Creating and Editing User Accounts

This section will show you how to create and edit user accounts in Skylar One, and will also show you examples of user accounts created in Skylar One.

Before Deployment

Before deployment, an administrator must determine:

Which team members require access to Skylar One.
What access levels to assign to each team member.
Which organization to place each team member in, so that each team member will have access to required device information.

After you have devised a plan, you can start adding user accounts to Skylar One.

Best Practices

When creating user accounts, ScienceLogic suggests you use the following best practices:

Limit the number of administrator user accounts to those who absolutely require full access to Skylar One.
Use care when assigning Access Keys to individual users and user policies. You should assign each user only the access that they require to perform their job duties.
Use care when updating user policies that have already been used to create user accounts. Remember that each change is dynamically added to each member's user account.

For user accounts that use local authentication, follow these guidelines for creating a strong password:

Is at least eight characters long.
Does not contain your username, real name, or company name.
Cannot be found in a dictionary.
Is significantly different from previous passwords. Passwords that increment (Password1, Password2, Password3) are not strong.
Contains a mixture of uppercase and lowercase letters, numerals, and non-alphanumeric characters.

Viewing a List of User Accounts

From the User Accounts page, you can view a list of all existing user accounts in Skylar One. From this page, you can also define new user accounts and edit existing user accounts.

To access the User Accounts page:

Go to the User Accounts page (Registry > Accounts > User Accounts).
For each account, the User Accounts page displays:

Username. The username used to log in to Skylar One.
User Display Name. The user's name as it appears throughout Skylar One and in logs. This value is determined by the user's authentication resource settings.
Last Name | First Name. The user's last name and first name. The icon to the left of the column specifies the account type.
Account Type. The user's account type. Choices are User or Administrator.
User Policy. User policy associated with the user's account, if applicable.
Primary Organization. The organization that the user belongs to.
Email Address. The user's email address.

State. Can be one of the following:

Active. User can log in.

Suspended. User cannot log in.
Vacation. User can log in, but Skylar One will not send any automated email notifications to the user's email address(es).

Auth Type. Specifies how the account is authenticated:

Local. Account is authenticated through account-definition on Skylar One.
LDAP/AD. Account is authenticated through an external LDAP or AD server.
SSO. Account is authenticated through an external SSO provider.
Certificate. Account is authenticated by security certificate.

User ID. Unique numeric ID assigned to each user by Skylar One.
Edited By. User who created or last edited the user account.
Last Edited. The date and time the account was created or last edited.

You can filter the items on this page by typing filter text or selecting filter options in one or more of the filters found above the columns on the page.

Manually Creating a New User Account

There are four ways to create a new user account in Skylar One:

Manually create the account and supply values in each field. This method is described in this section.
Manually create the account and align the account with a user policy (instead of supplying values in each field). This is described in the section on User Policies.
Automatically importing LDAP or Active Directory accounts into Skylar One. This is described in the Using LDAP or Active Directory section.
Automatically importing SSO accounts into Skylar One. This is described in the Using Single Sign-On (SSO) section section.

To manually create a new user account:

Go to the User Accounts page (Registry > Accounts > User Accounts).
In the User Accounts page, click the Create button. The Create New Account page appears.
In the Create New Account page, enter values in each field:

First Name. User's first name. This value can be up to 24 characters in length.
Last Name. User's last name. This value can be up to 24 characters in length.
Generate name based on first and last name. If you select this checkbox, Skylar One will generate a login name for the user. ScienceLogic recommends that you do not select this option.
Account Login Name. User's login name. This field can be up to 32 characters in length.
Primary Email. User's email address. This field can be up to 64 characters in length.

The Password, Confirm Password, Password Strength, Password Expiration, Password Shadowing, and Require Password Reset fields apply only to users configured for local authentication.

Password. The user's password. This value must meet the requirements specified for the value you select in the Password Strength field set in the Behavior Settings page (System > Settings > Behavior).
Confirm Password. The user's password again. This value must be identical to the value you specified in the Password field.
Password Strength. When defining or editing a user account, the administrator can define the required password strength. The user must then always use a password that meets or exceeds that specified password strength. Skylar One will not allow the user to save changes to their password that do not meet the password strength requirement. Choices are:

Good. Password must be at least eight characters long and contain at least one number or one symbol.
Strong. Password must be at least eight characters long and contain at least one number and at least one symbol.
Very Strong. Password must be at least 13 characters long, contain no repeated characters, and contain at least one number and at least one symbol. Recommended.

Password Expiration. Specifies whether or not the password for this account will expire and if so, when the password will expire. Choices are:

Disabled. Password does not expire.
30 Days. When the current password is 30 days old, during login the user will be prompted to change the password.
60 Days. When the current password is 60 days old, during login the user will be prompted to change the password.
90 Days. When the current password is 90 days old, during login the user will be prompted to change the password. Recommended.
180 Days. When the current password is 180 days old, during login the user will be prompted to change the password.
365 Days. When the current password is 365 days old, during login the user will be prompted to change the password.

