diff --git a/content/en/docs/marketplace/platform-supported-content/modules/administration.md b/content/en/docs/marketplace/platform-supported-content/modules/administration.md index 5b3c797eda6..d66ce304f3e 100644 --- a/content/en/docs/marketplace/platform-supported-content/modules/administration.md +++ b/content/en/docs/marketplace/platform-supported-content/modules/administration.md @@ -7,16 +7,16 @@ description: "Describes the configuration and usage of the Administration module ## Introduction -The [Administration](https://marketplace.mendix.com/link/component/23513) module contains the administration functionality, which allows you to manage local accounts and to view app statistics, such as runtime information, sessions, and schedules events. +The [Administration](https://marketplace.mendix.com/link/component/23513) module contains the administration functionality. It allows you to manage local accounts and view app statistics, such as runtime information, sessions, and scheduled events. ### Features -* Support managing user accounts -* Provide a read-only overview to show the following information: +* Manages user accounts +* Provides a read-only overview that shows the following information: * All active sessions * All scheduled events * All runtime instances -* Support viewing runtime statistics +* Displays runtime statistics ### Dependencies @@ -29,18 +29,98 @@ The [Administration](https://marketplace.mendix.com/link/component/23513) module Follow the instructions in [How to Use Marketplace Content](/appstore/use-content/) to import the Administration module into your app. +## Module Roles and Access Control + +### Overview of Module Roles + +The Administration module provides a set of fine-grained module roles for enhanced control over permissions and access. You can combine these roles to allow only the permissions required for a specific use case. + +* **Administrator** – Allows full management of user accounts: + + * Create new user accounts. + * Delete existing user accounts. + * Read and write access to `FullName` and `Email` of the `Administration.Account` objects. + * Change passwords of other accounts. + +* **User** – Allows the following access levels: + + * Write access to the `FullName` and `Email` attributes of the `Administration.Account` object for the current user. + * Read access to the `FullName` and `Email` attributes of other users’ `Account` objects. + +{{% alert color="warning" %}}This module role has been superseded by granular module roles, which offer improved flexibility and control. Refer to the following user roles for detailed instructions and examples.{{% /alert %}} + +* **ReadOwnDetails** – Allows read access to the `FullName` and `Email` attributes of the `Administration.Account` object for the current user. + +* **EditOwnDetails** – Allows read and write access to the `FullName` and `Email` attributes of the `Administration.Account` object for the current user, where write access inherently includes read access. + +* **EditOwnPassword** – Allows the current user to change their own password. Note that either `ReadOwnDetails` or `EditOwnDetails` is required when applying this module role. + +* **ReadOthersFullName** – Allows read access to the `FullName` attribute of other users’ `Administration.Account` objects. + +* **ReadOthersEmail** – Allows read access to the `Email` attribute of other users’ `Administration.Account` objects. + +{{% alert color="info" %}}The fine-grained module which were just mentioned were introduced in version 4.5.0 of the Administration module. If these roles are not available in your environment, Mendix recommends upgrading to the latest version to benefit from these improvements.{{% /alert %}} + +### Default Access Rules + +**Default rights for new members** are set to **None** for all access rules. + +## Combining Module Roles Depending on Use Case + +You can combine these module roles to configure access to user account data based on the needs of the app. Instead of assigning broad access, select only the module roles required for each app role. + +{{% alert color="info" %}}Users with edit access automatically have read access. Edit permissions therefore include the ability to view and modify data.{{% /alert %}} + +The following examples illustrate common role combinations: + +### Default End-User + +Allows users to read and edit only their own details, and change only their own password. + +* **EditOwnDetails** +* **EditOwnPassword** + +### Read-Only User Profile + +Allows users to read only their own personal details. Profile updates and password management are handled externally through the configured identity provider (IdP) or single sign-on (SSO) solution. + +* **ReadOwnDetails** + +### Users Who Need Visibility of Other Users’ Names + +Required only when users’ full names must be displayed. For example, when using the [Workflow Commons](https://docs.mendix.com/appstore/modules/workflow-commons/) module, users with access to the Task Inbox must be able to view other users’ full names. The **Assignee** column uses this to display who is assigned to each task. + +* **ReadOwnDetails** +* **EditOwnPassword** +* **ReadOthersFullName** + +### User Profile with Email Visibility + +Allows users to view their own personal details, the names of other users, and other users’ email addresses. + +* **ReadOwnDetails** +* **EditOwnPassword** +* **ReadOthersFullName** +* **ReadOthersEmail** + +### Administrative Users + +Allows full management of user accounts. + +* **Administrator** + ## Usage ### Adding the Account Overview Page to the Navigation {#add-account-overview} -On the `Administration.Account_Overview` page, you can view and manage all the accounts in your app. To add the page to the navigation of the app, do as follows: +On the `Administration.Account_Overview` page, you can view and manage all the accounts in your app. To add the page to the app navigation, follow these steps: -1. In App Explorer, open **Navigation**. +1. In **App Explorer**, open **Navigation**. 2. In **Menu**, click **New item**. The **New Menu Item** dialog box opens. 3. Enter a caption. 4. Select an icon. 5. In the **On click** drop-down list, select **Show a page**. The **Select web page** dialog box opens. -6. Find **Account_Overview** using the search box on the top and select it. The **Select web page** dialog box closes. +6. Find **Account_Overview** using the search box at the top and select it. The **Select web page** dialog box closes. 