The Maintain Users section enables system administrators to set up and maintain user accounts, passwords, and associated application privileges. This section can only be accessed by users who have been granted the "MaintainUsers" system privilege—a privilege typically reserved for system administrators.
By default, all xTuple ERP user records are integrated with the user records on the PostgreSQL server instance where the xTuple ERP database is running. This integration makes for flexible system administration. Several of the user access options available to system administrators are described here: Section 13.1, “Database Information”.
We recommend that you restrict access to this section to a limited number of people. The following screen will appear when you select the "Maintain Users" option:
The "Maintain Users" screen displays information on all existing users, including username, proper name, and status. To include inactive users in the display, select the "Show Inactive Users" option.
To the far right of the screen, the following buttons are available:
- CLOSE
Closes the screen, returning you to the application desktop.
Runs the report associated with this screen.
- NEW
Opens screen for creating a new user.
- EDIT
Enables you to edit highlighted users. The edit screen is the same as that for creating a new user—except that when editing, the fields will contain user information. Double-clicking on a user will also bring you to the editing screen.
To create a new user, select the NEW button. The following screen will appear:
When creating a new user, you are presented with the following options:
- Username
Enter a unique username to clearly distinguish the new user from existing users. The username is case-sensitive. This is a required field.
- Active
Select to mark the user as Active. Not selecting marks the user as Inactive. Users cannot be deleted from the system, but marking them Inactive prevents them from logging into the application.
- Proper Name
Enter the user's first name and last name (e.g., John Smith).
- Initials
Enter the user's initials.
- Password
User passwords are established to ensure application and system security. Passwords are case-sensitive. As you can see in the example, this field does not display the values entered on the screen. Instead, individual keystrokes are replaced by asterisks (*) to protect the password from being viewed. Once the user's password is entered, it can only be reset by an system administrator who must overwrite the existing password.
- Verify
Verify the accuracy of the user's password by retyping it in this field. Again, individual keystrokes will be replaced by asterisks (*) to protect the password from being viewed.
- Dept.
Select a Department to associate with the specified user. This is an optional setting.
- Shift
Select a Shift to associate with the specified user. This is an optional setting.
- Locale
Select one of the available Locales. Use the
Defaultoption if you want the operating system to determine the correct Locale for the user. Locale settings affect how information is formatted and displayed on a user's screen. Only users who have been granted the "MaintainLocales" privilege can define and maintain Locale settings. For more information on Locales and Locale settings, see Section 13.11, “Locales”.- Employee
If the user is an Employee, then the Employee Code will be displayed here. The link between the user and Employee records will be made automatically if the username matches the Employee Code.
- Purchasing Agent
Select if the users is authorized to make purchases. Not selecting means the user is not authorized to make purchases.
- Can Create System Users
Select if the user is authorized to create new users. Not selecting means the user is not authorized to create new users.
Note
System administrators are able to assign and/or revoke privileges on a module-by-module basis. The application provides granular security settings for each module, down to the submenu level.
- Disable Export Display Contents
Select to prevent user from exporting display contents. The "Export Contents" option can be found on right-click menus throughout the application. If selected, the user will be blocked from using the "Export Contents" option.
- Use Enhanced Authentication
Select to require users to use enhanced authentication when they log in to the application. Enhanced authentication adds a layer to the authentication process used to log in to the system. When this feature is turned on, user passwords are stored in the database in a modified form. The end result is that users may only log in to the database using the xTuple Client. If users try to access the database using a tool other than an xTuple application, they will not be able to connect. User passwords entered when logging in via the xTuple Client will not be recognized if the xTuple Client is not used. If enhanced authentication is specified for a user, that user must also select the "Use Enhanced Authentication" flag in their log in options. If enhanced authentication is not specified, users will be permitted to log in to the database using database tools other than the xTuple Client.
Note
The enhanced authentication option will only affect users whose passwords are created or updated after the option is enabled/disabled. Legacy users will not be affected if the option is not used. Legacy users may continue logging in as before this feature was implemented.
- May only use Shop Floor Workbench
Select if you want the user to have access only to the Shop Floor Workbench—and to no other screens. If selected, the Shop Floor Workbench will be the only screen the user will have access to when they log in to the database. The log in screen for this user will be the same as for all users. However, once logged in, the user will only be able to see and use the Shop Floor Workbench. This option will override any other privileges which may have been assigned previously to the user.
- Module
Select an individual module to assign privileges for that module. Assign privileges to the user on a module-by-module basis. Select one module, assign the appropriate privileges, and then repeat for each subsequent module the user will need access to. All application modules are included in the list.
