Dash Enterprise
User administration
Using Dash with MDMThe web dashboardConfiguring DashConfiguration optionsAnalyticsDash web appUser administration

User Administration

Dash Enterprise's user administration features allow you to control who has access to the web management dashboard, and the actions they can perform. You can create users directly in the dashboard, or integrate Dash Enterprise with an identity provider for single sign-on.

Overview

The Dash Enterprise User Management overview page

The user overview shows all the user accounts that exist in your organization. For each user, you can see their current status and level of access, and also perform the following actions:

  • Editing the user to change their name or roles
  • Enabling or disabling the user's sign-in access
  • Resetting a user's two-factor authentication (for users who have two-factor authentication enabled on their account)
  • Deleting the user account
  • Resending the user's invitation email (only available for users that have not yet completed the signup process)

Adding users

Adding a new user in Dash Enterprise

To add a new user, click the New user button in the toolbar. You'll need to enter the user's first name and email address, and decide whether to require two-factor authentication (2FA) for their account. You can also select the roles you want to assign to the user. The available roles are:

  • User manager - can access the user administration function in the dashboard, and has the ability to add, edit, and remove users, as well as set their roles.
  • Configuration manager - can create, edit and delete device groups and their device configurations.
  • Device manager - can activate and deactivate Dash display devices and assign them to existing device groups

Roles are additive, meaning that assigning multiple roles to a user will grant them all the associated permissions. If a user is not assigned any role, they will have read-only access to the dashboard.

Clicking the Invite button will send the user a welcome email containing login instructions and a temporary password. To activate their account, the user must sign in within 4 days and set a permanent password.

When the invite email is sent, the user's account status will show as Invited. Once they sign in and choose a permanent password, their status will change to Active. If the user does not sign in within 4 days, you can resend the welcome email by clicking the Resend button in the users table.

Editing users

To edit a user, select the user in the table and click the Edit button in the toolbar. You can change the user's display name as well as their roles.

Note that it can take up to 1 hour for role changes to take effect. The user can refresh their roles immediately by signing out of the dashboard and signing in again.

Resetting a user's two-factor authentication

If a user has lost their authenticator device or is otherwise unable to enter their code when signing in, you can disable two-factor authentication (2FA) on their account to allow them to access the dashboard. Simply click Reset in the 2FA status column of the user table, and they will be able to sign in.

If the user's account is set to require 2FA, they'll be prompted to set up a new authenticator when they sign in. If 2FA is optional for their account, they can set it up themselves from the account details menu.

Disabling access and deleting accounts

There are two ways to disable a user's access to the dashboard:

  • Disable account access - To temporarily disable a user's access, click the Disable button in the Account Access column of the users table. This action keeps the account in the system but removes the user's ability to sign in. It is useful for temporarily restricting access.
  • Delete the account - To permanently delete a user's account, click the trash can icon in the users table. This action will remove the account from the system permanently.

Note that a user cannot disable or delete their own account. A user account can only be deleted by another user with the User manager role.

Single Sign-on (SSO)

Dash Enterprise can be configured to connect to your corporate identity provider (IDP) using either SAML 2.0 or OpenID Connect. If you have a Dash Enterprise subscription and would like to enable SSO on your account, please contact Dash support. To set up a SSO integration, click Set up single sign-on (SSO) in the main toolbar, and select the type of SSO integration you would like to set up.

SAML 2.0

Configure your IDP using the values provided in the setup dialog. Once your IDP is configured, you can pass the SAML metadata document to Dash Enterprise either by entering a URL or by uploading the document directly. You can optionally require that SAML assertions from your IDP are signed and/or sign SAML requests from Dash Enterprise to your IDP.

If you choose to enable signing, the necessary certificates will be available after you create the SSO configuration, so just save the configuration then click "Edit SSO Configuration" to retrieve them.

User attributes

Dash Enterprise requires you to specify the user attributes that contain the user's first name and email address. You can specify them in the format you use in your IDP. For example, you could enter emailAddress if the attribute is of the Basic type, or http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress if the attribute is of the URI type.

Default permissions

Dash Enterprise will assign default permissions to each user when they first sign in. You can either specify the permissions that will be applied, or you can specify SAML user attributes that will be used to set the permissions for each user. Configure your IDP so that the attributes have the value 'true' if you would like the user to have the given permission.

If you choose to specify the default permissions, they will be set once (when the user first signs in) and can then be modified by editing their account from the users table. If you set permissions from SAML attributes, the permissions cannot be edited from the web dashboard, but will be automatically updated each time the user signs in.

Open ID Connect (OIDC)

Configure your IDP with the scopes and redirect URI provided in the setup dialog. Once your IDP is configured, enter the domain of your IDP's OpenID configuration document. For example, if the document is located at https://yourdomain.provider.com/.well-known/openid-configuration then enter https://yourdomain.provider.com

User attributes

Dash Enterprise requires you to specify the user attributes that contain the user's first name and email address. If you do not know the request method or field names, leave them at their default values.

Default permissions

Dash Enterprise will assign default permissions to each user when they first sign in. The permissions you select will be applied to each user when they first sign in. Once they have signed in, you can change the user's permissions by editing their account from the users table.