Wiki source code of Benutzerverwaltung

Last modified by Sabrina V. on 2026/07/23 08:25
Show last authors
1 {{aagon.floatingbox/}}
2
3 In the //User Management// section, you can create, edit, and delete users and user groups. This allows you, for example, to set up users for branch offices to better distribute tasks within ACMP. It also lets you use user group and user rights within User Management to control who can view specific solutions in ACMP and perform certain actions.
4
5
6 = Rights and Permissions in ACMP =
7
8 Rights management in ACMP is an indirect part of user management. The control of rights for users and groups consists of two components: basic rights and component-specific permissions.
9
10 |=(% style="width: 437px;" %)Components of Rights Management|=(% style="width: 1035px;" %)Description
11 |(% style="width:437px" %)Fundamental Rights|(% style="width:1035px" %)(((
12 Basic rights refer to the rights that are assigned to users and groups directly during creation or in user management and that apply across the entire ACMP Console. Using these rights, you can, for example, specify which ACMP Solutions a user is allowed to view and which actions they are permitted to perform within a solution. For more info, you can jump to the section on [[Rights of User>>doc:||anchor="HManagingUsersandGroupsinACMP"]].
13 )))
14 |(% style="width:437px" %)Component-Specific Permissions|(% style="width:1035px" %)Component-specific permissions allow you to specify, for individual system components and elements - such as reports, Client Commands, or folders - which users are allowed to view and, if applicable, edit each component. These permissions are managed through individual access lists for each component. For more information on permissions, see the “Access Lists” section.
15
16 == Default Users and Groups ==
17
18 Closely linked to the basic rights and specific permissions are the default user //ADMINISTRATOR// and the default group //Privileged users//. The //ADMINISTRATOR// user account has all existing rights and permissions in the ACMP Console and cannot be edited or deleted. The “Privileged users” group, on the other hand, is a default group that cannot be edited through general user management. This group is created dynamically and individually for each access list in ACMP. This means that this group includes all users who have the basic right to view the respective solution containing the specific access list. Thus, the //Privileged users// group can be used to control which individual components users within a specific solution can view and use. For more information on working with access lists, see the section “Access Lists in ACMP.”
19
20 = Managing Users and Groups in acmp =
21
22 In the overview, you'll see the two tabs, “Users” and “Groups,” under which the respective items are displayed. When you first open the view, the focus is on the users.
23
24 [[User Management>>image:68_System_Benutzerverwaltung Übersicht_1821.png||alt="63_System_Benutzerverwaltung_1696.png" data-xwiki-image-style-alignment="center"]]
25
26 Depending on which option you selected ([[Users>>doc:||anchor="HManageUsers"]] or [[Groups>>doc:||anchor="HManageGroups"]]), the commands in the ribbon bar will change. However, you can [[import AD users>>doc:||anchor="HImportActiveDirectoryUsers"]] from either tab at any time. In the left pane, you’ll see a list of all created users, from which you can, for example, see at a glance what roles they have been assigned and whether multi-factor authentification (MFA) is activated. On the right side is the detail view for the currently selected user.
27
28 Legend
29
30 |(% style="width:278px" %)**Symbol**|(% style="width:1414px" %)**Description**
31 |(% style="width:278px" %)(((
32 [[image:1730896286452-269.png]]
33
34 Helpdesk
35 )))|(% style="width:1414px" %)The user can be a ticket editor
36 |(% style="width:278px" %)(((
37 [[image:1730896286453-120.png]]
38
39 Tenants
40 )))|(% style="width:1414px" %)The user can view and manage all Clients regardless of their client relationships
41 |(% style="width:278px" %)(((
42 [[image:1730896286453-510.png]]
43
44 Multi-factor authentifcation
45 )))|(% style="width:1414px" %)Multi-factor authentification is activated for the user
46 |(% style="width:278px" %)(((
47 [[image:1730896286454-100.png]]
48
49 Multi-factor authentifcation
50 )))|(% style="width:1414px" %)Multi-factor authentification is enforced for the user and must be set up during the next login, if it has not already been done (see Use Case: Enforcing Multi-Factor Authentication for Another User)
51
52 {{aagon.infobox}}
53 If, as an administrator, you require users to enable multi-factor authentification, both icons may be visible in the MFA column: This means that mandatory setup (yellow icon) is required for the user, and the user has already enabled it (green icon) by completing the configuration process (see [[Use Case: Forced setup of multi-factor authentication for an user>>doc:ACMP.610.MFA.Zwangseinrichtung der Multifaktor-Authentifizierung für einen Benutzer.WebHome]]).
