User Management

User Access Level

FireScope SDDM has three access levels which allows users the necessary accessibility for their assigned tasks.

Following are the access roles listed from least access to most access:

• Service Analyst
• FireScope Administrator
• Configuration Administrator

Create User

To Create a SDDM User:

1. Log in to FireScope SDDM as a FireScope or Configuration Administrator.
2. Click Administration > Users > Create and the New User page will be displayed.

Enter User Information

Locale:

1. Timezone: Click on the Change button to change the Country and time zone.  A drawer will slide out from the right that provides the necessary time zone fields
2. Date/Time Format: Click on Change button to change the time and date format.  A drawer will slide out from the right that provides the necessary date and time fields.

Application Settings

1. Homepage:  Select the home page that you would like this user to see at login
2. Auto-Logout: Enter the number of seconds that a user will be inactive prior to logging out the user.  Enter 0 for Never, a minimum of 60 seconds or a maximum of 14400 seconds.

Save / Cancel – Click Save to save changes.

To Update or Edit a SDDM User:  Log in to FireScope SDDM as a FireScope or Configuration Administrator.

Click Administration > Users > List and the Users Page will be displayed with a list of the current Users, their online status, username, contact details and User Type.

1. Click on user’s Username.  The Edit User page will be displayed.
   1. Alternatively, you can click on the three dots on the far right of the line with the username you are interested in and select Edit User
2. Make necessary changes.
3. Click the Save button. 

To Disable a SDDM User:  

Log in to FireScope SDDM as a FireScope or Configuration Administrator.

Click Administration > Users > List. The Users page will be displayed with list of the current Users, their online status, username, contact details and User Type.

The column headers can be used to group or sort the list.

1. Click on the three dots on the far right of the line with the username you are interested in on Users screen and select Disable User
2. Click confirm to disable.

To Delete a SDDM User:

Deleting a User requires some considerations. If this user is in Active Directory , deleting this user will simply cause the user to be recreated in the next synchronization.

Additionally, consider the reassignment of any objects that may belong to this user. For example, you may choose to reassign ownership and persist and pass control to another user.

To Delete a SDDM User:  Log in to FireScope SDDM as FireScope or Configuration Administrator.

1. Click Administration > Users > List. The Users page will be displayed with list of the current Users, their Online Status, Username, Contact Details and User Type.
2. Select a user from the list,
   1. Click on the three dots on the far right of the line with the username you are interested in and select Delete User
3. Click Confirm to confirm the deletion.

User Groups

User Groups are used to manage access for a group of Users. They are commonly used to represent a team within an organization that shares common responsibilities or tasks related to managing the IT assets. While User Group membership determines which assets are accessible to Users, User Group Permissions determines the level of access rights (read-only, read-write) the user has to those assets.

User Groups linked to a Service Group – will allow users access to all Logical Groups, CIs and related elements (Attributes) under that Service Group & its Logical Groups.

User Groups linked to a Logical Group – will allow users access to all CIs and related elements (Attributes) under that Logical Group.

User Groups linked to a Blueprint Group – will allow users access to view and edit Blueprint Groups and their associated Blueprint elements.

Creating and Managing a User Group

Note: Although Users can belong to more than one User Group, it is easier to manage permissions by NOT overlapping user and group memberships with complex Service and Logical group assignments. Log in to FireScope SDDM as a FireScope or Account Administrator.

1. Click Administration > User Groups > Create and the New User Group page will be displayed..

Enter New User Group Data

1. User Group Name: Enter a name for your User Group.
2. User Membership: Add users here by clicking on Edit button. Existing Users will be displayed in the drawer to the right of the screen (see example below)

1. Click on the check box next to the username you wish to add to the group, and you will see the users added to the User Membership area
2. Group Permissions: Select the appropriate Group Permissions as described above by clicking on the edit button
   1. Service Groups
   2. Logical Groups, or
   3. Blueprint Groups
3. Click Save to save your changes.

User Authentication

FireScope provides three different ways to authenticate users

1. Local Authentication Only:  This is the default authentication. It authenticates against local users only. This method does not require any type of integration with other authentication sources or organizations within the company. This type of authentication uses the values entered on the Create User page as described above.  Note: Enabling Local Authentication will disable Active Directory Authentication.
2. Active Directory Authentication: This is a method that authenticates against local users and Windows Active Directory. This method requires FireScope cloud to have access to the Windows Active Directory to verify user credentials. It also requires configuration provided by Active Directory and users should be already imported through AD User Configuration. The Active Directory may be provided by a different organization within your company.
3. SAML Authentication This is a method that authenticates against local users and SAML. SAML authentication is a method to authenticate users against a remote service, known as a SAML Identity Provider (IdP), instead of authenticating against FireScope SDDM which is the SAML Service Provider (SP). SAML Identity Provider may be provided by a different organization within the company.

