Users

Create a Normal User

Admins give Users access to the search appliance to the data. The amount and type of data available to the user depend on the user’s group permissions and security collections. Normal users require a username and a password to sign in to the system. If a user needs to interact only with IMAT APIs, see the Script User section below.

1. In the navigation pane, click Users.

2. Click add_circle found in the top-right corner of the Users screen. This opens the Add User screen.

3. Choose Normal as the Account Type.

4. In the Username field, type the user’s sign-in name. Usernames can contain the following characters:

   • numbers

   • letters (uppercase and lowercase)

   • _ (underscore)

   • - (hyphen)

   • . (period)

   • * (asterisk)

   • @ (at)

5. Type the First name.

6. Type the Last name.

7. In the Password field, type the user’s password. This is a temporary password, and the user must reset it during their first sign-in. Remember the password, because you’ll need to share it with the user. Once you leave this screen, you will be unable to view the password again.

8. Confirm password by typing it again.

9. Enter an Email address. IMAT versions before 8.5 do not have this capability.

10. In the Available Groups area, click on the groups you want the user to belong to. The list of groups the user is added to is found in Added Groups. Different IMAT applications require different access roles, but all users must have either the searchappliance_search or the searchappliance_search_by_id role for search-related applications. See Search Appliance Roles for more information.

11. Click Add.

A notification appears confirming that the user has been added.

Clicking arrow_back returns you to the list of users without saving the changes.

Note that only one user can be added at a time unless the Add via CSV wizard is used.

Password Requirements

Basic password requirements are found below; however, the rules regarding passwords may vary depending on how your organization configured password requirements:

• Must contain at least 12 characters

• Must contain at least 1 uppercase letter, 1 lowercase letter, 1 number, and 1 special character

• Expires after 60 days

• Cannot reuse the past 24 passwords

• Cannot contain the username

• Cannot contain the email address

Click on image to zoom

Edit a Normal User

Normal users are identified by the person icon, person. Edit a user's groups, lock or unlock a user, disable or enable the user, and reset a user's password in the User Details screen.

Clicking on any user opens a pane on the right to access the editing options.

Click on image to zoom

Edit Full Name

On occasion, an administrator may need to change the full name of a user. This may be because of a spelling error or a name change. To do so, follow the steps below:

1. Click edit next to the user's name.

2. Make the change.

3. Click Update User.

Click on image to zoom

Disable And Enable a User

A disabled account prevents a user from signing in to the system. Users are automatically disabled if they have not signed in to the system after 60 days. An administrator may also disable an account if necessary. Use Disable to differentiate between a user's actions and an administrator's actions. A good example is when an employee is no longer employed, but the administrator wants to keep the username to access audit logs. A message will appear below the Disabled toggle stating why a user is disabled.

Disable a User

To disable a user, follow the steps below:

1. In the navigation menu, click Users.

2. Locate and click the user.

3. Click Disabled in the pane on the right. The toggle changes from faded to dark.

The Disabled column now contains a check next to the user.

Enable a User

To enable a user, follow the steps below:

1. In the navigation menu, click Users.

2. Locate and click on the user.

3. Click Disabled in the right pane. The toggle changes from dark to faded.

Click on image to zoom

Unlock a User

A locked account prevents a user from signing in to the system and from resetting his or her password. An account becomes locked when a user incorrectly keys in the password six times consecutively.

Unlock a User

To unlock a user, follow the steps below:

1. In the navigation menu, click Users.

2. Locate and click the user.

3. Click the Locked toggle in the pane on the right. The toggle changes from dark to faded.

The Locked column no longer contains a check next to the user.

Click on image to zoom

Set a Temporary Password

There are times when a user needs his or her password reset before signing in to the server. An administrator can create a temporary password for the user for one-time use only. The user will be required to reset the password the next time they sign in. To set a temporary password, follow the steps below:

1. Click Users in the navigation pane.

2. Select the user you wish to edit.

3. Click Reset Password in the pane on the right.

4. Enter the New password.

5. Retype the password in Confirm.

6. Click Reset.

The Password Expired column contains a check on the Users screen for the following two reasons:

• The user hasn’t signed in after an administrator set the password.

• The configured amount of time has passed since the user last reset their password.

Click on image to zoom

Manage Groups

There are times when a specific group of users should have access to the same information. Users can be added to preconfigured default Roles or to customer-created groups. Groups are used in security collections and system sets and can limit the information a specific set of users can view.

1. Click Users in the navigation pane.

2. Select the user you wish to edit.

3. Click Manage Groups.

4. Move the groups that the user should be assigned to from the left column to the right column:

   • Click add by the group name to move one group to the user.

   • Click fast_forward to move all the groups to the user.

5. Click Save.

Remove a user from groups by one of the following means:

• Click close next to the group in the right column.

• Click fast_rewind to remove all from the right column to the left.

