Adding Groups

User Groups can simplify security management. Rather than assigning the same permissions to 10 Users, you can create a User Group, assign the permissions to that Group and then add the 10 individuals as members to the Group. Users can belong to as many Groups as necessary.

The User's total permissions will be from the permissions assigned directly to them and the permissions of each Group they belong to.

The default Connect Daily installation has an Admins group which are Users that have administrative privileges, and group Users which all Users belong to.

Edit Group Form

Group Name - The name to use for the Group.

Description - You should put in a text description of your Group so that other administrators will know what it is for.

LDAP Equivalent Groups - If you have configured the authentication system to use LDAP/AD, you can enter the LDAP/AD groups that are equivalent to this Connect Daily group. This allows you to not have to individually set the permissions and group memberships for each Connect Daily user. You can specify more than one group to be equivalent to a Connect Daily group. Separate each group with a semi-colon. You can put each group on a separate line, but if there are multiple groups, they must be separated with a semi-colon.

You can enter the equivalent group name two ways. You can enter the complete distinguished name for the group. For example:

CN=Domain Admins,CN=Users,DC=testing,DC=mhsoftware,DC=com

Alternatively, you could enter it as a regular expression:

^CN=Domain Admins,.*

which would match a person who is a member of any group named Domain Admins, regardless of the context. Another example would be

.*,DC=testing,DC=mhsoftware,DC=com$ which would match any group defined in testing.mhsoftware.com

Each time a user logs in, the user's group membership in the directory will be reconciled. They will be added and removed from groups based on the mappings you create.

Tips:

• If you don't set a value for this field, then users will not be added or removed from the group.
• If you are not sure what the complete distinguished name for a group is, use a tool like JXplorer to browser your directory tree and look at a few users.
• If you enable debug mode in ldap.properties, each user's group memberships will be printed on login. You can view this in the log files, or in the audit trail.
• During initial setup, you might want to make sure that the Connect Daily Admins group is the last one you set up. If you enter an LDAP equivalent group incorrectly, then you'll be removed from the Admin group on login. You would have to do a manual database edit to undo the error.
• If you're having trouble getting a regular expression right, use an online tool to test them. Search for java regular expression tester.

Users - Select the Users to put in your Group by using the mover. Mark the Users you want in the Available Users box, and then click on the > button so that they are moved to the Selected Users box. You can mark multiple Users at a time by using a combination of shift and click or control and click.

Security - This section contains information on the privileges and permissions assigned to the Group.

• System Wide Permissions
• Things this Group has permissions for - This section lists the privileges that the Group has permissions to. If the User has Manage Security permissions to these privileges, then they can view the Manage Security dialog for that privilege and edit the Group's permissions.