KACE Systems Management Appliance 13.2 Common Documents - Administrator Guide

View or edit user profiles

View or edit user profiles

You can view general information about your user profile, and edit some settings, when needed.

The User Profile dialog box allows every user to quickly change their password, review the devices and assets assigned to them, and any Service Desk Tickets that they created. Users with administrative-level permissions can also edit some additional parameters, such as their name, email, manager, and locale. They can also quickly go to the User Detail page to review additional information about their account, and to make any changes, as needed.

For more information about editing user accounts using the User Detail page, see the following topics:

NOTE: Users without administrative privileges can only update their passwords and view a limited set of information in this dialog box without making any additional changes or accessing the User Detail page.

Tab	Option	Description
Profile	Login	The name the user types in the Login ID field on the login page.   NOTE: You cannot change the login of the default admin account.
	Name	The user’s full name.
	Primary Email	The user’s email address.
	Manager	The user’s manager.
	Locale	The locale to use for the Administrator Console and User Console for the user.
	Update Password	The password the user types when logging in. If the Organization component is enabled on your appliance, or if you want to link multiple K-Series appliances, use caution when changing the password of the admin account. Admin account passwords for the System-level, for organizations, and for linked appliances must be the same if you want to switch among them using the drop-down list in the top-right corner. The drop-down list shows only those organizations and appliances whose admin account passwords are the same.
Devices	Name	The device name.
	Subtype	The Asset Subtype for this device, if one is assigned.
	Primary Device	Indicates if the device is the primary device for the selected user.
Assets	Name	The asset name.
	Type	The asset type.
	Subtype	The Asset Subtype for this device, if one is assigned.
Service Desk Tickets	Number	The number of the Service Desk ticket the user logged.
	Title	The title of the Service Desk ticket the user logged.
	Status	The status of the Service Desk ticket the user logged.

NOTE: This link only appears if your account has administrative privileges.

Using an LDAP server for user authentication

Using an LDAP server for user authentication

User authentication can be done locally, using accounts created on the appliance, or externally, using an LDAP server.

If you use external LDAP server authentication, the appliance accesses a directory service to authenticate users. This allows users to log in to the appliance Administrator Console, User Console, or System Administration Console using their domain username and password.

For information about adding user accounts to the appliance for local user authentication, see:

About the login account on your LDAP server

About the login account on your LDAP server

To set up LDAP user authentication, you need to create a login account for the appliance on your LDAP server. The appliance uses this account to read and import user information from the LDAP server.

The account needs read-only access to the Search Base DN field on the LDAP server. The account does not need write access, because the appliance does not write to the LDAP server.

In addition, the account must have a password that never expires. Because the password never expires, make sure it is very secure. The user can change the password (that complies with the appropriate security requirements), however, the password must be updated on the appliance. You can give the account a username, such as KACE_Login, or you can attempt to connect to the LDAP server using an anonymous bind.

Configure and test LDAP user authentication

Configure and test LDAP user authentication

You can configure and test connections from the appliance to an external LDAP server.

NOTE: All servers must have a valid IP address or hostname. Otherwise, the operation times out, which results in login delays when using LDAP authentication.

Table 5. Server information

Option	Description
Name	The name you want to use to identify the server.
Host Name or IP Address	The IP address or the hostname of the LDAP server. If the IP address is not valid, the appliance waits to timeout, resulting in login delays during LDAP authentication.   NOTE: To connect through SSL, use an IP address or hostname. For example: ldaps://hostname.
Port	The LDAP port number, which is usually 389 (LDAP) or 636 (secure LDAP).
Base DN	The criteria used to search for accounts. This criteria specifies a location or container in the LDAP or Active Directory structure, and the criteria should include all the users that you want to authenticate. Enter the most specific combination of OUs, DCs, or CNs that match your criteria, ranging from left (most specific) to right (most general). For example, this path leads to the container with users that you need to authenticate: OU=end_users,DC=company,DC=com.   NOTE: Domain Users is a special group that is not added to the memberof attribute values. For Domain Users members, use this format: (primaryGroupId=513).
Advanced Search	The search filter. For example: (&(sAMAccountName=KBOX_USERNAME)(memberOf=CN=financial,DC=example,DC=com))
Login	The credentials of the account the appliance uses to log in to the LDAP server to read accounts. For example: LDAP Login:CN=service_account,CN=Users, DC=company,DC=com. If user name and password are not provided, the tree lookup is not performed. Each LDAP Label can connect to a different LDAP or Active Directory server.
Password	The password of the account the appliance uses to log in to the LDAP server.
Role	(Required) The user’s role: • Global Administrator: The user can access the System Administration Console, and each organization’s Administrator Console as an administrator with full read/write permissions. They must first log in to the System Administration Console, and then log in to the applicable organization account using the drop-down list in the top-right corner. • Administrator: The user can log in to and access all features of the Administrator Console, User Console, or System Administration Console. • Read Only Administrator: The user can log in, but cannot modify any settings in the Administrator Console, User Console, or System Administration Console. • User Console Only: The user can log in only to the User Console . This role is only available in the Administrator Console. • No Access: The user cannot log in to the Administrator Console, System Administration Console or User Console. No Access is the default role.   NOTE: These roles are predefined and you cannot edit them. However, you can create and edit custom roles as needed.

NOTE: Record the search and filtering criteria you use for filling out this form. You use this same information to import user data, and later to schedule user import on a regular basis.

b.	Click the Edit button next to the server on which the user account you are testing is located .

If the test is successful, the authentication setup is complete for this user, and other users in the same LDAP container.