User Management

Dashboard User

Dashboard users are restricted to the Dashboard Pages only. Lens content accessibility is restricted to associated Logical or Service Groups, based on User Group membership. Although the Users cannot create reports, they can access reports shared based on User Group membership (or public reports). They can create their own Dashboard Pages and Spaces. For Trend Graph or Pie/Bar charts, Dashboard users can also create their own graphs from accessible CI Attributes.

Services Supervisor

Services Supervisor have all the access of Dashboard users plus access to Service Management and Analysis sections of the application. Some Dashboard content will also provide additional contextual links to allow further analysis your issues or services. In addition to services and analysis views, supervisor users can create and manage their own reports. CI access is based on user group membership.

Services Manager

Services Manager user have access to Dashboard, Analysis, Service Management, and Service based Configuration (Service Groups, Policy, etc) but not device level Configuration (CI).

Configuration Administrator

Configuration Administrator have the ability to edit the configuration of your CIs, Visual Controls and other Data Collection or Data presentation settings. CI access is based on user group membership.

FireScope Administrator

FireScope Administrator have the ability  to edit settings that affects users, groups or properties that has impact on accessibility. Batch configuration functions such as Blueprint linkage and Migrate CIs requires this level of access. FireScope Administrators has access to all Service Groups, Logical Groups and CIs. They can also administer other users’ Dashboards and Reports.

Account Administrator

Global Settings that affects all configurations and evaluations within the account requires this level of access. Limit this user access level to those you wish to conduct global setting configurations only. Account Administrators have access to all Service Groups, Logical Groups and CIs. This level of access can also administer other users’ Dashboards and Reports.

Create a SPM User:

1. Log in to FireScope SPM as a FireScope Administrator.
2. Click Administration > Permissions > Users. The Users page will be displayed with list of the current Users, their access level, user group(s) and online status.
3. Click on the Create button(on the upper, right side of the page). The Create User page will be displayed.

1. Complete the form.
2. Click on the Save button.                                                                 

Update a SPM User:

Refer to Create User for Screen Shots#  Log in to FireScope SPM as a FireScope Administrator.

1. Click Administration > Permissions > Users. The Users page will be displayed with list of the current Users, their access level, user group(s) and online status.
2. Click on User’s Alias (Login Name). Edit User page will be displayed.
3. Add, delete or update the User information.
4. Click on the Save button. 

Delete a SPM User:

Note: Deleting a User consists a some considerations.# If this User is Active Directory created, deleting this user will simply cause the user to be recreated in the next synchronization.

1. Determine the reassignment of any objects that may belong to this user. For example, you may choose to reassign ownership and persist and pass control to another user.
2. Below is the reassignment screen you will see after clicking delete on an individual User’s Configuration form. (not from the grid)

User Groups

User Groups are used to manage access for a group of Users. They are commonly used to represent a team within an organization that shares common responsibilities or tasks related to managing the IT assets.While User Group membership determines which assets are accessible to Users, User Access Level(link) determines the level of access rights (read-only, read-write) the user has to those assets.

 User Groups linked to a Service Group – will allow users access to all Logical Groups, CIs and related elements (Attributes, Event Definitions, Events, etc) under that Service Group & its Logical Groups.

 User Groups linked to a Logical Group – will allow users access to all CIs and related elements (Attributes, Event Definitions, Events, etc) under that Logical Group.

 User Groups linked to a Blueprint Group – will allow users access to view and edit Blueprint Groups and their associated Blueprint elements.

Creating and Managing a User Group

 Note: Although users can belong to more than one User Group, it is easier to manage permissions by NOT overlapping User and Group memberships with complex Service and Logical Group assignments.# Log in to FireScope SPM as a FireScope or Account Administrator.

1. Click Administration > Permissions > User Groups. The User Groups page will be displayed with list of the current User Groups.

