Roles

👥 Roles Overview

Roles determine what users are authorized to do in GermainUX. Each Role contains a set of permissions and can be assigned directly to users or mapped to groups from LDAP, Active Directory, or an OAuth identity provider.

🤝 Roles and Teams

Roles and Teams control different aspects of access:

A user may need both the appropriate Role and Team membership to access a feature and its associated data.

👀 View Roles

Go to:

Germain Workspace > Left Menu > System > Auth Settings > User Roles

By default, GermainUX provides two Roles:

Additional Roles can be created to meet your organization’s access-control requirements.

➕ Create a Role

1. Go to System > Auth Settings > User Roles.

2. Click Add New Configuration.

3. Enter a unique Role name.

4. Select the permissions to assign to the Role.

5. Save the Role.

When using LDAP, Active Directory, or OAuth group mapping, the GermainUX Role name must match the corresponding external group name, including its spelling and capitalization.

🔑 Available Permissions

👤 Assign Roles to Users

For GermainUX-managed users:

1. Go to System > Auth Settings > Users.

2. Select the user.

3. Assign one or more Roles.

4. Save the user.

When multiple Roles are assigned, the user receives the combined permissions of those Roles.

🔗 Map External Groups to Roles

When authentication is managed through LDAP, Active Directory, or OAuth:

1. Create or identify the required group in the external identity provider.

2. Create a matching Role in GermainUX.

3. Ensure that both names use identical spelling and capitalization.

4. Assign the user to the external group.

5. Confirm that the authentication provider returns the group membership.

6. Test the user’s resulting permissions.

💡 Example

For configuration instructions, see:

✏️ Edit a Role

1. Go to System > Auth Settings > User Roles.

2. Select the Role.

3. Add or remove permissions.

4. Save the changes.

5. Test the updated Role with a non-administrator account.

Changes affect every user or external group mapped to that Role.

✅ Validate Role Permissions

Confirm that users:

• Can perform only the operations required for their responsibilities

• Cannot enable configurations when assigned only Create Inactive Config

• Cannot modify configuration without Create/Edit Config

• Cannot manage accounts without Manage Users

• Cannot view Session Replays without View User Replay

• Can access only the dashboards and data authorized through their Teams

💡 Recommended Practices

• Apply the principle of least privilege.

• Create Roles based on job responsibilities rather than individual users.

• Limit Create/Edit Config and Manage Users to authorized administrators.

• Grant View User Replay only when required.

• Use Create Inactive Config when configuration changes require approval.

• Reserve Monitor for technical monitoring accounts.

• Periodically review Roles, permissions, user assignments, and external group mappings.

• Test Role changes with a non-administrator account before applying them broadly.