Access management

In the Access management section, users can perform the following actions:

• add, edit, and archive users;
• reset user passwords;
• add, edit, and delete user roles;
• assign roles to users;
• add, edit, and delete user groups;
• group users;
• configure LDAP authentication settings;
• configure SSO connection settings;
• configure TRON.ASOC authentication settings.

The section contains the following subsections:

• the Users subsection;
• the Roles subsection;
• the Groups subsection;
• the LDAP subsection;
• the SSO subsection;
• the Authentication methods subsection.

Users

The Users subsection contains a list with the following information about users:

• Username—the user's unique login or identifier;
• Display name—the name other users see;
• Account type—an internal account created within the system, or an LDAP/SSO account;

warning

You can't edit LDAP/SSO accounts or reset their passwords.

• Assigned roles—the roles assigned to the user;
• Password reset—an indicator of whether the user must reset their password. Yes means that the user must change their password the next time they sign in.

Roles

The Roles subsection displays all system roles and the number of users assigned to each role.

Base system roles

Role	Description
Administrator (isadm)	This role has full permissions, and the product assigns all existing permissions to it during installation. It's intended for users responsible for deploying and maintaining the infrastructure and system software required for the solution to operate, such as operating systems, application servers, and databases. These users are also responsible for creating and managing user accounts, roles, and access; changing settings; monitoring the license; and connecting security tools and scan sources.
Auditor (isaud)	This role is intended for monitoring data and system security, monitoring user actions and system operations, analyzing event logs, monitoring scan results, and checking compliance with Quality Controls.
Information security engineer (isoff)	This role is intended for ensuring the information security of projects under development, configuring security rules, monitoring threats, and managing security tools and scans.
Developer (dev)	This is the minimum base role. It's intended for users who check compliance with standards, view scan results, and review excluded issues.

info

• You can't delete the Administrator (isadm) role. You can only block it. TRON.ASOC also requires the system to have at least one user with the Administrator (isadm) role.
• You can delete the other roles (Auditor (isaud), Information security engineer (isoff), and Developer (dev)).

Groups

In the Groups subsection, you can create, edit, and delete user groups, add users to groups, and configure mappings with LDAP/SSO groups.

info

When you add new users to a group, the additional permissions specified for the group are added to the user's role permissions.

LDAP

The LDAP subsection provides convenient and secure management of users and their access through integration with LDAP or AD.

SSO

The SSO subsection lets you configure and manage users and their access through integration with IdP (Identity Provider) services, for example, Identity Blitz and Keycloak.

Authentication methods

In the Authentication methods subsection, you can configure the following settings:

• authentication methods;
• maximum session duration;
• maximum number of incorrect password attempts before temporarily blocking the account;
• temporary account block duration;
• sign-out after inactivity;
• account Password requirements.