Access control
This section deals with user management: assigning permissions, organizing them into groups, and creating device codes.
Groups
Groups are a logical structure for categorizing users.
Groups contain the following parameters:
| Item | Description |
|---|---|
| Name | Name of the group |
| Description | Description of the group |
| Zone | Zone to which the group belongs |
After clicking on a group, you can edit it (gear icon in the top right corner) or delete it (red trash bin icon in the top right corner).
A new group can be created using the Add Group button in the top right corner of the administration portal. Then fill in the parameters and click Save.
Users
This subsection contains a list of users.
Each user has the following parameters:
| Item | Description |
|---|---|
| First Name | User’s first name |
| Last Name | User’s last name |
| User’s email address | |
| Role | User role (Super user, access to selected parts of WA, no access) |
| Group | The group to which the user belongs |
| Created | When the user was created |
| Updated | When the user was last changed |
A new user can be created using the Add user button in the top right corner of the administration portal. Then fill in the parameters and click Save.
After clicking on a user, detailed information appears. Users can be edited by clicking the gear icon in the top right corner of the portal, or deleted using the red trash bin icon.
In the Devices section, there is a list of devices used by the user. Here you can add a new device or generate a unique key (registration code) for DNS PATROL login by clicking the + button above the Devices table.
You then need to fill in the following fields: Prefix (the prefix added before the device name), Usage Limit (how many devices can use the code), and Expires At (code validity in days), and click Save.
Each device contains the following parameters:
| Item | Description |
|---|---|
| Hostname | Unique name assigned to each device in the network, replacing numeric IP addresses |
| Name | Device name |
| Device Token | Device identifier |
| MAC address | Device MAC address |
| Last login at | When the device last connected to the network |
In the table, each device has a red trash bin icon that can be used to delete it.
User invitation
A user who has no login provider linked yet can be sent an invitation. The add-user icon in the top right part of the page opens the Invite user window, where the Generate link button creates a link with a limited validity. The link is single-use; generating a new one invalidates the previous one.
Opening the link takes the invited user to a welcome page where they link their login provider to the account. Whether they have already accepted the invitation is shown on the user detail in the Authorizations item.
Disabling the app
The user detail and the group detail control how the DNS PATROL application behaves on devices:
| Item | Description |
|---|---|
| Allow disabling app | Allow / Prohibit: whether the user may turn the application off themselves |
| App enabled | Enable / Disable: whether the application is turned on |
The values are inherited: a user takes over the settings of their group, a group takes over the system default. An inherited value is marked with an icon next to the selected option; picking another option overrides it for that user or group. The Reset button returns both items back to inheritance.
User Roles
User roles can be selected individually or multiple roles at once. Individual access rights are combined.
| User Roles | Role ID | Displayed sections in WA |
|---|---|---|
| Super User | super_user | access to all sections in Administration portal |
| Subnet Access | subnets_viewer | access to section Subnets |
| Zones Access | zones_viewer | access to section Zones |
| Resolvers Access | resolvers_viewer | access to section Resolvers |
| Rulesets Access | rulesets_viewer | access to section Rule sets |
| Statistics Access | statistics_viewer | access to section Analytics: Statistics, Logs history, Passive DNS, Files |
| Users Access | users_viewer | access to sections Groups and Users |
| Devices Access | devices_viewer | access to sections Registration Codes and Devices |
| No Access to DNS Management | no_role | access only to Dashboard |
Read, write, and delete access settings are configured as follows:
Access control > Groups > click on the group I want to edit > information about the group and a list of users will be displayed > clicking on the lock icon in the upper right corner will open a dialog box with all users > I can choose one of three options for each user > save with the Save button.
Registration Codes
This subsection lists the individual registration codes used when registering a device after launching the DNS PATROL application for the first time.
The individual registration codes then contain the following parameters:
| Item | Description |
|---|---|
| First name | User’s first name |
| Last name | User’s last name |
| Prefix | Prefix preceding the device name |
| Code | Registration code for the DNS PATROL application |
| Usage limit | Number of devices on which the code may be used |
| Number of uses | Number of devices on which the code has been used |
| Expires on | Date on which the code will expire |
A new registration code can be created using the Add registration code button in the upper right corner of the administration portal. Then, fill in the individual parameters and click on the Save button.
Devices
This subsection contains a list of all registered devices with the option to display only those that are not assigned to any user.
Each device contains the following parameters:
| Item | Description |
|---|---|
| Name | Device name (including the prefix from the registration code) |
| Hostname | Device system name |
| MAC address | Device MAC address |
| User | User name (or button with the option to assign a user) |
| User email | |
| Last login | When the device last logged into the system |
A new device code can be created using the Add Device Code button in the top right corner of the administration portal. Then fill in the parameters and click Save.
Identity Sync
This subsection is available to the Super User role only and is used to monitor the automatic import of users from external identity sources.
Identity Sources
The Identity Sources table lists the configured sources and their current state:
| Item | Description |
|---|---|
| Name | Source name |
| Type | Source type |
| Status | Whether the source is active or disabled |
| Sync state | Whether a synchronisation is currently running or the source is idle |
| Sync interval | How often the source is synchronised |
| Next run | How long until the next synchronisation |
| Last run | The result of the last run together with the number of created and updated users and the finish time |
The Sync Now button in the last column starts a synchronisation of an active source manually, without waiting for the next scheduled run.
Identity Sync Runs
The Identity Sync Runs table lists the individual runs. The dropdown above the table limits it to the runs of a selected source.
| Item | Description |
|---|---|
| Status | Whether the run finished with success or an error |
| Trigger | Whether the run was scheduled or started manually |
| Started at | When the run started |
| Finished at | When the run finished |
| Created Users | Number of newly created users |
| Updated Users | Number of changed users |
| Deactivated Users | Number of users deactivated based on the source |
| Failed Records | Number of records that could not be processed |
| Skipped | Number of soft-deleted and manually created users the synchronisation did not touch |
| Collapsed runs | How many identical consecutive runs are collapsed into the row |
| Error | The error message if the run failed |
Clicking a row opens the Run details window with a summary of the run (status, trigger, duration) and with lists of the individual affected records - created and updated users, deactivated and skipped users, created user groups, and failed records together with the reason for the failure.