If the password is set to expire, on the expiration date the user will be prompted to change the password at the Login page. The user will be required to enter their old password and then enter a new password twice. If the user incorrectly enters the previous password or enters an invalid new password, the user will not be allowed to log in to Skylar One.

The new password must meet the requirements of the Password Strength field and the Password Shadowing field. Skylar One will prompt the user to meet these requirements and display a description of those requirements.

NOTE: The value in the Password Expiration field in this page (the Account Permissions page) overrides the value in the Behavior Settings page (System > Settings > Behavior).

Password Shadowing. Specifies requirements for password reuse. By default, when a user defines a new password, they cannot reuse any passwords that they has used in the last 12 months. The choices in this field are:

Default - cannot reuse passwords from past year
1 - Cannot reuse last password
2 - Cannot reuse last 2 passwords
3 - Cannot reuse last 3 passwords
4 - Cannot reuse last 4 passwords
5 - Cannot reuse last 5 passwords
6 - Cannot reuse last 6 passwords
7 - Cannot reuse last 7 passwords
8 - Cannot reuse last 8 passwords
9 - Cannot reuse last 9 passwords
10 - Cannot reuse last 10 passwords

Require Password Reset. If selected, the user will be prompted to change their password at the next login. When creating a new user account, this option is selected by default. After the user's first login, when they are prompted to change their password, this option is then unselected.
Multi-Factor Auth (MFA) User. If this user requires a different user name for Multi-factor authentication, enter the MFA user name in this field.

NOTE: For details on configuring multi-factor authentication, see the section on using multi-factor authentication.

Organization. The organization of which the new user account will be a member. Users can select from among all organizations in Skylar One.
Account Type. Specifies whether the user is a member of a user policy. Choices are:

Individual. User account is not a member of a user policy.
Policy Membership. User will be defined with a user policy. When selected, the Policy Membership field becomes active.

When a user policy is applied to a user's account, the user inherits the Key Privileges specified in the user policy. Administrators cannot add additional Key Privileges or delete Key Privileges from the user's account.
When a user policy is edited, each user account that is a member of that template will be dynamically updated.

The second drop-down list contains an entry for each standard account type. These account types affect the list of Key Privileges for the user. The choices are:

Administrator. By default, administrator user accounts are granted all permissions available in Skylar One. Administrators can access all tabs and pages and perform all actions and tasks.

User. Non-administrator user accounts are assigned key privileges. Key privileges are customizable by the administrator and grant users access to pages and tabs and permit users to view information and perform tasks in Skylar One. These key privileges are defined by the Skylar One system administrator from the Access Keys page (System > Manage > Access Keys).

Suspended. Account is not active. User cannot log in to Skylar One.
Active. Account is active. User can log in to Skylar One.
Vacation. Account is active and the user can log in to Skylar One, but Skylar One does not send email messages to the user.

Authentication Method. Specifies how the user will be authenticated. The choices are:

Local. User's username and password are authenticated by the database.
LDAP. User's username and password are authenticated by an LDAP server or Active Directory server. For details on configuring Skylar One to use LDAP or Active Directory authentication, see the section on Using LDAP or Active Directory.
SSO. User's username and password are authenticated by Security Assertion Markup Language (SAML)-based single sign-on through an identity provider (IdP). For details on configuring Skylar One to use SSO authentication, see the section on Using Single Sign-On (SSO).
Certificate. User's username and password are authenticated by security certificate. For details on configuring Skylar One to use certificate authentication, see the section on CAC Authentication.

Restrict to IP. The user will be allowed to access Skylar One only from the specified IP address. Specify the IP address in standard dotted-decimal notation.
Country. Select the appropriate country to associate with the user account.
Time Zone. Select the appropriate time zone to associate with the user account.

: By default, the Country field and Time Zone field will be set to the system-wide defaults defined in the Behavior Settings page (System > Settings > Behavior). You can override these values for the current user. Changing the default country or time zone for the current user will not affect the system-wide default settings.

NOTE: If the user account is aligned with a user policy that specifies a time zone, the Time Zone field will be disabled. The user account will use the Time Zone specified in the user policy and the Time Zone field cannot be edited.

Autosync Time Zone With Local Settings. Specifies whether Skylar One should always use the time zone specified in the Time Zone field or if Skylar One should adopt the local time zone (when it differs from the value in the Time Zone field). This is helpful for users who travel and use Skylar One "on the road". Choices are:

Yes. If the value in the Time Zone field differs from the local time zone, Skylar One should use the local time zone.
No. Skylar One will continue to use the time zone specified in the Time Zone field, even if the local time zone differs.

Policy Membership. If you selected Policy Membership in the Account Type field, the Policy Membership field is activated. In this field, you can select a user policy to apply to the new user account.

When a user policy is applied to a user's account, the user inherits the Key Privileges specified in the user policy. Administrators cannot add additional Key Privileges or delete Key Privileges from the user's account.
When a user policy is edited, each user account that is a member of that policy will be dynamically updated.

Click the Save button to save the new user account.
The Account Permissions page appears, with some of the fields already populated with values from the Create New Account page.
An additional set of tabs appears. These tabs are the Account Panel tools. These tabs are described in the section on Managing User Accounts.

