> ## Documentation Index
> Fetch the complete documentation index at: https://docs.germainux.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles

> Roles determine what users are authorized to do in GermainUX.

Service
`Authentication`

Availability
8.6.0 or later

> [card] [Roles Overview](#roles-overview)
>
> What roles authorize

> [card] [Create a Role](#create-a-role)
>
> Match external group names exactly

> [card] [Map External Groups to Roles](#map-external-groups-to-roles)
>
> Link AD or LDAP groups

> [card] [Recommended Practices](#recommended-practices)
>
> Role management best practices

## Roles Overview

Roles determine what users are authorized to do in GermainUX. Each Role contains a set of permissions and can be assigned directly to users or mapped to groups from LDAP, Active Directory, or an OAuth identity provider.

## Roles and Teams

Roles and Teams control different aspects of access:

| Access-Control Object | Purpose |
| - | - |
| **Role** | Controls which operations the user can perform in GermainUX. |
| **Team** | Controls which dashboards, data, and Session Replays the user can access. |

A user may need both the appropriate Role and Team membership to access a feature and its associated data.

## View Roles

Go to:

**Germain Workspace > Left Menu > System > Auth Settings > User Roles**

By default, GermainUX provides two Roles:

| Role | Purpose |
| - | - |
| `germain_apm_admin` | Provides administrative and configuration permissions. |
| `germain_apm_user` | Provides standard user permissions. |

Additional Roles can be created to meet your organization’s access-control requirements.

## Create a Role

**1. Go to System > Auth Settings > User Roles**

**2. Click Add New Configuration**

**3. Enter a unique Role name**

**4. Select the permissions to assign to the Role**

**5. Save the Role**

When using LDAP, Active Directory, or OAuth group mapping, the GermainUX Role name must match the corresponding external group name, including its spelling and capitalization.

## Available Permissions

| Permission | Description |
| - | - |
| **Create Inactive Config** | Allows users to create monitoring, analytics, and automation configuration objects, but not enable them. A user with **Create/Edit Config** must review and enable the configuration. |
| **Create/Edit Config** | Allows users to create, edit, delete, enable, and disable GermainUX configuration objects. |
| **Create Dashboard** | Allows users to create and edit dashboards. |
| **Edit UI Field/Column** | Allows users to customize supported Workspace elements, such as dashboard fields and columns. |
| **View Data** | Allows users to query and view business and metadata stored in the GermainUX Datamart. |
| **View User Replay** | Allows users to view Session Replays that they are otherwise authorized to access. |
| **Manage Users** | Allows users to create, edit, enable, disable, and remove GermainUX users. |
| **Monitor** | Allows GermainUX Engines and Agents to retrieve their monitoring configuration from the GermainUX server. This permission is generally intended for technical monitoring accounts. |

## Assign Roles to Users

For GermainUX-managed users:

**1. Go to System > Auth Settings > Users**

**2. Select the user**

**3. Assign one or more Roles**

**4. Save the user**

When multiple Roles are assigned, the user receives the combined permissions of those Roles.

## Map External Groups to Roles

When authentication is managed through LDAP, Active Directory, or OAuth:

**1. Create or identify the required group in the external identity provider**

**2. Create a matching Role in GermainUX**

**3. Ensure that both names use identical spelling and capitalization**

**4. Assign the user to the external group**

**5. Confirm that the authentication provider returns the group membership**

**6. Test the user’s resulting permissions**

### Example

| External Group | GermainUX Role |
| - | - |
| `germain_apm_admin` | `germain_apm_admin` |
| `germain_apm_user` | `germain_apm_user` |

For configuration instructions, see:

| Topic | Link |
| - | - |
| LDAP User Management | [LDAP User Management](https://docs.germainux.com/main/ldap-user-management.md) |
| OAuth User Management | [OAuth User Management](https://docs.germainux.com/main/oauth-user-management.md) |
| Windows Active Directory User Management | [Windows Active Directory User Management](https://docs.germainux.com/main/windows-active-directory-user-management.md) |

## Edit a Role

**1. Go to System > Auth Settings > User Roles**

**2. Select the Role**

**3. Add or remove permissions**

**4. Save the changes**

**5. Test the updated Role with a non-administrator account**

Changes affect every user or external group mapped to that Role.

## Validate Role Permissions

Confirm that users:

* Can perform only the operations required for their responsibilities
* Cannot enable configurations when assigned only **Create Inactive Config**
* Cannot modify configuration without **Create/Edit Config**
* Cannot manage accounts without **Manage Users**
* Cannot view Session Replays without **View User Replay**
* Can access only the dashboards and data authorized through their Teams

## Recommended Practices

* Apply the principle of least privilege.
* Create Roles based on job responsibilities rather than individual users.
* Limit **Create/Edit Config** and **Manage Users** to authorized administrators.
* Grant **View User Replay** only when required.
* Use **Create Inactive Config** when configuration changes require approval.
* Reserve **Monitor** for technical monitoring accounts.
* Periodically review Roles, permissions, user assignments, and external group mappings.
* Test Role changes with a non-administrator account before applying them broadly.

## Get Help

> [card] [Contact GermainUX Support](https://docs.germainux.com/main/support.md)
>
> The GermainUX team helps you get up and running faster, empower your team, turn data into actionable insights, and optimize performance to deliver measurable business outcomes.

> [card] Can't find what you need?
>
> Search all GermainUX docs with **Ctrl + K**, or use the feedback buttons at the bottom of this page to tell us what is missing.

The content of this document is proprietary to GERMAIN SOFTWARE.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.