PaperCut NG sets up one administrator account called “admin”. This is the master administrator account, with access to all features, whose password is assigned during the configuration wizard. In large organizations it is likely that administrator level access will need to be granted to more than one person. One solution is to give all persons the master password; however the recommended approach is to assign administrator rights to these individual's network user accounts. The advantages of this approach are:
They can access the administration pages using their own username and password (they don't have to remember another password!).
Different levels of administrator access can be assigned to the user. PaperCut NG includes an advanced Access Control List (ACL) allowing different administrators access to different functions and areas of the application.
Most activity is audited so changes can be sourced to an individual.
Administrator access may be assigned at the group or user level. Assigning admin access to a group is convenient for giving the same permissions to multiple users. Assigning admin access to a user is useful when specific permissions are required. See the following sections for more detail.
Administrative users should login via http://servername:9191/admin
rather than
http://servername:9191/
, http://servername:9191/app
or
http://servername:9191/user
so that they are directed to the correct interface.
PaperCut NG allows different levels of administrator access to be defined via access control list. The access list is presented as a series of checkboxes enabling or disabling access to selected features or application areas.
For security reasons it is advisable to:
Grant the user's own accounts administrator level rights rather than have them use the general
built-in admin
account.
Grant the administrator the minimum level rights need for them to perform their job.
ACL configuration can be complex. Always test that the ACL rights assigned work as expected by asking the administrator to log in and verify that they can access the required program functions.
Assigning administrator access to a group is useful when many users all require access to the same
functionality. For example, the Management
group might be assigned access to
reporting functionality only.
Groups in PaperCut NG are mirrored from the domain / directory server. Before a group can be used, it must be added to PaperCut NG (see the section called “Groups in PaperCut NG” for more information). By default PaperCut NG synchronizes users' group membership with the domain / directory server overnight. If a user has been added to a group in the domain / directory and requires group level admin access on the same day, a manual synchronization should be run. See the section called “User and Group Synchronization” for more information.
Example: assigning the Management
group access to reporting features:
Log in to the system as the built in admin
user.
Ensure that the Management
group has been imported into PaperCut NG (see
the section called “Groups in PaperCut NG” for more information).
Navigate to the
→ page.
In the field titled Assign administrator access to this group:, select the
Management
group from the list, and click .
By default Management
will have access to all features. To change this,
click on the show/hide details link to the right of
Management
's entry.
Deselect all access rights for Management
except
Access reports section. When finished, click
to save the changes.
Test by logging into the administrator interface as a user in the Management
group, and checking that access is allowed just to the Reports section.
The scheduled reports feature can automatically deliver selected reports via email to interested parties. See the section called “Scheduling and Emailing Reports” for more information.
Assigning access to an individual user is suitable when the access rights are specific to that user.
For example, the junior system administrator mary
might be assigned access to all
functionality except the ability to grant administrator rights to other users.
Assigning the user with login name mary
all admin rights except the ability to
grant admin rights to other users:
Log in to the system as the built in admin
user.
Navigate to the
→ page.
Enter mary
into the field titled
Assign administrator access to this user: and click
.
By default mary
will have access to all features. To change this, click on
the show/hide details link to the right of mary
's entry.
Deselect the access right Access admin rights settings for
mary
.
Click on the
button to save the change.Verify that Mary can now log into the administrator interface, but is unable to access the Admin Rights section.
© Copyright 1999-2011. PaperCut Software International Pty Ltd. All rights reserved.