Password Strength

When defining or editing a user account that uses local authentication, the administrator can define the required password strength. The user must then always use a password that meets or exceeds that specified password strength.

To determine password strength, Skylar One uses the following scoring system:

Too short = password is less than eight characters
Bad password = same password as username
Bad password = score less than 34
Good password = score greater than 34 and less than 68. Minimum requirements are that the password must be at least eight characters long and contain at least one number or one symbol.
Strong password = score greater than 68 and less than 100. Minimum requirements are that the password must be at least eight characters long and contain at least one number and at least one symbol.
Very Strong password = score equal to or greater than 100, where password length is greater than 13 characters. Minimum requirements are that the password must be at least 13 characters long, contain no repeated characters, and contain at least one number and at least one symbol.

To generate a score for a password, Skylar One uses the following scoring parameters:

Base score for password length (password must contain at least eight characters) = password length * 4

If password contains at least three numbers = +5
If password contains at least two symbols = +5
If password contains both uppercase and lowercase letters = +10
If password contains a least one number and letters = +15
If password contains at least one number and at least one symbol = +15
If password contains letters and at least one symbol = +15
If password is only numbers = -10
If password is only letters = -10
One repeated character in password = (1 - password length ) (a negative value)
Two repeated characters in password = (2 - password length) (a negative value)
Three repeated characters in password = (3 - password length ) (a negative value)

Using LDAP or Active Directory for Authentication

For details on configuring Skylar One to use LDAP or Active Directory authentication, see the section on using Using LDAP and Active Directory.

Using SSO for Authentication

For details on configuring Skylar One to use SSO authentication, see the section on using Using Single Sign-On.

Using Certificates for Authentication

For details on configuring Skylar One to use certificate authentication, see the section on CAC Authentication.

Editing an Existing User Account

The Account Properties page allows you to define contact information for a user or edit existing contact information for a user. From this page, you can also access the other tabs in the Account Administration panel.

To edit the contact information for a user account:

Go to the User Accounts page (Registry > Accounts > User Accounts).
In the User Accounts page, find the user account you want to edit. Click its business card icon ().
The Account Properties page appears.
In the Account Properties page, you can edit one or more contact fields. You can also click one of the additional tabs. After you save a new user account, an additional set of tabs appears. These tabs are the Account Panel tools. These tabs include the following:

Properties. Displays the Account Properties page, where you can define contact information for a user or edit existing contact information.
Permissions. Displays the Account Permissions page, where you can define or edit the account name, password, account type, state, authentication method, ticket queue membership, and privilege keys.
Preferences. Displays the Account Preferences page, where you can customize some of the behavior and appearance of Skylar One. The customizations that you choose will appear each time the current user logs in to Skylar One. This will not affect how Skylar One appears to other users.
Schedule. Displays the Account Scheduled page, where you can view a calendar for the user and enter one-time and recurring appointments, meetings, and vacation leave for the user.
Report. Generates an HTML report about the user account.

Each of the tabs is described in the section on Managing User Accounts.
Click the Save button to save your changes.

Deleting an Existing User Account

From the User Accounts page, you can delete one or more user accounts.

If you delete an existing user account that has any shared dashboards, those dashboards will also be deleted.

You cannot delete users who own shared device groups. If you attempt to do so, the user account remains in the system, but in a suspended state.

To do so:

Go to the User Accounts page (Registry > Accounts > User Accounts).
In the User Accounts page, find the account or accounts you want to delete. Select its checkbox.

In the Select Action drop-down field (in the lower right), choose DELETE Accounts.
Click the Go button.
The selected account(s) will be deleted from Skylar One.

Performing Administrative Tasks for One or More User Accounts

The User Accounts Manager page contains a drop-down field in the lower right called Select Action. This field allows you to apply an action to multiple user accounts at once. You can delete, change authentication, or change the default brand for multiple user accounts, simultaneously.

To apply an action to multiple user accounts:

Go to the User Accounts page (Registry > Accounts > User Accounts).
In the User Accounts page, select the checkbox for each user account you want to apply the action to. To select all checkboxes for all user accounts, select the checkbox at the top of the page.
In the Select Action drop-down list, select one of the following actions.

DELETE Accounts. Deletes all selected user accounts from Skylar One.

You cannot delete users who own shared device groups. If you attempt to do so, the user account remains in the system, but in a suspended state.

Require LDAP/AD Authentication. Each selected user must be authenticated on an LDAP server or an Active Directory server. User must have an existing account on an LDAP server or an Active Directory server. For details on configuring Skylar One to use LDAP or Active Directory authentication, see the section Using LDAP and Active Directory.
Remove LDAP/AD Authentication. Each selected user must be authenticated by a Compute Nodes.
Change Brand To. Change the default theme (page layout, color, and graphics) for the user(s). Select from the list of existing themes.
Change User Policy To. Change the user policy associated with the user account(s). Select from the list of existing user policies.

Click the Go button to apply the selected action to each selected user account.