• Click Reset to return all groups to their original position.

Click on image to zoom.

Create an SSO User

IMAT versions prior to 9.0 do not have this capability.

Single Sign-On (SSO) allows users to sign in to multiple applications with one set of credentials. SSO can be used across websites, applications, and services.

Note that the only difference between a normal user and an SSO user is how they sign in to the system.

To allow an SSO user to sign in, ensure the username entered matches the one in the SSO system and that you provide the correct email. The user will be asked to verify their email before they can sign in for the first time.

The user's full name and email are automatically updated whenever the user signs in, based on the information stored in the SSO system.

1. In the navigation pane, click Users.

2. Click add_circle found in the top-right corner of the Users screen. This opens the Add User screen.

3. Choose SSO as the Account Type.

4. In the Username field, type the sign-in name for the user. Usernames can contain the following characters:

   • numbers

   • letters (uppercase and lowercase)

   • _ (underscore)

   • - (hyphen)

   • . (period)

   • * (asterisk)

   • @ (at sign)

5. Type the First name.

6. Enter the Last name.

7. Enter an Email address.

8. In the Available Groups area, click on the groups to add the user to. The list of groups the user is added to is found in Added Groups. Different IMAT applications require different access roles, but all users must have either the searchappliance_search or the searchappliance_search_by_id role for search-related applications. See Search Appliance Roles for more information.

9. Click Add.

A notification appears confirming that the user has been added.

Clicking arrow_back returns you to the list of users without saving the changes.

Click on image to zoom

Edit an SSO User

SSO users are easily identifiable by the domain icon, domain, next to their usernames. You may edit the following items for an SSO user: full name, email, enable or disable an account, manage groups, or delete.

Click edit next to the Full Name or Email fields to edit.

Click on image to zoom

Create a Script User

IMAT versions before 9.0 do not have this capability.

Script users are intended for users to access the system programmatically with access tokens instead of passwords. A script user account won't automatically lock due to inactivity because it only interacts with IMAT's APIs.

One use case is for health exchange/CCD on-demand, where the third-party partner is given an account with an associated access token. It isn't used for end-user sign-in, but rather for API requests to trigger between the systems.

Another example is if extra processing needs to happen around set generation beyond the default behavior. A script is written to handle the extra needs and uses a token to query IMAT APIs as needed.

Create a script user with the following steps:

1. In the navigation pane, click Users.

2. Click add_circle found in the top-right corner of the Users screen. This opens the Add User screen.

3. Choose Script from the options provided.

4. In the Username field, type the sign-in name for the user. Usernames can contain the following characters:

   • numbers

   • letters (uppercase and lowercase)

   • _ (underscore)

   • - (hyphen)

   • . (period)

   • * (asterisk)

   • @ (at sign)

5. Enter a Description. The description should be added to help you remember why the user needs the account.

6. Add an Available Group. Different IMAT applications require different access roles, but all users must have either the searchappliance_search or the searchappliance_search_by_id role for search-related applications. See Search Appliance Roles for more information.

7. Click Add.

Click on image to zoom.

Edit a Script User

Script users are easily identifiable by the computer icon, computer, next to their usernames. You may edit the following items for a script user: description, enable or disable an account, manage groups, manage Access Tokens, or delete.

To edit the description, click edit and retype the description before clicking Update Description.

Add Users by CSV

It is possible to add multiple users at one time using CSV data.

Customizing individual groups per user is not possible with this feature, so create a batch of users that should be included in the same group or groups.

1. From the Admin: Users screen, click more_vert.

2. Select note_add Add via CSV.

3. Choose the Account Type: Normal users or SSO users.

4. Click Select File.

5. Select the CSV file to upload. A message will appear stating there are no errors in the data. If an error is found, a table appears with the rows of data and the identified error. Fix the errors in the file and click Select File again.

6. Click Next when there are no errors in the file.

7. Choose any applicable groups. Groups cannot be created from this screen, so they must be created beforehand. Click Next.

8. Review the data, then click Create Users.

9. The status column indicates if the user was successfully uploaded. The most common reasons for failure are a duplicated username or a password does not meet the minimum requirements.

10. Click Close after reviewing the results.

Click on the image to zoom

Delete a User

We recommend that you disable rather than delete users if they’ve signed in to and used their account. Deleting a user removes all auditing information and can affect other aspects like access tokens, sharing, etc. However, if you have determined that deleting a user will have no negative effects, you may delete a user by following the steps below:

1. Click Users in the navigation pane.

2. Locate and click on the user.

3. Click delete Delete User in the details pane on the right.

4. Confirm you would like to delete the user by typing the username on the line provided.

5. Click Delete.

The Delete option may not be available if your organization has disabled it.

Click on image to zoom

Download a List of Users

It is possible to download the list of users as a CSV file:

1. Click more_vert.

2. Click file_download Download list as CSV.