107 lines
3.6 KiB
Markdown
107 lines
3.6 KiB
Markdown
# User Management & Roles Guide
|
|
|
|
## Overview
|
|
|
|
The STEAM Security Dashboard uses role-based access control with four user groups. Only administrators can manage users. All user operations are logged in the audit trail.
|
|
|
|
## User Groups
|
|
|
|
| Group | Access Level | Description |
|
|
|-------|-------------|-------------|
|
|
| Admin | Full access | All operations including user management, delete, audit log |
|
|
| Standard_User | Operational access | Create, edit, limited delete (own resources only), exports |
|
|
| Leadership | Read-only + exports | View all data, download CSV/XLSX exports |
|
|
| Read_Only | View only | Read-only access to all pages, no modifications |
|
|
|
|
## Permission Matrix
|
|
|
|
| Action | Admin | Standard_User | Leadership | Read_Only |
|
|
|--------|-------|---------------|------------|-----------|
|
|
| View findings/CVEs | Yes | Yes | Yes | Yes |
|
|
| Sync Ivanti data | Yes | Yes | No | No |
|
|
| Edit hostname/DNS overrides | Yes | Yes | No | No |
|
|
| Edit notes | Yes | Yes | No | No |
|
|
| Add to queue | Yes | Yes | No | No |
|
|
| Create FP workflows | Yes | Yes | No | No |
|
|
| Edit FP submissions | Yes | Yes | No | No |
|
|
| Upload compliance reports | Yes | Yes | No | No |
|
|
| Add CVEs | Yes | Yes | No | No |
|
|
| Upload documents | Yes | Yes | No | No |
|
|
| Export CSV/XLSX | Yes | Yes | Yes | No |
|
|
| Delete CVEs/documents | Yes | Own only | No | No |
|
|
| Manage users | Yes | No | No | No |
|
|
| View audit log | Yes | No | No | No |
|
|
|
|
## Managing Users (Admin Only)
|
|
|
|
### Accessing User Management
|
|
1. Click the user icon in the top navigation bar
|
|
2. Select "User Management" from the menu
|
|
3. The user list shows all accounts with their group, status, and last login
|
|
|
|
### Creating a New User
|
|
1. Click "Add User"
|
|
2. Fill in the required fields:
|
|
- **Username** — must be unique
|
|
- **Email** — user's email address
|
|
- **Password** — initial password (user should change on first login)
|
|
- **Group** — select from Admin, Standard_User, Leadership, or Read_Only
|
|
3. Click Save
|
|
|
|
New users default to Read_Only if no group is specified.
|
|
|
|
### Editing a User
|
|
1. Click the edit icon on the user row
|
|
2. Modify username, email, or group
|
|
3. Optionally set a new password (leave blank to keep current)
|
|
4. Click Save
|
|
|
|
### Changing User Groups
|
|
When changing a user's group, a confirmation dialog appears. Extra warnings are shown when:
|
|
- Removing Admin privileges from a user
|
|
- Upgrading a user to Admin
|
|
|
|
Group changes are logged separately in the audit trail with the previous and new group recorded.
|
|
|
|
### Deactivating Users
|
|
Users can be deactivated rather than deleted. Deactivated users cannot log in but their data and audit history are preserved.
|
|
|
|
## Authentication
|
|
|
|
- Sessions use httpOnly cookies with 24-hour expiry
|
|
- Passwords are hashed with bcryptjs
|
|
- All API endpoints (except login) require a valid session
|
|
- Failed login attempts are not rate-limited at the application level
|
|
|
|
## Audit Log
|
|
|
|
The audit log records all significant actions in the dashboard. Only admins can view it.
|
|
|
|
### What's Logged
|
|
- User creation, updates, group changes, deletion
|
|
- CVE creation, updates, deletion
|
|
- Document uploads and deletions
|
|
- Ivanti sync operations
|
|
- FP workflow submissions and edits
|
|
- Queue operations
|
|
- Compliance uploads
|
|
- Login/logout events
|
|
|
|
### Audit Entry Fields
|
|
Each entry includes:
|
|
- Timestamp
|
|
- User who performed the action
|
|
- Action type (e.g., user_create, ivanti_fp_workflow_created)
|
|
- Entity type and ID
|
|
- Details (JSON with specifics of what changed)
|
|
- IP address
|
|
|
|
## Default Admin Account
|
|
|
|
On first setup (`node setup.js`), a default admin account is created:
|
|
- Username: `admin`
|
|
- Password: set during setup
|
|
- Group: `Admin`
|
|
|
|
Change the default password immediately after first login.
|