More Granular control of user permissions on InControl2

Product Discussion Feature Requests
1

I would like to have more granular control.

EX:

I have users that are helpdesk that need the ability to remote into the device, change it’s tags and move from one group to another if needed.

However, this person does not, and ideally wouldn’t, have the option to remove devices from InControl2.

Ideally it would also log when they make changes to the tags.

2

Hi @jbierwiler,

There is a type of user which would meet the majority of your requirements - Group Admin.

This account can:-

  • Add Devices

  • Edit Devices, including tags, notes, changing the device name, etc

  • Move Devices (to other Groups the user has access to only - from Release 2.8)

  • Remote Web Admin to access the Device GUI

  • Remove Devices from InControl

However, all of their actions are recorded in the Organization Operational Log.

Below is a log to show the information provided:-

image
image1821×774 110 KB

Here is a summary of the user roles and an explanation of their access, etc:-

image
image356×652 17.2 KB

I hope this helps,

Steve

2 Likes
3

Bumping this. Any chance someone from Peplink could comment on adding more granular permissions?

4

I brought this up alongside Erik a few days ago with Peplink. Hopefully we see this move forward :slight_smile:

3 Likes
5

Good to know! Looking forward to saying hi in San Ant :slight_smile:

6

Bumping this as well.

The ability for group admins to remove devices from our IC2 org makes it hard to demo devices and the portal to customers while trusting they won’t remove the device from our org.

7

And also the ability to ONLY allow SSO login. When we create a user, we can have:

  • SSO & local password
  • Only local password

but we cant have only SSO (which is what we want for 90% of our accounts i.e. all but the break glass/emergency access ones)

1 Like
8

agreed. and real SSO, not social login stuff. real SSO since we can enforce things like country restrictions, device-bound FIDO2 authentication (not a soft passkey), etc.

1 Like
9

In InControl 2.15, the single checkbox option in the Organization Settings will be split into 5, like this:

Only allow users authenticated with:
Password, except (space delimited usernames):
[____________________]
Google ID
Entra ID
Apple ID
The OIDC provider for your domain (if any)

The exception list is the break glass. Will it work for you?

For the FIDO2 support, the Peplink ID team will look into the feasibility.