Skip to main content
Users live in the Authorization area of Lerian Console, next to Roles, Groups, and Permissions. Open Authorization from the Authorization entry in the Settings sidebar, or from the gear menu in the top bar. Roles and permissions control what each user can do. The Users page needs Access Manager and the read permission on users. Without that permission, the Console shows a not-authorized page instead of the list. On Lerian Cloud, the list shows only the users of the logged-in administrator’s tenant. Console does not expose users from other tenants.

​
The Users page

The table has seven columns: You choose which columns the table shows. The list paginates, and the footer gives the range on screen and the total. The row menu holds four items: View, Reset password, Edit, and Delete. The Console shows Reset password only to an account with the update permission on reset-password. It shows Edit only to an account with the update permission on users. It shows Delete only to an account with the delete permission on users.

​
Create a user

1

Open the form

Click New User. The New user page opens.
2

Fill in the fields

The Personal information section asks for Name, Last Name, Username, and E-mail. The Password section asks for Password and Confirm Password. The Access section asks for Groups.
3

Save

Click Create user. This step needs the create permission on users. The Console opens the page of the new user.
The Console applies these rules:
  • Name and Last Name are required, and Username holds at least 3 characters.
  • Username accepts letters, numbers, hyphens, and underscores.
  • E-mail holds a valid address.
  • Password holds at least 12 characters, with one uppercase letter, one lowercase letter, one number, and one special character.
  • Password rejects two identical characters next to each other, so aa and 11 both fail.
  • Groups accepts one or more groups. At least one is required.
The Console checks these rules before it submits the form. The identity backend can apply further rules.

​
Edit a user

1

Open the row menu

Find the user, open the menu in the Actions column, and select Edit.
2

Change the fields

The sheet has no password field. You change the Name, the Last name, the E-mail, and the Groups. The sheet holds no username field, so a user keeps the username they got at creation. To remove every group of a user, use the Groups tab on the page of the user.
3

Save

Click Save.

​
Reset a user’s password

1

Open the dialog

Find the user, open the menu in the Actions column, and select Reset password. A dialog opens for that user.
2

Type the new password

Fill in New password and Confirm password. The new password follows the rules in Create a user.
3

Confirm

Click Reset password.
This is an administrator reset. It asks for no current password and sets no temporary password. The user signs in with the new one next time.
To manage your own multi-factor authentication, use Settings › Security. To reset your own password, use Forgot my password? on the sign-in page. The link appears when the deployment sets ENABLE_FORGOT_PASSWORD to true.

​
Delete a user

Deleting a user permanently removes the account. This action cannot be undone.
Find the user, open the menu in the Actions column, and select Delete. A dialog titled “Delete user?” says that the user loses access to the Console and to every group and role they hold, and that this cannot be undone. After you confirm, the Console shows “User deleted”. The Console does not offer Delete on your own account.

​
Roles, groups, and permissions

The Authorization sidebar has four entries: Users, Roles, Groups, and Permissions. Authorization opens on Users. A permission names a resource and an action. You grant it to a role, or directly to a user. A user gets a role directly or through a group. View in the row menu opens a page for one user. That page has six tabs: Effective Access, Roles, Groups, Direct Permissions, Profile, and Security. The Security tab also has a Remove passkey card. It needs the delete permission on passkeys-admin.

​
The Roles page

The Roles table has seven columns: Name, ID, Type, Groups, Status, Created At, and Actions. Type shows System or Custom. Status shows Enabled or Disabled. The platform manages the system roles. The row menu of a system role holds View only. The row menu of a custom role holds View, Edit, and Delete. The Console shows Edit only to an account with the update permission on roles. It shows Delete only to an account with the delete permission on roles.

​
Create a role

1

Open the form

On the Roles page, click New Role. The form opens on the right side of the screen.
2

Fill in the fields

The form asks for Name, Display Name, and Description.
3

Save

Click Save. This step needs the create permission on roles. The new role appears in the list.
The Console applies these rules:
  • Name and Display Name are required.
  • Name holds 2 to 100 characters: letters, numbers, hyphens, and underscores.
  • Display Name holds at most 100 characters. Description holds at most 500.

​
Edit a role

1

Open the row menu

Find the role, open the menu in the Actions column, and select Edit.
2

Change the fields

Change the Display Name, the Description, or the Enabled switch. The Name field is read-only, so a role keeps the name it got at creation.
3

Save

Click Save.

​
Assign permissions, users, and groups to a role

View in the row menu opens a page for one role. That page has three tabs: Permissions, Users, and Groups. Each tab lists what the role holds.
1

Open the tab

On the role page, open the Permissions, Users, or Groups tab.
2

Open the panel

Click Add Permissions, Add Users, or Add Groups. A panel opens with a search box.
3

Select the items

Select the items to add. An item that the role already holds shows “Already assigned”.
4

Assign

Click the button at the bottom of the panel, for example Assign 2 Permissions.
The Add Permissions panel also filters the list by Resource. To remove one item, use the remove button on its row. To remove more than one, select the rows and click Remove Selected. The Console asks you to confirm. On a system role, the Users and Groups tabs offer add and remove. The Permissions tab offers neither. A Lerian product can declare its own roles and permissions, and the Console lists a declared role as Custom. On a declared role, Identity refuses with 422 to change the description or the groups. It also refuses to add or remove a permission that a product declares. See Identity service.

​
Create a group

1

Open the form

On the Groups page, click New Group. The form opens on the right side of the screen.
2

Fill in the fields

The form asks for Name, Display Name, and Contact Email.
3

Save

Click Save. This step needs the create permission on groups. The new group appears in the list.
Name and Display Name follow the same rules as for a role. Contact Email is optional. When you fill it in, it holds a valid address. The Groups table shows Name, ID, Members, Created At, and Actions. The row menu holds View, Edit, and Delete. The Console shows Edit only to an account with the update permission on groups. It shows Delete only to an account with the delete permission on groups.

​
Edit a group

1

Open the row menu

Find the group, open the menu in the Actions column, and select Edit.
2

Change the fields

Change the Display Name or the Contact Email. The Name field is read-only.
3

Save

Click Save.

​
Add members and roles to a group

View in the row menu of a group opens a page with two tabs: Members and Roles.
1

Open the tab

On the group page, open the Members or Roles tab.
2

Open the panel

Click Add Members or Add Roles. A panel opens with a search box.
3

Select and add

Select the users or roles. Click the button at the bottom of the panel, for example Add 2 Members or Assign 2 Roles.
To remove a member or a role from the group, use the same buttons as on a role page.

​
Browse permissions

The Permissions page lists the permissions in one table. Search by name, or filter by Resource. The table has these columns: