Skip to Content
Admin guidesUsers, teams, and permissions

Users, teams, and permissions

ELM uses a granular permission model. Users are granted permissions directly or through teams, and system administrators bypass all checks.

Users

The Users administration page listing local, LDAP, and SAML users

Each user has:

  • A username and email.
  • A type: local (password stored in ELM), ldap, or saml (managed by your directory - see Authentication).
  • An active flag and last login time.
  • System admin status (grants all permissions), or a set of granted permissions and team memberships.

Administrators can create, edit, and deactivate local users, assign permissions, and add users to teams.

Teams

Teams group users so permissions can be granted in bulk.

The Teams administration page

Each team can:

  • Contain any number of users.
  • Be granted a set of permissions that all members inherit.
  • Be mapped to an LDAP group and/or a SAML group - users who belong to that directory group are automatically added to the team when they sign in.

Permissions

Permissions are predefined and grouped by feature area:

PermissionGrants
sources.viewView sources.
sources.manageCreate, edit, sync, and delete sources.
content_views.viewView content views.
content_views.manageCreate, edit, compose, and roll back content views.
hosts.viewView hosts and host groups.
hosts.manageManage hosts, groups, and provisioning.
kickstarts.viewView kickstarts.
kickstarts.manageManage kickstarts and credentials.

A user's effective permissions are the union of their direct grants and the grants of every team they belong to.

System administrators bypass these checks and can access everything. Administration areas - Settings, Users, Teams, and the Audit log - are available to system administrators only.

Audit log

The audit log (administrators only) records data-modifying actions across ELM so you can see who changed what and when.

The Audit Log showing timestamped user actions and affected resources

Logged actions include, among others:

  • Creating, updating, and deleting users and teams.
  • Syncing sources and composing content views.
  • Uploading packages.
  • Flagging hosts for provisioning and assigning content.
  • Syncing the Depot catalog and launching Ascender jobs.
  • Changing settings.

Each entry records the timestamp, the acting user, the action, the affected resource, and any relevant details. The log is paginated for browsing large histories.

  • Configure directory-based sign-in and group mapping in Authentication.
AuthenticationIntegrations