54
55
56 {{/aagon.infobox}}
57
58
59
60 == Manage Users ==
61
62 In the //Users// tab, you can add new users, edit existing users, or delete them. You can also change a user’s password directly from the ribbon bar and reset the user’s multi-factor authentification, if it has been set up for that user.
63
64 === **Add a User** ===
65
66 Click the //Add// button on the ribbon bar to create a new user profile. In the wizard that opens, start by entering a username. You can also optionally enter a description and an email address.
67
68 {{aagon.infobox}}
69 Adding an email address is optional in this step. However, if the user is being set up to work in the Helpdesk, an email address is required.
70 {{/aagon.infobox}}
71
72 It is possible to enter an email address for the new user that is already being used by an existing user.
73
74 {{aagon.warnungsbox}}
75 Dual use is subject to certain restrictions and must therefore be confirmed manually.
76 {{/aagon.warnungsbox}}
77
78 By confirming the dual use, you agree to the following restrictions:
79
80 * Neither user can have a forgotten password sent to them via the Helpdesk web interface
81 * Neither user can log in to the Helpdesk web interface using their AD credentials
82 * It will not be possible to assign tickets and comments to a contact in the Helpdesk
83 * Problems may occur when importing contacts using the Contacts Adapter
84
85 Finally, set a password for the ACMP Console. You can also set a password directly for using the web interface. Use the //Password Strength// view to check how suitable and strong your chosen password is.
86
87 [[Set User Properties>>image:67_Benutzerverwaltung_Benutzereigenschaften_904.png||alt="Benutzerverwaltung_Gruppenzuweisung.png"]]
88
89
90
91 **Assign Groups**
92
93 In the second step, specify the group membership. In most cases, [[groups>>doc:||anchor="HManageGroups"]] have different rights. A user can be assigned to multiple groups. There is no requirement to assign a user to a group. Some groups are already provided when you install ACMP (including //AD Login//, //Full access//, and //Secured by MFA//).
94
95 {{aagon.warnungsbox}}
96 For security reasons, it is not recommended to assign a user to multiple groups. Instead, you can, for example, create a separate group for the user.
97 {{/aagon.warnungsbox}}
98
99 [[Mapping the user to one or more groups>>image:67_Benutzerverwaltung_Gruppenzuweisung.png||alt="Benutzerverwaltung_Gruppenzuweisung.png"]]
100
101
102
103 **Set Rights of User**
104
105 In the third step, you can set the rights of the user. If you assigned the user to a group in the prior step, the following page will display which rights the user will have. If you did not specify a group, you can set the rights of the user individually. To do this, select the solutions that should be visible to the user. Once you have selected a solution, you can specify in the field on the right which rights the user should have for that solution.
106
107
108 [[Enable visibility for solutions and assign user permissions>>image:68_Benutzerverwaltung_Rechte des Benutzers_1078.png||alt="System_Benutzerverwaltung_NeuerBenutzer3" data-xwiki-image-style-alignment="center"]]
109
110
111
112 **Select Roles and Tenants**
113
114 Now define roles and tenants for the user. You can specify whether the user should be assigned a Helpdesk role, which would allow them to become a ticket editor. You can also specify whether the user can view and manage all tenants, only selected tenants, or none at all. If you want to use [[multi tenancy>>doc:ACMP.610.Mandantenfähigkeit in ACMP.WebHome]] in ACMP, you must grant the user access to all tenants or at least selected tenants.
115
116 (% class="box warningmessage" %)
117 (((
118 [[image:https://doc.aagon.com/bin/download/XWiki/Aagon%20Warnungsbox/WebHome/Warning.svg||alt="Warning" height="32" width="32"]] **Achtung: **
119
120 If you do not select a tenant, the new user will not be able to log in to the ACMP Console later.
121 )))
122
123 [[Define Roles and Tenants>>image:Benutzerverwaltung_Rollen und Mandanten.png]]
124
125
126 **Set ACMP Contact**
127
128 In the final step, you can assign an existing contact from the Helpdesk to the user or create a new contact for the user
129
130 {{aagon.infobox}}
131 This step is only possible if the Helpdesk is installed as a solution.
132 {{/aagon.infobox}}
133
134 Finally, click //Done// to confirm the mapping or create the new contact and complete the user creation process.
135
136 === **Edit User** ===
137
138 Select a user and click the //Edit// button on the ribbon bar. The same dialog box that appears when creating a user will open. All properties are already filled in and can be changed as needed.