To Select the type of Authentication that you want, go to Settings > Single Sign-On and select the type of Authentication / Sign-on that you desire as shown on the page below;

Active Directory User Configuration

FireScope SDDM allows the user to configure access to Windows AD from a deployed Edge device which provides users a more secure method to access user information to setup accounts in SDDM cloud. The connection is assigned to a single Edge device which is already deployed within the user’s network and utilizes an already open connection between the Edge device and the SDDM cloud to deliver the user data.

Log in to FireScope SDDM as a FireScope or Account Administrator.

1. Click Settings > Single Sign-On: Active Directory Configuration and the Active Directory Configuration page will be displayed.

Click on Server Connection to display Server Connection page;

1. Edge Device: Click on Change Edge Device button to select an Edge Device to designate the data collection or operation target. Note: Changing the Edge device setting will require configuration update to move the access to your data from one Edge to another.
2. Windows AD Connection:
   1. Server Address: Enter your internal AD server such as ad.company.com or 10.0.0.123.
   2. Port: Enter the Port number. Note: Default port is 389
   3. Domain: Your Domain, often the text following the @ in your email, such as company.com
   4. Use SSL Connection: should be toggled on and you must upload an SSL certificate to enable SSL connection. 
   5. Press Choose File to select your SSL certificate if SSL is selected
   6. Press Save Changes to save your changes
3. Return to the AD Configuration Screen and select Server Authentication

1. Authentication User: Enter the Authentication User
2. Password: Enter the Password
3. Press Save Changes to save your updates.

Note: Make sure the AD account user you enter here has visibility to the users you wish to import.

Return to the AD Configuration Screen and select User Import Criteria to display the page below

1. AD User Group –This is the actual location of the User. The full baseDN path the main user group ‘OU=Demo Users,OU=Demo,DC=mycompany,DC=int’
2. Query Filter: This is utilized to narrow the user list down to the ones you wish to import with this rule. Query filter to select users to import Fields sAMAccountName, mail, sn, givenName are all required for valid users. How-to guide on writing filters https://technet.microsoft.com/en-us/library/aa996205(v=exchg.65).aspx
   Note: Consult your security administrator and test the search filters with AD administrative tools before trying it in FireScope SDDM.
3. FireScope User Type: You can select the user access level for the imported or updated user from the drop down list. Note: If the user is part of multiple rule results, the highest level will be granted.
4. FireScope User Groups: –You can select the user group of which the imported or updated user will become a member. Note: This is additive only. When a user does NOT match a user group assignment, the update import will NOT remove the user from any group or groups.
   Examples: view msdn reference

Click Add Import Criteria and Save Changes

Return to the AD Configuration page and select User Import Scan and Schedule

1. Allow Scans for Active Directory Users: toggle on if desired
2. Scan Frequency:  Specify the scan frequency in minutes
3. Import Active Directory Users to FireScope: Toggle this on to import AD users
4. Click Save Changes or Save & Scan Active Directory Users as desired.

Return to the AD Configuration Screen and select User Import Results to see the results of the input job

Last Scan Summary–Displays the record of updated and imported users. Click on Results to see detailed view. 

External Authentication

If you have SAML Identity Provider or Windows Active Directory deployed in your organization for user access management, you can utilize FireScope’s External Authentication to use the same credentials as the organization’s login credentials.

Click on Settings > Application Settings> Single-Sign-On: SAML Configuration the Configuration Authentication via a SAML ID Provider page will be displayed.

Successful SAML authentication requires the following:

1. FireScope SDDM cloud to have access to your SAML Identity Provider.
2. Configuration and exchange of SAML metadata between FireScope SDDM and your SAML Identity Provider.
3. Changes to the customer’s authentication server (idP ie PingID) and to the customer’s account in FireScope SDDM (SP).

Remote Identity Provider: complete this section if appropriate

1. Identity Provider Entity ID (Issuer): This information must be provided by your Remote Identity Provider. Coordinate SAML configuration with your Remote Identity Provider.
2. Single-Sign-On Service URL: URL target of the IdP where the SP will send the Authentication Request Message
3. Single-Log-Out Service URL: or Log-Out Redirect URL: URL where the SP will perform a simple non-SAML redirect.
4. X.509 Certificate:  IdP public certificate used in verifying signed SAML responses

1. Local Service Provider: (FireScope)
   1. Service Provider ID (Metadata): Click Download XML to download the appropriate XML details.
   2. User Alias Mapping: Click and select the appropriate mapping
   3. NameID Format: Click and select the appropriate NameID Format
   4. Single Log-Out Service: URL for the Identity Provider to issue a logout request to FireScope
   5. Assertion Consumer Service URL (ACS): Displays the ACS URL.
   6. X.509 Certificate: IdP public certificate used in verifying signed SAML responses

Local Service Provider Options

This section has additional SAML configuration which must match your Remote Identity Provider configuration. Coordinate SAML configuration with your Remote Identity Provider.