. Users can restart and mount shared drives in other VMs. Use caution when sharing."

What adding a co-owner does

• Configuration owners: The user is added to the owners of the VM configuration, so they receive the Co-owner role every time the VM starts. With Method One this happens only when the VM has a configuration; on a VM without one, the Co-owner role adds a Manager with every permission.
• Drive keys: tiCrypt shares the key of each drive in the configuration with the new co-owner, read-write or read-only as the configuration attaches the drive. It shares only keys you hold yourself, so a drive you have no key for is not shared. With Method Two, such a drive is named in an error that starts with "Failed to share", followed by the reason: "you do not have a key for it", or "it is shared with you read-only, so you cannot share it read-write". A drive that was never formatted has no key yet; its key is shared with the co-owners when the drive is first formatted.

caution

Adding co-owner(s) can grant them access to the VM's associated drives, and co-owners can restart the VM and mount those drives in other VMs. Whether each co-owner actually receives a drive key depends on the keys and the Share drives permission of the person adding them.

Confirmations, Errors & Solutions

Updated Users' to VM Co-owners Successfully

Edit ownership of vm-name total-updating-time.

Added Users, Teams and Projects Successfully

Add user-name to vm-nametotal-adding-time.

Failed to Select the Co-owner

You must select at least one user from the autocomplete.

Select User to Be the VM Co-owner

In the Add Users, Teams, Groups field, ensure you select the user for the co-owner position in the VM.

Remove Users from a Virtual Machine

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to remove users from.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, select the Users section in the left panel.
6. Next, select the user to remove.
7. Click the Open full menu button in the top right panel.
8. Then, select Remove user access.
9. In the pop-up, click Remove followed by the user name to proceed.

Result:

The user loses access to the VM immediately. The task Remove followed by the user name, or the number of users, runs on the VM.

info

Removed VM users lose access to the VM, but their home directory and group memberships are not deleted.

Removing a co-owner. When the selection includes a co-owner, tiCrypt also removes them from the owners of the VM configuration, so they no longer receive the Co-owner role when the VM starts. If you own some of the configuration's drives, hold the Unshare drives permission, and the co-owner holds keys to those drives, the prompt adds the option Also remove their keys to followed by the number of drives of this configuration. It is ticked by default; untick it to leave their drive keys in place.

note

You cannot remove the VM Owner. Edit user access and Remove user access are not offered when the selection includes the Owner.

Confirmations, Errors & Solutions

Removed Users from VM Successfully

Remove user-name(s) from vm-nametotal-removing-time.

Failed to View Users Section in Virtual Machine

The Users section does not appear in the VM Settings and Details window.

Ask VM Users Permissions from VM Owner

Ask the VM owner to allow you to access the VM users section. The VM Settings and Details option itself only appears for Managers, Co-owners, and the Owner of the VM.

To Virtual Machine Owner
To allow VM users permissions to a VM user:  

1. In the VMs section, click the virtual machine where you want to update a user's viewing users permissions.
2. Click the VM Settings and Details option in the bottom center.
3. In the new window, select the Users section in the left panel.
4. Next, select the appropriate user, then click the Open full menu button in the top-right panel.
5. Select Edit user access.
6. In the pop-up, set the profile to Custom.
7. Scroll down under Permissions, and tick Users.
8. Click Save.

Edit Roles in a Virtual Machine

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to edit management roles.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, select the Users section in the left panel.
6. Next, select the user(s) to manage.
7. Click the Open full menu button in the top right panel.
8. Then, select Edit user access.
9. In the Update permissions of prompt, set the Profile to Custom, then select the role: Co-owner, Manager, or User.
10. Click Save.

Result:

tiCrypt shows "Updated user", or "No changes made" if nothing changed.

note

• The prompt is prefilled from the first selected user. Profiles are listed as the role, a colon, and the profile name, for example Manager : Analysts.
• Choosing the Co-owner role, or a Co-owner profile, adds the user to the owners of the VM configuration. Switching a co-owner to another role removes them from the configuration owners.
• The Owner's permissions cannot be changed: "You cannot change the owner permissions".

Confirmations, Errors & Solutions

Updated Users' Roles VM Successfully

Updated user.

Edit Permissions in a Virtual Machine

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to manage user permissions.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, select the Users section in the left panel.
6. Next, select the user(s) to manage.
7. Click the Open full menu button in the top right panel.
8. Then, select Edit user access.
9. In the pop-up, with the Profile set to Custom, tick or untick VM user(s) permissions.
10. Click Save.

Result:

tiCrypt shows "Updated user", or "No changes made" if nothing changed.

note

On a VM that is part of a constellation, the Manager and Co-owner permission lists also include Manage VPN ("Allows manager to manage VPN") and VM Orchestrator ("Allows the management of the constellation"). See VM Roles and Permissions.

Confirmations, Errors & Solutions

Updated Users' Permissions VM Successfully

Updated user.

Sync User Access in a Virtual Machine

Two actions carry the label Sync user permissions, and they do different things. The one in the Users section, described here, reconciles the VM's user list with tiCrypt. The one in the VM's menu re-applies access directory permissions on the drives and does not add or remove users; see Advanced Operations.