139
140 If you only want to rename a user, you can also do so by right-clicking to access the context menu.
141
142 === **Delete a User** ===
143
144 Select a user and click the Delete User icon in the context menu. Respond to the confirmation prompt with Yes to delete the user.
145
146 === **Change Password** ===
147
148 To change a user’s password, select the user and click the Change Password icon. Enter the new password and confirm it.
149
150 == Manage Groups ==
151
152 In the //Groups// tab, you can add new groups and edit, delete, or duplicate existing groups.
153
154 [[Group Overview in User Management>>image:68_Benutzerverwaltung_Gruppen Übersicht_1660.png||alt="67_Benutzerverwaltung_Gruppen Übersicht_1660.png"]]
155
156 === **Add Group** ===
157
158 Click the //Add// button on the ribbon bar to create a new group. In the wizard that opens, first enter a name and, optionally, a description for the group.
159
160 **Add Users to the Group**
161
162 In the second step, you can assign one or more users to the group or clear the group for now. To do this, simply select the appropriate users from the list. These users will then become members of the group.
163
164 **Set rights of group**
165
166 Next, in the third step, specify the rights of group. To do this, first select the solutions that should have visibility to the group. Once you’ve selected a solution, you can specify in the right-hand field what rights the group members should have for that solution.
167
168 [[image:68_System_Benutzerverwaltung Gruppenrechte_965.png||alt="System_Benutzerverwaltung_NeueGruppe1" data-xwiki-image-style-alignment="center"]]
169
170 (% style="text-align:center" %)
171 Enable visibility for solutions and assign group permissions
172
173 (% class="wikigeneratedid" id="HRollenundMandantenauswE4hlen" %)
174 (% id="cke_bm_89369S" style="display:none" %)** **
175
176 **Select Roles and Tenants**
177
178 Now define the roles and tenants for the group. You can specify whether members of this group should be assigned a Helpdesk role, which would allow them to become ticket editors. A member of this group can thus act as a Helpdesk agent to create, edit, and process tickets. You can also specify whether members of this group can view and manage all tenants, only selected tenants, or none at all. If you want to use [[multi tenancy>>doc:ACMP.610.Mandantenfähigkeit in ACMP.WebHome]] in ACMP, you must grant the user access to all tenants or at least selected tenants.
179
180
181 **Active Directory Group Mapping**
182
183 This step is used to map users in an Active Directory group to the ACMP group you are currently creating. This allows you to manage users exclusively through AD, rather than having to manually create all users in ACMP again. To use this function effectively, you must specify a login group in the platform configuration that includes all users authorized to access the ACMP (see [[Login>>doc:ACMP.610.ACMP-Solutions.System.Einstellungen.ACMP Server.WebHome||anchor="HActiveDirectoryLogin"]]).
184
185 {{aagon.infobox}}
186 If you do not want to use this function, you can skip this step and finish creating the group.
187 {{/aagon.infobox}}
188
189 Now configure the group so that an AD group is assigned to it. This ensures that a user in the AD group is automatically created in ACMP upon their first login and assigned to this group. If the user already exists, they will be assigned to this group if they have not already been. Similarly, you can manually synchronize users using the //Import all new AD users from the AD access group in user management// function, which will also remove ACMP Users from the group if they are no longer part of the assigned AD group. However, ACMP users are not automatically deleted. ACMP users can also continue to be created manually and assigned to the group; as a result, they will not be included in the synchronization when a manual synchronization is performed using the aforementioned function.
190
191 (% style="text-align:center" %)
192 [[image:XWiki.Images.WebHome@system_benutzerverwaltung_neuegruppe2.png||alt="System_Benutzerverwaltung_NeueGruppe2" height="401" width="327"]]
193 Add an Active Directory group
194
195 To assign a corresponding AD group to this ACMP group, click //Add// and, in the new window, select the domain in which the group to be assigned is located. Enter a group name or part of it, and click //Check Name// to display all matching groups. Select the group you want to map. You can map multiple AD groups to a single ACMP group.
196
197 {{aagon.infobox}}
198 To enable the selection of domains via the dialog box, a user with domain read permissions must be entered in the ACMP settings (see login).