Tip
You can dramatically speed up the process of adding new users by adding privileges by user group.
Note
If individual user privileges appear to be disabled, that means the user is assigned to a user group. The only way to change individual privileges in this case is to remove the user from the group.
- Available Privileges
Select appropriate privileges from list of available privileges. The privileges listed in this column represent the full range of privileges available for the specified module. The list of available privileges will change as different modules are specified. To grant privileges to a user, highlight an available privilege and then click the ADD button. The highlighted privilege will be added to the user's list of granted privileges. Double-clicking on a privilege will also move it to the granted privileges column. You can grant all privileges for a specified module by clicking on the ADD ALL button.
- Granted Privileges
Displays granted privileges for the specified user. To remove a user's granted privileges for a specified module, highlight a granted privilege and then click the REVOKE button. The highlighted privilege will be removed from the user's list of granted privileges. Double-clicking on a privilege will also remove it from the granted privileges column. You can remove all granted privileges for a specified module by clicking on the REVOKE ALL button.
The following buttons are located between the Available Privileges and Granted Privileges columns:
- ADD->
Highlight a specific privilege in the available privileges column, then select this button to transfer the privilege to the granted privileges column. Double-clicking on an available privilege will also transfer it to the granted privileges column.
- ADD ALL->>
Select this button to automatically transfer all available privileges to the granted privileges column.
- <-REVOKE
Highlight a specific privilege in the granted privileges column, then select this button to remove the privilege from the granted privileges column. Double-clicking on a granted privilege will also remove it from the granted privileges column.
- <<-REVOKE ALL
Select this button to automatically remove all granted privileges from the granted privileges column.
While you may assign individual privileges by user, you also have the option to add user privileges by user group. Adding user privileges by user group can dramatically speed up the process of adding new users. You can learn more about user groups here Section 9, “Maintain Groups”. To add user group privileges to a user profile, select the "Groups" tab, as shown in the following screen:
When adding user group privileges to a user profile, you are presented with the following options:
- Available Groups
Select an available user group from the list. To grant user group privileges to a user, highlight an available group and then click the ADD button. The highlighted group will be added to the user's list of granted groups. Double-clicking on a group will also move it to the granted groups column.
- Granted Groups
Displays granted groups for the specified user. To remove a granted group from the user, highlight a granted group and then click the REVOKE button. The highlighted group will be removed from the user's list of granted groups. Double-clicking on a group will also remove it from the granted groups column.
The following buttons are located between the Available Privileges and Granted Privileges columns:
- ADD->
Highlight a specific group in the available groups column, then select this button to transfer the group to the granted groups column. Double-clicking on an available group will also transfer it to the granted groups column.
- <-REVOKE
Highlight a specific group in the granted groups column, then select this button to remove the group from the granted groups column. Double-clicking on a granted group will also remove it from the granted groups column.
To the far right of the screen, the following buttons are available:
- SAVE
Saves the specified user's information and adds it to the list of registered users.
- CANCEL
Closes the screen without saving any changes, returning you to the previous screen.
Tip
Remember to select the ADD button when you have finished entering a user's information.
Multiple Site installations have the option of defining user site security. User site security provides a method for restricting a user to a single or multiple Sites. All of the screens in the application will honor this restriction. On the multiple site documents, such as Purchase Orders and Sales Orders, the user will be able to view restricted Sites, however, they will not be able to edit restricted Sites. To add user site security to a user profile, select the "Sites" tab, as shown in the following screen:
When adding user site security to a user profile, you are presented with the following options:
- Grant Access to all Sites
Select this option if the user has full unrestricted access to all Sites defined in the application.
- Grand Access only to Selected Sites
Select this option if the user has restricted access to the Sites defined in the application.
- Available Sites
Select an available Site from the list. To grant access privileges to a user, highlight an available Site and then click the ADD button. The highlighted Site will be added to the user's list of granted Sites. Double-clicking on a Site will also move it to the granted Sites column.
- Granted Sites
Displays granted Sites for the specified user. To remove a granted Site from the user, highlight a granted Site and then click the REVOKE button. The highlighted Site will be removed from the user's list of granted Sites. Double-clicking on a Site will also remove it from the granted Sites column.
The following buttons are located between the Available Sites and Granted Sites columns:
- ADD->
Highlight a specific Site in the available Sites column, then select this button to transfer the Site to the granted Sites column. Double-clicking on an available Site will also transfer it to the granted Sites column.
- <-REVOKE
Highlight a specific Site in the granted Sites column, then select this button to remove the Site from the granted Sites column. Double-clicking on a granted Site will also remove it from the granted Sites column.