Location: Virtual Machines > VMs > select the virtual machine > VM Settings and Details > Users

1. Click Sync user permissions in the top right panel.

Result:

The task Sync user access for followed by the VM name runs. It removes VM users whose tiCrypt accounts have been deleted, revokes the authorization of users whose role on the VM does not match how tiCrypt authorized them, authorizes users who are missing an authorization, and registers co-owners listed in the VM configuration who are not yet on the VM as Managers. Authorizing managers is done only when you are the VM Owner. Your own access is never changed.

note

This action is offered to Managers and higher who also hold the system permission Share VMs with other users.

Access User Profiles in a Virtual Machine

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to access user profiles.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, select the Profiles section in the left panel.

note

• Only Managers, Co-owners, and the Owner of a VM can open VM Settings and Details, where the Profiles section is. Only the VM Owner can edit or remove Manager and Co-owner profiles in the table; any Manager can edit or remove User profiles.
• The Profiles section appears only when the VM's controller provides the settings service. It is not controlled by a permission: if it is missing, the VM's controller does not offer that service, and granting permissions does not make it appear.
• Click a profile to open its detail page, which offers Edit Profile and Remove from VM. Edit Profile is offered for a Co-owner profile only to the VM Owner.

Add User Profiles in a Virtual Machine

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to add user profiles.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, select the Profiles section in the left panel.
6. Click the Add new profile button in the top right panel.
7. In the pop-up, enter the profile name.
8. Select the role and permissions.
9. Click Create Profile.

Result:

The profile appears in the Profiles section and can be chosen in the Profile field when you add or edit users.

note

• The pinned Add profile action also opens this prompt. It is offered to Managers and higher who hold the system permission Share VMs with other users.
• The Profile Name can be up to 32 characters, cannot contain any of /\|":*?<>{}, and must differ from the VM's other profile names ("Conflicts with another profile name").
• Two profiles cannot share the same role and permissions. If they would, the prompt shows "Profile with same role/permissions already exists." and Create Profile stays inactive.

Confirmations, Errors & Solutions

Failed to Enter User Profile Name

You must enter a name.

Enter User Profile Name

In the Add user profiles to vm-name prompt, enter the user profile name in the Profile Name field.

Failed to Select User Profile Role

Must select a role.

Select User Profile Role

Select a user profile role under the Role section.

Import User Profiles from the Same or Other Virtual Machines

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to import user profiles.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, select the Profiles section in the left panel.
6. Click the Add new profile button in the top right panel.
7. In the pop-up, tick Import profile from same or other VM.
8. Next, select the profile in the Existing Profiles field and enter a new profile name.
9. Alter permissions for the new profile.
10. Click Create Profile.

note

Existing Profiles lists the profiles of the VMs you have running, grouped by VM. Selecting one fills in the form; the new profile is created on the current VM only.

Apply Virtual Machine User Profile to User(s)

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to edit management roles.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, select the Users section in the left panel.
6. Next, select the user(s) to manage.
7. Click the Open full menu button in the top right panel.
8. Then, select Edit user access.
9. In the prompt, select the user(s) VM profile at the top.
10. Click Save.

Confirmations, Errors & Solutions

Applied Users' Profile VM Successfully

Updated user.

Edit User Profiles in a Virtual Machine

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to edit user profiles.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, select the Profiles section in the left panel.
6. Click the Edit permissions button in the top right panel.
7. Next, tick or untick permissions of the VM user profiles.
8. Finally, click Save in the top right corner.

Result:

The profile definitions are updated. Users who already have these profiles keep their current permissions.

note

• You can edit multiple VM profiles in bulk at the same time. The table has one row per profile and the columns Name, Role, Count, one column per permission, and Actions.
• Co-owner profile rows cannot be edited, because co-owners always have every permission.
• Two profiles of the same role cannot end up with the same permissions. A duplicate row turns red, its tooltip names the other profile ("Duplicate role profile permissions as: profile-name"), and Save stays inactive until you resolve it.
• Save changes only the profile definitions. To push a change to the users who have a profile, edit that single profile instead, as described below.

Edit a Single User Profile and Its Users

Location: Virtual Machines > VMs > select the virtual machine > VM Settings and Details > Profiles

1. Click the Edit button next to the profile.
2. In the Update role profile profile-name prompt, change the Profile Name or the permissions. The role of a profile cannot be changed.
3. Under Changes to existing users, leave Apply changes to all users with this profile ticked (the default) to apply the new permissions to the users listed below it, or untick it to change only the profile.
4. Click Save.

Result:

The profile is updated. If Apply changes to all users with this profile was ticked, the task Update followed by the number of users runs and applies the new permissions to those users, except the VM Owner and you. If nothing changed, tiCrypt shows "No changes made".

Confirmations, Errors & Solutions

Updated User Profile Successfully

Update number-of-users-with-the-profile to vm-name (total-updating-time).

Delete User Profiles in a Virtual Machine

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the virtual machine to edit user profiles.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, select the Profiles section in the left panel.
6. Click the Remove button next to the user profile you want to delete.
7. In the pop-up, click Remove followed by the profile name to proceed.

Bulk Email Users from a Virtual Machine

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the VMs section on the top left panel.
3. In the left panel, click the menu next to the virtual machine to bulk email.
4. Select Bulk email.
5. In the pop-up, click Copy to copy the VM users' emails or click Download to download them.
6. Once done, click Close.

note

The Prefer contact email? checkbox is ticked by default and lists each user's contact email where one is set. Untick it to list each user's login email instead.