> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://mediakind.ferndocs.com/beam/system-admin/security/user-management/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://mediakind.ferndocs.com/_mcp/server. # User management ## Manage users Administrators have rights to create users and assign groups. User groups reflect different user roles with specific permissions. Permissions authorize access to applications, menus and features. Menu options depend on your processing type and product installation. ### User groups A user group is a set of access rights and permissions. Permissions authorize users to either display or edit configurations. Users are assigned to at least one user group. A user can be assigned to multiple groups. New users are automatically assigned to the **Monitoring** group. ### User group permissions There are 3 default user groups. Permissions are either Read (R), Write (W), or Read and Write (R/W). Yes means the user group can carry out the action, but may be limited to specific options. User group options depend on your processing type and product installation. | | Admin | Configuration | Monitoring | API | | ---------------- | ----- | ------------- | ---------- | --- | | Services | R/W | R/W | R | R/W | | Servers | R/W | R/W | R | R/W | | Templates | R/W | R/W | R | R/W | | Failover | R/W | R/W | R | R/W | | Alarms and Stats | R | R | R | R | | Settings | R/W | N/A | N/A | R/W | | Restore | Yes | Yes | No | R/W | | Backup | Yes | Yes | Yes | R/W | | User Management | R+W | N/A | N/A | N/A | #### Failover default user rights per user group Admin users have all rights. **Monitoring** users can (based on Failover control privilege): * View groups * View group details * View failover audit history * Trigger manual failover * Trigger a manual revert * Trigger a maintenance mode **Configuration** users (based on Failover configuration privilege): * View groups * View group details * Trigger manual failover * Trigger a manual revert * Trigger a maintenance mode * Create groups * Edit groups * Delete groups * Edit default failover mode * Edit timeout period | Group | Services | Servers | Templates | System Center | Restore | Backup | User Management | | ------------- | -------- | ------- | --------- | ------------- | ------- | ------ | --------------- | | Admin | R+W | R+W | R+W | R+W | Yes | Yes | R+W | | Monitoring | R | R | R | N/A | No | Yes | N/A | | Configuration | R+W | R+W | R+W | N/A | Yes | Yes | N/A | ### Display the list of users * Click in the upper right corner of the window. * Select User Management. The User Management Administration page displays. * Select Users. The list of users displays. You can scroll to the end of the list to display the total number of users. ### Add a new group * Click in the upper right corner of the window. * Select User Management. The User Management Administration page displays. * Select Groups. The list of groups displays. You can scroll to the end of the list to display the total number of groups. * Select Add Group. You are prompted to enter group information. * Enter the Name and define the Permissions for the group, as shown in the example below: * Select a Save option. The new Group appears in the list of groups. The group permissions for **Monitoring**, **Configuration**, **Admin** and **API** are listed below (permissions for these groups cannot be modified by the user): **Monitoring**: The users with **Monitoring** access can perform the following actions in the code: * Access the GUI * Backup databases * Manually perform a revert and failover of servers **Configuration**: The users with **Configuration** access can perform the following actions in the code, in addition to the permissions described in the **Monitoring** group above: * Restore databases * Create, edit and delete services * Create, edit and delete templates * Create and edit servers * Modify licenses * Create, edit and delete failover groups * Access settings * Modify SNMP configurations * Schedule jobs on services * Edit alarm overrides * Generate catalogs, outputs and assets **Admin**: The users with **Admin** privileges can perform the following actions in the code, in addition to the permissions described in the **Monitoring**, **Configuration** and **API** groups above (meaning, these users have the rights to perform everything in the system): * Modify external links and general settings * Delete licenses and servers * Reboot Servers **API**: The users with **API** privileges have the right to access the API. ### Create a new user The Controller is a single access point for products. Administrators manage users, groups and permissions from the system center. * Display users. * Select Add User. You are prompted to enter User information. * Enter the User information. Username * Password * Select a Save option. * Assign a user to a group to manage user access rights and permissions. By default, new users are assigned to the Monitoring group. An Admin user can edit or create other Admin users and profiles, including passwords and permissions. ### Assign a user to a group Groups are a set of access rights and permissions. Permissions authorize users to either display or edit configurations. Give a user access rights by assigning the user to a group. * Display users. * Click the user in the list to display user information and permissions. * Scroll to Permissions then use the arrows to add the group to the list of Chosen groups. You can add multiple groups, or click Choose all to assign the user to all available groups. * Click Save. ### Link LDAP or Active Directory The MediaKind Controller can be linked with an external server (LDAP or ActiveDirectory) to identify and authenticate users. If activated, the authentication page displays before granting access to the **Home** page. The LDAP connection parameters are defined in a dedicated configuration file. If using LDAP, the MediaKind Controller neither stores nor manages user passwords that are managed by the external LDAP server. Users defined on the external server can coexist with locally defined users. * See LDAP configuration for LDAP configuration procedures. * Follow the steps. When users are first installed from the LDAP or ActiveDirectory server, they are by default, automatically assigned to the Monitoring group. The default group can be configured. Alternatively, LDAP can be configured to assign groups based on LDAP group membership. Administrators can [edit user groups](#editing-user-information) to [manage permissions](#user-group-permissions) and access rights. ### Editing user information * Display users. * Select a User. * Edit the user information: Username * Password * Personal information * Permissions * Select a save option to continue or exit. An Admin user can edit or create other Admin users and profiles, including passwords and permissions. ### Edit a user password Any user can edit their password, but only users with admin or configuration permissions can edit passwords for other users. * Display the list of users in the System Center. * Click the current Admin user from the list to edit. * Click the this form link to change the password. * Edit user profile settings then click Save. ## Save options for user management | Save option | Result | | --------------------- | ------------------------------------------------------------------------------------- | | Save\*\* | The user is added to the list. | | Save and continue\*\* | Additional user information displays (groups and permissions). | | Save and add another | User is added to the list and the add user page is refreshed to add another new user. |