1. Click on the Create button. Create User Groups page will be displayed.

1. Group Name: Create your user groups to organize asset access.
2. Users: Select which groups this new user will be associated with for access to assets. User group assignment also determine visibility to group shared dashboard pages.
3. Service Group/Logical Group
   • User groups linked to a Service Group – will allow users access to all Logical Groups, CIs and related elements (attributes, event definitions, events, etc) under that Service Group & its Logical Groups.
   • User groups linked to a Logical Group – will allow users access to all CIs and related elements (attributes, event definitions, events, etc) under that Logical Group.
4. Blueprint Group:
   • User groups linked to a Blueprint Group – will allow users access to view and edit Blueprint Groups and their associated Blueprint elements.
5. Click on the Save button.

External Authentication(SAML)

If you have SAML Identity Provider or Windows Active Directory deployed in your organization for user access management, you can utilize SPM External Authentication to use the same Credentials as the organization’s login Credentials. 

To Select a Method of Authentication: # Login in to Firescope SPM as an Account Administrator.

1. Click on Administrator > Permissions > External Authentication. External Authentication page will be displayed.

1. Select the Authentication Method from the drop down list. For more information on each method refer to Authentication Methods section.
2. Complete the form.
3. Click on Enable and Save button.

Authentication Methods

1. Local Authentication OnlyThis is the default Authentication method. It authenticates against local Users only. This method does not require any type of integration with other authentication sources or organizations within the company. 

1. Active Directory Authentication
   This is a method that authenticates against local Users and Windows Active Directory. This method requires SPM cloud to have access to the Windows Active Directory to verify user credentials. It also requires configuration provided by Active Directory and Users should be already imported through AD User Configuration. The Active Directory may be provided by a different organization within your company.

1. SAML AuthenticationThis is a method that authenticates against local Users and SAML. SAML authentication is a method that authenticate Users against a remote service, know as a SAML Identity Provider (IdP), instead of authenticating against SPM which is considered to be the SAML Service Provider (SP). SAML Identity Provider may be provided by a different organization within the company.
   Successful SAML authentication requires following:
   • SPM cloud to have access to your SAML Identity Provider.
   • Configuration and exchange of SAML metadata between SPM and your SAML Identity Provider.
   • Changes to the customer’s authentication server (idP ie PingID) and to the customer’s account in SPM (SP).

Select the SAML Authentication method from the drop down list on External Authentication page. SAML Authentication page will be displayed. This page has three sections which are explained below.# Remote Identity Provider(IdP) –  This information must be provided by your Remote Identity Provider. Coordinate SAML configuration with your Remote Identity Provider. For more information on the fields refer to the Section Description Table 1 below. Section Description Table 1

1. Local Service Provider(SP) – SAML configuration must be provided to your Remote Identity Provider and must match your Remote Identity Provider configuration. Coordinate SAML configuration with your Remote Identity Provider. This information is provided by SPM. For more information on the fields refer to the Section Description Table 2 below.

Section Description Table 2

1. Options – This section has additional SAML configuration which must match your Remote Identity Provider configuration.Coordinate SAML configuration with your Remote Identity Provider. For more information on the fields refer to the Section Description Table 3 below.Section Description Table 3

Common Errors

Invalid issuer in the Assertion/Response

Check that you have the correct Entity ID URL, and also verify that you are using the appropriate http or https at the beginning.

NameID was not in the Assertion Response

Check your claim rule and make sure you are sending SAM-Account-Name matched to Name ID.

User was not found

Check to make sure that you have imported users through the Administration menu à AD User Configuration page in FireScope. This should be in active status, and you can validate the correct users are created by checking the Users page.  AD imported users are noted with a “synced from AD” message immediately beneath the user’s name.

AD User Configuration

SPM allows the user to configure access to Windows AD from a deployed Edge device which provides users a more secure method to access user information to setup accounts in SPM cloud. The connection is assigned to a single Edge device which is already deployed within the user’s network and utilizes an already open connection between the Edge device and the SPM cloud to deliver the user data.

Note: Make sure the AD account user you enter here has visibility to the users you wish to import.# Log in to FireScope SPM as a Account Administrator.

1. Click Administration > Permissions > AD User Configuration. The Users Configuration page will be displayed.

1. Complete the form, for more information refer to the Section Description Table below.
2. Click on Save button.

Note: If a user is matched on more than one filter, their user account will have the highest level of permissions.

Section Description Table