Groups and roles

This chapter describes the Cryptshare roles that the Cryptshare Server expects from Keycloak when OpenID Connect (OIDC) is used for administrator login. Using OIDC allows more granular rights management than the standard administrator model in Cryptshare. The roles determine which parts of the Cryptshare administration interface a user can access and which administrative actions they can perform.

If Pointsharp IdP is not used, the required roles, groups, and role assignments must be set up manually in Keycloak. Create the roles in Keycloak and group them so that they match the administrator types used in Cryptshare.

The Pointsharp IdP provides a standard role mapping for Cryptshare Admin Permissions. Therefore, the Cryptshare groups and roles do not have to be created manually as they do when using other Identity Providers such as Keycloak or Microsoft Entra ID.

Go to Keycloak documentation for more information about managing roles and groups in Keycloak.

Required Cryptshare roles

Create the following roles in Keycloak. The role names must match the role names expected by the Cryptshare Server.

Role name	Description
ALL	Grants every available permission.
DEFAULT	Allows access to the Administration Interface.
SYSTEM_STATUS_VIEW	Allows access to the Administration Interface tab "System Status".
SYSTEM_SETTINGS_VIEW	Allows access to the Administration Interface tab "System Settings".
QUICK_VIEW	Allows access to the Administration Interface tab "QUICK".
TRANSFER_PROCESSING_VIEW	Allows access to the Administration Interface tab "Transfer Processing".
ARCHIVING_VIEW	Allows access to the Administration Interface submenu "Archiving".
PREPROCESSING_MANAGE	Allows changes to the processing command settings.
BACKUP_RESTORE_VIEW	Allows access to the Administration Interface tab "Backup / Restore".
RESTORE_VIEW	Allows access to the Administration Interface submenu "Restore".
OPERATING_SYSTEM_VIEW	Allows access to the Administration Interface tab "Operating System".
CUSTOMIZATION_VIEW	Allows access to the Administration Interface tab "Customization".
ADDON_PRODUCTS_VIEW	Allows access to the Administration Interface tab "Addon Products".
USER_ADMINISTRATION_VIEW	Allows access to the Administration Interface tab "User Administration".
LEGAL_VIEW	Allows access to the Administration Interface tab "Legal".
OPERATING_SYSTEM_UPGRADE	Allows operating system upgrades.
POSTUPDATE_LOGIN	Allows login to start the post-update process.
BACKUP_UPLOAD	Allows backup uploads.
BACKUP_DOWNLOAD	Allows backup downloads.
SUPPORT_CONTACT	Allows support requests to be sent.
LOG_VIEW	Allows access to the transfer and system log.
LIVE_LOGGER_VIEW	Allows access to the live logger.
LICENSE_MANAGE	Allows a new license to be uploaded.
OTHER_USER_ROLE_MANAGE	Allows management of users with a different role.
BASE_URL_MANAGE	Allows management of the base URL.
MAIL_SERVER_TARGET_MANAGE	Allows management of the mail server target.
LOG_SETTINGS_AUTOMATIC_SENDING_MANAGE	Allows management of automatic log sending.
SYSTEM_NOTIFICATIONS_MANAGE	Allows management of system notifications.
SYSTEM_LOG_DOWNLOAD	Allows system log downloads.
ACCEPT_LICENSE_AGREEMENT	Allows the license agreement to be accepted.
QUICK_ACTIVATE	Makes "Activate QUICK Access" available.
QUICK_MANAGE	Allows changes to QUICK settings.
LOGGING_MANAGE	Allows changes to logging settings.
SECURITY_MODES	Allows changes to security mode settings.
ID_PROVIDER	Allows changes to identity provider settings.
ONE_TIME_PASSWORD	Allows changes to one-time password settings.
DEFAULT_PRESET	Allows changes to the default preset.
SYSTEM_RESTART	Allows the system to be restarted.
IMPORT_CSV	Allows policy rules to be changed via CSV import.

Role name

Description

ALL

Grants every available permission.

DEFAULT

Allows access to the Administration Interface.

SYSTEM_STATUS_VIEW

Allows access to the Administration Interface tab "System Status".

SYSTEM_SETTINGS_VIEW

Allows access to the Administration Interface tab "System Settings".

QUICK_VIEW

Allows access to the Administration Interface tab "QUICK".

TRANSFER_PROCESSING_VIEW

Allows access to the Administration Interface tab "Transfer Processing".

ARCHIVING_VIEW

Allows access to the Administration Interface submenu "Archiving".

PREPROCESSING_MANAGE

Allows changes to the processing command settings.

BACKUP_RESTORE_VIEW

Allows access to the Administration Interface tab "Backup / Restore".

RESTORE_VIEW

Allows access to the Administration Interface submenu "Restore".

OPERATING_SYSTEM_VIEW

Allows access to the Administration Interface tab "Operating System".

CUSTOMIZATION_VIEW

Allows access to the Administration Interface tab "Customization".

