User Management | Germain Documentation

GermainUX provides flexible user-management, authentication, and access-control capabilities for the Germain Workspace.

Organizations can use GermainUX-managed accounts, integrate with an enterprise identity provider, or combine several authentication methods to meet their security requirements.

👥 User-Management Capabilities

Capability	Purpose
Users	Create and manage the people who can access the Germain Workspace.
Authentication providers	Authenticate users through a database, LDAP, Active Directory, OAuth 2.0, or OpenID Connect.
Roles	Define which features and administrative operations users can access.
Teams	Control dashboard, data, and Session Replay visibility for groups of users.
Access requests	Allow prospective users to request Workspace access for administrator approval.
Password management	Send welcome emails and allow eligible users to reset forgotten passwords.
API keys	Authenticate applications, scripts, and external services without an interactive user login.

🔑 Authentication Options

Method	Recommended Use
Database/JDBC	GermainUX-managed accounts authenticated against a configured database.
LDAP	Centralized authentication and role mapping through an LDAP directory.
Windows Active Directory	Authentication and role assignment using Active Directory users and groups.
OAuth 2.0/OpenID Connect	Enterprise single sign-on through an external identity provider.
API keys	Non-interactive authentication for applications and automated HTTP requests.

For centralized account administration, GermainUX recommends integrating the Workspace with your organization’s existing identity and authentication system whenever possible.

⚙️ Configuration

Most user-management settings are available under:

Germain Workspace > Left Menu > System > Auth Settings

Configuration Area	Purpose
Authentication	Configure JDBC, LDAP, OAuth, and OpenID Connect providers.
Users	Create users, review access requests, reset passwords, and assign roles or teams.
User Roles	Define permissions and map external groups to GermainUX roles.
Teams	Group users and configure dashboard or data visibility.
API Keys	Create and manage Bearer tokens for API authentication.

📖 User Management Documentation

👤 Users

Use the following guides to configure user accounts and authentication:

Guide	Description
Database Users and Roles	Configure JDBC authentication and create GermainUX-managed users.
LDAP User Management	Authenticate users and map directory groups through LDAP.
OAuth User Management	Configure OAuth 2.0 or OpenID Connect authentication.
Password Reset	Allow eligible users to reset a forgotten password.
User Access Request	Review, approve, reject, and audit Workspace access requests.
Windows Active Directory User Management	Configure Active Directory users and groups for GermainUX.

🔒 OAuth and OpenID Connect Providers

The OAuth User Management section includes provider-specific configuration guides:

Provider	Guide
Okta	Okta User Management
PingFederate	PingFederate OIDC
PingID	PingID User Management

👁️ Authorization and Visibility

Guide	Description
Roles	Define the operations users are authorized to perform.
Teams	Manage user groups, dashboard permissions, pinned dashboards, and data visibility.
API Keys	Authenticate applications and automated HTTP requests using Bearer tokens.

🤝 How Roles and Teams Work Together

Roles and Teams serve different but complementary purposes:

Access-Control Object	Controls
Role	What a user is allowed to do in GermainUX.
Team	Which dashboards, data, and Session Replays a user can access.

A user can belong to multiple Teams and have one or more Roles. The resulting access is based on the permissions and visibility inherited from all assigned Roles and Teams.

💡 Recommended Approach

When configuring user management:

Select the authentication method approved by your organization.
Configure the authentication provider.
Define Roles using the principle of least privilege.
Create Teams based on dashboard and data-visibility requirements.
Map external directory groups to GermainUX Roles when using LDAP or OAuth.
Test authentication, permissions, and visibility with a non-administrator account.
Periodically review users, Roles, Teams, access requests, and API keys.

Service: Authentication
Feature Availability: Varies by authentication and user-management capability