User management

[maznos]

Is there a way to assign a user to be responsible for adding users to database, meanwhile he dont have or assign "administrator access" to the database


maz

[ChrisH]

Open up GateKeeper, click on Users Tab and double click System Policies. At the top of the System Policies window is a drop down box named Right. One of the selections from this box is Users can create and edit users. Make this selection and then select Add and choose the user whom you wish to be able to create the users and that should be it.

[maznos]

Open up GateKeeper, click on Users Tab and double click System Policies. At the top of the System Policies window is a drop down box named Right. One of the selections from this box is Users can create and edit users. Make this selection and then select Add and choose the user whom you wish to be able to create the users and that should be it.

But I guess the user assigned have the ability to add a user with admin rights and then he can have admin rights to the server


maz

[ChrisH]

If the user is a member of the WinGate administrators, then yes he will have admin rights but then he could edit users anyway. Or are you referring to Windows admin rights?. Do you have WG Enterprise license?

[maznos]

If the user is a member of the WinGate administrators, then yes he will have admin rights but then he could edit users anyway. Or are you referring to Windows admin rights?. Do you have WG Enterprise license?

thank you chris

the wingate i admin is using its own user database so it is not depending on the windows user database
i need to do the following

I have "user1" which is a normal user
I want user1 to add a new "user2" but whenever user1 assign the user2 group he cant assign him "Administrators" group

what i mean in other words
if user1 is member of "operators" group (which is less previlage than Administrators) he cant add any user to the administrators group.

I am going on vacation and I want to let a user to manage accounts and adding users but he cant have an access to anything will give him an admin access

Thanx

[ChrisH]

I have "user1" which is a normal user
I want user1 to add a new "user2" but whenever user1 assign the user2 group he cant assign him "Administrators" group

I am assuming you mean here that you want user1 not to have the ability to assign any user to the Administrators group. Unfortunately, the way WG code is written now, this particular user (Users can create and edit users) can create any type of user and can assign himself to the admin group if he so chooses.

I am going on vacation and I want to let a user to manage accounts and adding users but he cant have an access to anything will give him an admin access

You no doubt need a vacation and it's great that you are finding the time to take one.

Since this user can add anyone to the Administrators group including himself, this could be a potential risk as you obviously are aware. I would suggest then, that you go through every system right and in any right that has the Administrators group listed, to delete this group and replace with the user Administrator which I assume is you. This way when you are away this user may assign users to the admin group but they would have no rights to change anything and WG won't allow the Administrator to be deleted. So, I think this is a workaround, but it would be nice as an Administrator to have a choice whether or not to allow the (Users can create and edit users) user the right to assign users to the Administrators group. I would suggest this should be a feature request to QBik to incorporate in an upcoming maintenace release.

[maznos]

I have "user1" which is a normal user
I want user1 to add a new "user2" but whenever user1 assign the user2 group he cant assign him "Administrators" group

I am assuming you mean here that you want user1 not to have the ability to assign any user to the Administrators group. Unfortunately, the way WG code is written now, this particular user (Users can create and edit users) can create any type of user and can assign himself to the admin group if he so chooses.

I am going on vacation and I want to let a user to manage accounts and adding users but he cant have an access to anything will give him an admin access

You no doubt need a vacation and it's great that you are finding the time to take one.

Since this user can add anyone to the Administrators group including himself, this could be a potential risk as you obviously are aware. I would suggest then, that you go through every system right and in any right that has the Administrators group listed, to delete this group and replace with the user Administrator which I assume is you. This way when you are away this user may assign users to the admin group but they would have no rights to change anything and WG won't allow the Administrator to be deleted. So, I think this is a workaround, but it would be nice as an Administrator to have a choice whether or not to allow the (Users can create and edit users) user the right to assign users to the Administrators group. I would suggest this should be a feature request to QBik to incorporate in an upcoming maintenace release.

Now you understood my point
If this function implemented in the next release it will be great

Thank you