Skip to main content
Version: 1.5

Access management

In the Access management section, users can:

  • add, edit, and archive users;
  • reset user passwords;
  • add, edit, and delete user roles;
  • assign roles to users;
  • add, edit, and delete user groups;
  • combine users within a group;
  • configure LDAP authentication settings;
  • configure SSO connection settings;
  • configure TRON.ASOC authentication settings.

The section contains these subsections:

  • Users;
  • Roles;
  • Groups;
  • LDAP;
  • SSO;
  • Authentication settings.

Users​

The Users subsection lists the following information about users:

  • Username—the user's unique login or identifier;
  • Display name—the name that other users see;
  • Assigned roles—the roles assigned to the user;
  • Password reset—an indicator that shows whether the user must reset their password. Yes means that the user must change their password the next time they sign in.

Users

Roles​

The Roles subsection displays all system roles and the number of users assigned to each role.

Roles

Basic system roles​

RoleDescription
Administrator (isadm)A role with full permissions. The product assigns all existing permissions to this role during installation. It's intended for users responsible for deploying and maintaining the infrastructure and system software required to run the solution, such as operating systems, application servers, and databases. It's also intended for users responsible for creating and managing user accounts, roles, and access; changing settings; monitoring the license; and connecting security tools and scanning sources.
Auditor (isaud)A role for monitoring data and system security, monitoring user actions and system operations, analyzing event logs, monitoring scan results, and checking compliance with Quality Controls.
Information security engineer (isoff)A role for monitoring and ensuring the information security of projects under development, configuring security rules, monitoring threats, and managing security tools and scans.
Developer (dev)The minimum basic role. It's intended for users who check compliance with standards, view scan results, and review excluded issues.
info
  • You can't delete the Administrator (isadm) role. You can only block it. TRON.ASOC also requires at least one user with the Administrator (isadm) role.
  • You can delete the other roles (Auditor (isaud), Information security engineer (isoff), and Developer (dev)).

Groups​

In the Groups subsection, you can create, edit, and delete user groups, add users to groups, and configure mapping with LDAP/SSO groups.

info

When you add new users to a group, the additional permissions specified for the group are added to the user's role permissions.

Groups

LDAP​

The LDAP subsection provides secure, convenient user and access management through integration with LDAP or AD.

LDAP

SSO​

The SSO subsection lets you configure and manage users and their access through integration with IdP (Identity Provider) services, for example, Identity Blitz and Keycloak.

SSO

Authentication settings​

In the Authentication settings subsection, you can configure:

  • authentication methods;
  • the maximum session duration;
  • the maximum number of incorrect password attempts before the account is temporarily blocked;
  • the temporary account lockout duration;
  • sign-out after inactivity;
  • account password requirements.

Authentication settings