> ## Documentation Index
> Fetch the complete documentation index at: https://docs.germainux.com/llms.txt
> Use this file to discover all available pages before exploring further.

# User Management

> GermainUX supports managed accounts, integration with an enterprise identity provider, or a combination of authentication methods to meet security needs.

Service
`Management`

Availability
2014.1 or later

> [!NOTE]
>
> GermainUX provides flexible user-management, authentication, and access-control capabilities for the Germain Workspace.

Organizations can use GermainUX-managed accounts, integrate with an enterprise identity provider, or combine several authentication methods to meet their security requirements.

> [card] [User-Management Capabilities](#user-management-capabilities)
>
> What user management covers

> [card] [Configuration](#configuration)
>
> Where to find settings

> [card] [User Management Documentation](#user-management-documentation)
>
> Links to detailed guides

> [card] [Recommended Approach](#recommended-approach)
>
> Recommended setup order

## User-Management Capabilities

| Capability | Purpose |
| - | - |
| **Users** | Create and manage the people who can access the Germain Workspace. |
| **Authentication providers** | Authenticate users through a database, LDAP, Active Directory, OAuth 2.0, or OpenID Connect. |
| **Roles** | Define which features and administrative operations users can access. |
| **Teams** | Control dashboard, data, and Session Replay visibility for groups of users. |
| **Access requests** | Allow prospective users to request Workspace access for administrator approval. |
| **Password management** | Send welcome emails and allow eligible users to reset forgotten passwords. |
| **API keys** | Authenticate applications, scripts, and external services without an interactive user login. |

## Authentication Options

| Method | Recommended Use |
| - | - |
| **Database/JDBC** | GermainUX-managed accounts authenticated against a configured database. |
| **LDAP** | Centralized authentication and role mapping through an LDAP directory. |
| **Windows Active Directory** | Authentication and role assignment using Active Directory users and groups. |
| **OAuth 2.0/OpenID Connect** | Enterprise single sign-on through an external identity provider. |
| **API keys** | Non-interactive authentication for applications and automated HTTP requests. |

For centralized account administration, GermainUX recommends integrating the Workspace with your organization’s existing identity and authentication system whenever possible.

## Configuration

Most user-management settings are available under:

**Germain Workspace > Left Menu > System > Auth Settings**

| Configuration Area | Purpose |
| - | - |
| **Authentication** | Configure JDBC, LDAP, OAuth, and OpenID Connect providers. |
| **Users** | Create users, review access requests, reset passwords, and assign roles or teams. |
| **User Roles** | Define permissions and map external groups to GermainUX roles. |
| **Teams** | Group users and configure dashboard or data visibility. |
| **API Keys** | Create and manage Bearer tokens for API authentication. |

## User Management Documentation

### Users

Use the following guides to configure user accounts and authentication:

| Guide | Description |
| - | - |
| [Database Users and Roles](https://docs.germainux.com/main/database-user-management.md) | Configure JDBC authentication and create GermainUX-managed users. |
| [LDAP User Management](https://docs.germainux.com/main/ldap-user-management.md) | Authenticate users and map directory groups through LDAP. |
| [OAuth User Management](https://docs.germainux.com/main/oauth-user-management.md) | Configure OAuth 2.0 or OpenID Connect authentication. |
| [Password Reset](https://docs.germainux.com/main/password-reset.md) | Allow eligible users to reset a forgotten password. |
| [User Access Request](https://docs.germainux.com/main/user-access-request.md) | Review, approve, reject, and audit Workspace access requests. |
| [Windows Active Directory User Management](https://docs.germainux.com/main/windows-active-directory-user-management.md) | Configure Active Directory users and groups for GermainUX. |

### OAuth and OpenID Connect Providers

The OAuth User Management section includes provider-specific configuration guides:

| Provider | Guide |
| - | - |
| **Okta** | [Okta User Management](https://docs.germainux.com/main/okta-oauth-integration-with-germain.md) |
| **PingFederate** | [PingFederate OIDC](https://docs.germainux.com/main/ping-federated-oidc.md) |
| **PingID** | [PingID User Management](https://docs.germainux.com/main/pingid.md) |

### Authorization and Visibility

| Guide | Description |
| - | - |
| [Roles](https://docs.germainux.com/main/users-roles.md) | Define the operations users are authorized to perform. |
| [Teams](https://docs.germainux.com/main/teams.md) | Manage user groups, dashboard permissions, pinned dashboards, and data visibility. |
| [API Keys](https://docs.germainux.com/main/api-keys.md) | Authenticate applications and automated HTTP requests using Bearer tokens. |

## How Roles and Teams Work Together

Roles and Teams serve different but complementary purposes:

| Access-Control Object | Controls |
| - | - |
| **Role** | What a user is allowed to do in GermainUX. |
| **Team** | Which dashboards, data, and Session Replays a user can access. |

A user can belong to multiple Teams and have one or more Roles. The resulting access is based on the permissions and visibility inherited from all assigned Roles and Teams.

## Recommended Approach

When configuring user management:

**1. Select the authentication method approved by your organization**

**2. Configure the authentication provider**

**3. Define Roles using the principle of least privilege**

**4. Create Teams based on dashboard and data-visibility requirements**

**5. Map external directory groups to GermainUX Roles when using LDAP or OAuth**

**6. Test authentication, permissions, and visibility with a non-administrator account**

**7. Periodically review users, Roles, Teams, access requests, and API keys**

## Get Help

> [card] [Contact GermainUX Support](https://docs.germainux.com/main/support.md)
>
> The GermainUX team helps you get up and running faster, empower your team, turn data into actionable insights, and optimize performance to deliver measurable business outcomes.

> [card] Can't find what you need?
>
> Search all GermainUX docs with **Ctrl + K**, or use the feedback buttons at the bottom of this page to tell us what is missing.

The content of this document is proprietary to GERMAIN SOFTWARE.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.