Manage administrators
The OneWelcome Identity Platform Delegation tool for administrators lets you assign the right amount of autonomy and responsibility to each administrator.
Tenants and administrator roles
If you have multiple tenants, such as a production instance and a non-production instance, you can assign roles specific to each tenant.
Administrator roles
Roles represent the rights or privileges that a user has in the OneWelcome Identity Platform console.
Supported administrator roles
-
access_read: This role provides a read-only overview of applications, scopes, mobile apps, and other features described under IDAAS Core - Access.
-
access_write: This role allows users to create and manage applications, scopes, mobile apps, and other features described under IDAAS Core - Access.
-
access_user_management: This role provides access to the user management features on the Access admin console, which allow administrators to manage users for the mobile identity module.
-
role_broker_read: This role provides a read-only overview of external identity providers (IDP) that are configured in the identity broker.
-
role_broker_write: This role allows users to create and manage external IDPs that are configured in the identity broker.
If you see only a subset of these roles, it is possible that your tenant doesn't have these applications enabled. Contact customer support to ask if these applications can be enabled for your organization.
Administrator permissions
A permission represents the rights or privileges that a person has in the delegation tool. If any permissions are assigned to a user, they are marked as a delegated admin, which means they can manage other users.
As a delegated admin, you can assign these permissions to other admins:
-
Invite/remove admins: A user with this permission can invite other admins.
-
Assign permissions to admins: A user with this permission can assign permissions to other users (admins).
-
Assign roles to admins: A user with this permission can assign roles to other users (admins).
If you don't see a specific permission, it means that you don't have this permission yourself. You can only assign permissions that you also possess.
Account status
Admin users can have three different account states:
-
Invited: The user has been invited as an admin but hasn't accepted the invite yet.
-
Activated: The user is an active admin and can log in to a tenant.
-
Blocked: This status can only be assigned by Thales and ensures that a user is unable to log in.
Invite a new administrator
As a delegated admin, you can invite colleagues as admins on the OneWelcome Identity Platform.
-
Log in to the Delegation tool.
-
Select a tenant.
Note
This step is skipped if you have access to only a single tenant.
The Delegation tool lists all the admins for that tenant.
-
In the upper-right corner, select Add admin.
-
On the Add admin dialog box, enter the details for the new admin:
-
Email
If the user exists in the system, the Delegation tool fills the remaining fields.
-
First name and Last name
-
Mobile number: This number is used for two-factor authentication (2FA) purposes.
-
-
Select the Permissions and Roles that you want to assign to the new admin.
-
Select Add admin again.
The Delegation tool sends the user an invitation email.
-
To invite a user to another tenant, in the upper-right corner, select the profile icon and select Change tenant. Repeat the steps to add this user as an admin on this tenant.
Add privileges to an admin
You can add additional permissions and roles to an existing admin.
-
Log in to the Delegation tool.
-
Select a tenant.
Note
This step is skipped if you have access to only a single tenant.
The Delegation tool lists all the admins for that tenant.
-
Select the admin that you want to add privileges to.
A details page opens and displays the tenant memberships that you have in common with the admin.
-
In the Memberships section, find the tenant that you want to change the privileges for, select the menu, and then select Change membership.
-
Select the permissions and roles that you want to add, and then select Save.
Delete an admin from a tenant
-
Log in to the Delegation tool.
-
Select a tenant.
Note
This step is skipped if you have access to only a single tenant.
The Delegation tool lists all the admins for that tenant.
-
Select the delete icon next to the admin that you want to delete.
-
To delete the admin from another tenant, select the profile icon in the upper-right corner, and select Change tenant. Delete the admin from that tenant.
When an admin is deleted from the last tenant, their account is also removed.