7. Click **OK** to save the settings for the new menu item. If you run the app and log in as a user with the Administrator role, you can see the new page in the navigation. @@ -49,28 +129,28 @@ If you run the app and log in as a user with the Administrator role, you can see 1. Make sure that you [added the account overview page to the navigation](#add-account-overview). -2. Run the app and log in to the app as a user with the Administrator role. +2. Run the app and sign in as a user with the Administrator role. 3. Go to the account overview page. 4. If the new user does not need to consume the published web service of your app, click **New local user** to add the new user. - {{% alert color="info" %}}A local user can only log in to your app using a web browser. Their user name and password cannot be used for authentication to consume a published web service of your app.{{% /alert %}} + {{% alert color="info" %}}A local user can only sign in to your app using a web browser. Their user name and password cannot be used for authentication to consume a published web service of your app.{{% /alert %}} 5. If the new user needs to consume the published web service of your app, click **New web service user** to add the new user. - {{% alert color="info" %}}A web service user cannot log into your app using a web browser. Their user name and password can only be used for authentication to consume a published web service of your app.{{% /alert %}} + {{% alert color="info" %}}A web service user cannot sign in to your app using a web browser. Their user name and password can only be used for authentication to consume a published web service of your app.{{% /alert %}} 6. In the **New Account** dialog box, fill in the user data. 7. Click **Save**. -## Using Supporting Microflows with Mendix SSO {#use-with-mendix-sso} +## Using Supporting Microflows with Mendix SSO {#use-with-mendix-sso} -The [Administration](https://marketplace.mendix.com/link/component/23513) module versions 1.3.X (for example 1.3.2) and 2.1.X (for example 2.1.2) contain a set of microflows to configure Mendix SSO to use **Administration.Account** as the user entity. To use the supporting microflows with Mendix SSO, perform the following steps: +The [Administration](https://marketplace.mendix.com/link/component/23513) module versions 1.3.X (for example, 1.3.2) and 2.1.X (for example, 2.1.2) contain a set of microflows to configure Mendix SSO to use **Administration.Account** as the user entity. To use the supporting microflows with Mendix SSO, follow these steps: 1. Make sure that your app contains the Mendix SSO module. If it does not, import the [Mendix SSO](https://marketplace.mendix.com/link/component/111349) module from the Marketplace. -2. Configure the **MendixSSO_AfterStartup** microflow from the Administration module as the [after startup](/refguide/runtime-tab/#after-startup) microflow. If there is already an after startup microflow, do not replace it, but add the **MendixSSO_AfterStartup** microflow as a sub-microflow in the existing microflow. +2. Configure the **MendixSSO_AfterStartup** microflow from the Administration module as the [after startup](/refguide/runtime-tab/#after-startup) microflow. If there is already an after startup microflow, add the **MendixSSO_AfterStartup** microflow as a sub-microflow in the existing microflow instead of replacing it. {{% alert color="info" %}}If you previously used the Mendix SSO in your application, use the **MendixSSO_MigrateUsersToAccount** microflow to migrate users from the `MendixSSOUser` to the `Administration.Account` specialization. Before executing the migration, carefully read the instructions in the microflow.{{% /alert %}} diff --git a/content/en/docs/marketplace/platform-supported-content/modules/workflow-commons.md b/content/en/docs/marketplace/platform-supported-content/modules/workflow-commons.md index d26fa0c56d5..f59fb8545a8 100644 --- a/content/en/docs/marketplace/platform-supported-content/modules/workflow-commons.md +++ b/content/en/docs/marketplace/platform-supported-content/modules/workflow-commons.md @@ -33,6 +33,7 @@ This module allows Mendix developers with little or no experience in building wo ### Dependencies +* [Administration](https://marketplace.mendix.com/link/component/23513) * [Data Widgets](https://marketplace.mendix.com/link/component/116540) * [Atlas Core](https://marketplace.mendix.com/link/component/117187) * [Atlas Web Content](https://marketplace.mendix.com/link/component/117183) @@ -127,6 +128,8 @@ You can find the following microflows in Workflow Commons: 2. Views personal performance in the **Task Dashboard**. 3. Views workflow progress in the **My Initiated Workflows** overview. 3. Make sure the correct user entity is set in the **App Settings**: open Studio Pro **App Settings** > **Workflows** tab and set **User entity** to *Administration.Account*. When using demo users, you should ensure that the entity of demo users is also set correctly: open **App Security** > **Demo users** tab and set the **Entity** to *Administration.Account* for each of the relevant users. +4. In order to show the assigned users for user tasks, users need read access to the full name of other users. Ensure that either the **Administration.User** or **Administration.ReadOthersFullName** module roles are assigned to all relevant app roles. Otherwise, users may experience incomplete functionality. +5. For Workflow Commons version 3.10.0 and above, we introduced the `DueDateExpirationInDays` constant to configure the period in days for which the workflows or user tasks are to be considered almost due. This option has visual indicators on the **Task Inbox**, **Task Dashboard**, **Default Workflow Admin** and **Workflow Definition View** pages. The default value is set to 2 days. You should set the value based on your business needs. {{% alert color="info" %}} For Workflow Commons versions from 2.1.0 to 3.12.1, you also need to configure the state change microflows in the **App Settings**: @@ -136,7 +139,6 @@ You can find the following microflows in Workflow Commons: For Workflow Commons version 4.0.0 and above, you no longer need to configure the state change microflows. {{% /alert %}} -4. For Workflow Commons version 3.10.0 and above, we introduced the `DueDateExpirationInDays` constant to configure the period in days for which the workflows or user tasks are to be considered almost due with visual indicators in pages **Task Inbox**, **Task Dashboard**, **Default Workflow Admin** and **Workflow Definition View**. The default value is set to 2 days. You should set the value based on your business needs. ### Upgrading from Mendix 10 to Mendix 11 {#upgrade-from-10-to-11}