ADDON_PRODUCTS_VIEW

Allows access to the Administration Interface tab "Addon Products".

USER_ADMINISTRATION_VIEW

Allows access to the Administration Interface tab "User Administration".

LEGAL_VIEW

Allows access to the Administration Interface tab "Legal".

OPERATING_SYSTEM_UPGRADE

Allows operating system upgrades.

POSTUPDATE_LOGIN

Allows login to start the post-update process.

BACKUP_UPLOAD

Allows backup uploads.

BACKUP_DOWNLOAD

Allows backup downloads.

SUPPORT_CONTACT

Allows support requests to be sent.

LOG_VIEW

Allows access to the transfer and system log.

LIVE_LOGGER_VIEW

Allows access to the live logger.

LICENSE_MANAGE

Allows a new license to be uploaded.

OTHER_USER_ROLE_MANAGE

Allows management of users with a different role.

BASE_URL_MANAGE

Allows management of the base URL.

MAIL_SERVER_TARGET_MANAGE

Allows management of the mail server target.

LOG_SETTINGS_AUTOMATIC_SENDING_MANAGE

Allows management of automatic log sending.

SYSTEM_NOTIFICATIONS_MANAGE

Allows management of system notifications.

SYSTEM_LOG_DOWNLOAD

Allows system log downloads.

ACCEPT_LICENSE_AGREEMENT

Allows the license agreement to be accepted.

QUICK_ACTIVATE

Makes "Activate QUICK Access" available.

QUICK_MANAGE

Allows changes to QUICK settings.

LOGGING_MANAGE

Allows changes to logging settings.

SECURITY_MODES

Allows changes to security mode settings.

ID_PROVIDER

Allows changes to identity provider settings.

ONE_TIME_PASSWORD

Allows changes to one-time password settings.

DEFAULT_PRESET

Allows changes to the default preset.

SYSTEM_RESTART

Allows the system to be restarted.

IMPORT_CSV

Allows policy rules to be changed via CSV import.

Group roles by Cryptshare administrator type

Create one group in Keycloak for each Cryptshare administrator type that should be available. Assign the required roles to each group.

Keycloak group	Cryptshare administrator type	Assigned roles
ADMIN	Full administrator	ALL
LOG_ANALYST	Log administrator	DEFAULT LIVE_LOGGER_VIEW LOG_VIEW SYSTEM_STATUS_VIEW
CONFIG_ADMIN	Configuration administrator	ACCEPT_LICENSE_AGREEMENT ADDON_PRODUCTS_VIEW BACKUP_RESTORE_VIEW CUSTOMIZATION_VIEW DEFAULT DEFAULT_PRESET ID_PROVIDER LEGAL_VIEW LICENSE_MANAGE ONE_TIME_PASSWORD OPERATING_SYSTEM_VIEW POSTUPDATE_LOGIN QUICK_ACTIVATE QUICK_MANAGE QUICK_VIEW SECURITY_MODES SYSTEM_RESTART SYSTEM_SETTINGS_VIEW SYSTEM_STATUS_VIEW TRANSFER_PROCESSING_VIEW USER_ADMINISTRATION_VIEW
QUICK_SUPPORTER	QUICK support administrator	DEFAULT QUICK_ACTIVATE QUICK_VIEW SECURITY_MODES

Keycloak group

Cryptshare administrator type

Assigned roles

ADMIN

Full administrator

ALL

LOG_ANALYST

Log administrator

DEFAULT

LIVE_LOGGER_VIEW

LOG_VIEW

SYSTEM_STATUS_VIEW

CONFIG_ADMIN

Configuration administrator

ACCEPT_LICENSE_AGREEMENT

ADDON_PRODUCTS_VIEW

BACKUP_RESTORE_VIEW

CUSTOMIZATION_VIEW

DEFAULT

DEFAULT_PRESET

ID_PROVIDER

LEGAL_VIEW

LICENSE_MANAGE

ONE_TIME_PASSWORD

OPERATING_SYSTEM_VIEW

POSTUPDATE_LOGIN

QUICK_ACTIVATE

QUICK_MANAGE

QUICK_VIEW

SECURITY_MODES

SYSTEM_RESTART

SYSTEM_SETTINGS_VIEW

SYSTEM_STATUS_VIEW

TRANSFER_PROCESSING_VIEW

USER_ADMINISTRATION_VIEW

QUICK_SUPPORTER

QUICK support administrator

DEFAULT

QUICK_ACTIVATE

QUICK_VIEW

SECURITY_MODES

Assign users to groups

Add users to the appropriate groups in Keycloak. A user receives the Cryptshare administration permissions that are assigned to all groups they belong to.

Change administrator permissions

To change a user’s administrator permissions, update the user’s group membership or update the roles assigned to the group in Keycloak. The updated permissions are applied the next time Cryptshare receives the user’s role information from Keycloak.