199 {{/aagon.infobox}}
200
201
202
203 === Multi-factor authentification ===
204
205 In the final step, you can configure multi-factor authentification for the users in the group.
206
207 If you want to enforce the use and configuration of multi-factor authentication when users in the newly created group log in, you must enable the checkbox (“Enforce multi-factor authentication configuration for users in this group upon login”).
208
209 You can create a custom text message to serve as a help message that is displayed to the user during login and provides additional guidance. You have access to standard text-editing tools (various fonts and font sizes, paragraph styles, links, etc.). The configured text can be accessed, for example, in the login mask via the “I need help” button.
210
211 Exit your work by clicking //Done// to create a group.
212
213
214 [[Configuration Options for Multi-Factor Authentication>>image:67_Benutzerverwaltung_Gruppe hinzufügen Multifaktor-Authentifizierung_mit Haken_810.png]]
215
216 {{aagon.infobox}}
217 See the “Enforcing multi-factor authentification for a user” use case to learn how to set this up for other users.
218 {{/aagon.infobox}}
219
220 {{aagon.infobox}}
221 If you later want to customize the text for multi-factor authentification, change group properties, or configure the group's users and rights of group, you can do so using the //Edit// function in the ribbon bar. To do this, select the desired group and edit all the details.
222 {{/aagon.infobox}}
223
224 {{aagon.infobox}}
225 A general text that links to the online help is already included for the included “Securd by MFA” group. This text can also be customized.
226 {{/aagon.infobox}}
227
228 Click //Finish //to create the group.
229
230 === **Edit Group** ===
231
232 To edit a group, select it from the list and click the //Edit// button (​) on the ribbon bar. A window will open where you can change any of the information you specified when you created the group. The current values are already entered and can be edited as needed. This also allows you to change the group properties later, set a different set of rights for the users or the group itself, or customize the help text for multi-factor authentication. If you simply want to rename the group, you can do so by right-clicking and using the context menu.
233
234 === **Delete Group** ===
235
236 Select a group and click the Delete Group icon. Confirm the security prompt to delete the group. Users assigned to the group will, of course, remain unaffected.
237
238 === **Duplicate Group** ===
239
240 To duplicate an existing group along with all its existing users, select the desired group. Then select Duplicate Group from the ribbon bar.
241
242 A new window will open displaying the properties of the new group. You can now assign a name to the duplicated group and customize it using the available tabs.
243
244 {{aagon.infobox}}
245 If you don't want to include all users from the original group in the new group, you can deselect all users on the “Users in Group” tab using the context menu. You can also select “Select All” here, which allows you to work more efficiently when adding multiple users.
246 {{/aagon.infobox}}
247
248 ​
249
250 Confirm your entries by clicking //Save//.
251
252 === Reset multi-factor authentification for a User ===
253
254 To reset multi-factor authentification for a user, you can use the button of the same name in the ribbon bar ([[image:1730896831843-996.png]]). Confirm your entry, and all factors for the selected user’s multi-factor authentification will be deleted. The user password remains unchanged. If mandatory authentication has been configured for the user, the user will be required to set up authentication automatically upon their next login.
255
256
257
258 = Import Active Directory Users =
259
260 In ACMP, one or more AD groups can be assigned to a group, linked by “or.” A mapping is displayed by a corresponding icon. All members of these groups can log in to the ACMP Console and have the rights assigned to their group. A prerequisite for this is that they are also members of the respective access group specified under [[AD Login>>doc:ACMP.610.ACMP-Solutions.System.Einstellungen.ACMP Server.WebHome||anchor="HActiveDirectoryLogin"]]. Manually adding users is not necessary in this case, but it remains possible, allowing users to be managed entirely within Active Directory.
261
262 If a user logs in this way, the system automatically adds them to the ACMP Database. Alternatively, all users can be manually imported into the database using the //Import all new AD users from the AD access group into the database// function. This does not involve user synchronization, so existing users are neither imported into AD nor deleted from it. Users who have been deleted from Active Directory or removed from a group are not deleted from the ACMP Database, but are merely removed from the corresponding ACMP groups.
263
264 {{aagon.infobox}}
265 Disabled users are not included in the user import.
266 {{/aagon.infobox}}
267
268 (% style="text-align:center" %)
269 [[image:XWiki.Images.WebHome@hmfile_hash_3bb9c266.png||alt="9.3 - Loginprozess" height="542" width="715"]]
270 Flowchart of the Login Process
© Aagon GmbH 2026
Besuchen Sie unsere aagon-Community