Access management

In the Access management section, users can:

• add, edit, and archive users;
• reset user passwords;
• add, edit, and delete user roles;
• assign roles to users;
• add, edit, and delete user groups;
• organize users into groups;
• configure LDAP authentication settings;
• configure SSO connection settings;
• configure TRON.ASOC authentication settings.

The section includes the following subsections:

• the Users subsection;
• the Roles subsection;
• the Groups subsection;
• the LDAP subsection;
• the SSO subsection;
• the Authentication settings subsection.

Users

The Users subsection contains a list with the following user information:

• Username—the user's unique login or identifier;
• Display name—the name that other users see;
• Account type—an internal account created within the system or an LDAP/SSO account;

warning

You can't edit LDAP/SSO accounts or reset their passwords.

• Assigned roles—the roles assigned to the user;
• Password reset—an indicator of whether the user needs to reset their password. Yes means that the user must change their password the next time they sign in.

Roles

The Roles subsection displays all system roles and the number of users assigned to each role.

Base system roles

Role	Description
Administrator (isadm)	A role with full permissions. The product assigns all existing permissions to this role during installation. It's intended for users responsible for deploying and maintaining the infrastructure and system software required to run the solution, such as operating systems, application servers, and databases. These users are also responsible for creating and managing user accounts, roles, and access; changing settings; monitoring the license; and connecting security tools and scan sources.
Auditor (isaud)	This role is intended for monitoring data and system security, tracking user actions and system operations, analyzing event logs, monitoring scan results, and verifying compliance with Quality Controls.
Information security engineer (isoff)	This role is intended for managing and ensuring the information security of projects under development, configuring security rules, monitoring threats, and managing security tools and scans.
Developer (dev)	A minimum base role intended for users who verify compliance with standards, view scan results, and review excluded issues.

info

• You can't delete the Administrator (isadm) role; you can only block it. In addition, TRON.ASOC requires at least one user with the Administrator (isadm) role.
• You can delete the other roles (Auditor (isaud), Information security engineer (isoff), and Developer (dev)).

Groups

In the Groups subsection, you can create, edit, and delete user groups, add users to groups, and configure mappings to LDAP/SSO groups.

info

When you add new users to a group, the additional permissions specified for the group are added to the user's role permissions.

LDAP

The LDAP subsection provides a convenient and secure way to manage users and their access through integration with LDAP or AD.

SSO

The SSO subsection lets you configure and manage users and their access through integration with IdP (Identity Provider) services, for example, Identity Blitz and Keycloak.

Authentication settings

In the Authentication settings subsection, you can configure the following settings:

• authentication methods;
• maximum session duration;
• maximum number of invalid password attempts before temporarily blocking the account;
• temporary account lockout duration;
• sign-out after inactivity;
• account password requirements.