Keycyte PAM 3.2 · Administrator Guide

User Roles

A user role groups users. It has two uses:

• It restricts its members: a schedule limits when they can sign in and connect, and IP lists limit where they can sign in and connect from.
• It can be authorized in server roles and password roles as a group, so that all its members get the access of those roles.

To open the page, select Roles > User Roles.

Before you begin, make sure that you have the Add permission for User Roles.

Creating a User Role

To create a user role:

1. Select Roles > User Roles.
2. Click Add.
3. Enter a Name, and optionally Tags and a Description.
4. Move the users of the role from Non-Member to Member.
5. Click Save.

After the role is saved, the Linked Command Filters section of the panel lets a MASTER attach command filters to the role. See Command Filters.

The row of each role has the buttons Edit, Schedule, IP List, Members, Owners and Delete. Expand a row to see its members.

Restricting Sign-In Times

A schedule on a user role restricts when its members can sign in and connect. Outside the schedule, sign-in and new connections are refused, and the refusal is recorded in the Access log.

To set a schedule, click Schedule in the row of the role, select None, Daily, Weekly or Custom, fill in the times or dates, and click Save. The schedule types are the same as for server roles; see Server Roles.

If a user is a member of several user roles, every one of their schedules must allow the current time.

Restricting Client IP Addresses

To restrict the addresses that members can sign in and connect from:

1. Click IP List in the row of the role.
2. Under Blacklist Address, add the addresses that are always refused. Under Whitelist Address, add the addresses that are allowed. Type an address and press Enter or click the add button.
3. Click Save.

You can enter an exact address (10.0.0.10), a CIDR range (10.0.0.0/8) or a wildcard (192.168.1.*).

The lists are evaluated as follows:

• An address that matches the blacklist of any of the user’s roles is refused.
• If a role has a whitelist, an address that matches none of its entries is refused.
• A role without a whitelist does not restrict addresses beyond its blacklist.

Changing Members and Owners

To change the members, click Members, move users between Non-Member and Member, and click Save. To remove one member, expand the row and click the delete button next to the user.

To change the owners, click Owners, select the administrator accounts in Change Owners and click Save.

Deleting a User Role

To delete a role, click Delete in its row and confirm. You need the Delete permission for User Roles.