Users & Roles¶

SentriKat uses role-based access control (RBAC) to manage user permissions. Users are assigned roles within organizations, and their access is scoped accordingly.

Role Hierarchy¶

Permission Matrix¶

Creating Users¶

Via the Admin Panel¶

1. Go to Admin > Users
2. Click Add User
3. Fill in the form:
4. Email: User's email address (used for login)
5. Display Name: Full name
6. Password: Initial password (user can change later)
7. Organization: Assign to one or more organizations
8. Role: Select role per organization
9. Click Create User

Via Invitation¶

1. Go to Admin > Users
2. Click Invite User
3. Enter the email address and select a role
4. Click Send Invitation

The user receives an email with a link to set their password and complete registration.

Via API¶

curl -X POST https://sentrikat.example.com/api/users \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "display_name": "Jane Analyst",
    "password": "initial-password-123",
    "organization_id": 1,
    "role": "manager"
  }'

Managing Users¶

Editing a User¶

1. Go to Admin > Users
2. Click the user's name
3. Update fields as needed
4. Click Save

Changing Roles¶

1. Open the user's profile
2. In the Organizations section, click the role dropdown
3. Select the new role
4. Click Save

Disabling a User¶

Rather than deleting, you can disable a user account:

1. Open the user's profile
2. Toggle Account Active to off
3. Click Save

Disabled users:

• Cannot log in
• Do not receive alert emails
• Are preserved for audit trail purposes
• Do not count against the license user limit

Resetting a Password¶

Multi-Organization Access¶

A single user can belong to multiple organizations with different roles:

# Assign user to additional organization via API
curl -X POST https://sentrikat.example.com/api/users/5/organizations \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "organization_id": 3,
    "role": "viewer"
  }'

When a user belongs to multiple organizations, they can switch context using the organization selector in the top navigation bar.

LDAP/SSO Users¶

When LDAP or SAML SSO is configured, users are provisioned automatically on first login:

• Display name and email are synced from the directory
• A default role is assigned based on group mappings
• Passwords are managed by the identity provider

See LDAP/SSO for configuration details.

Audit Log¶

All user actions are recorded in the audit log:

1. Go to Admin > Audit Log
2. Filter by user, action type, or date range
3. Export as CSV if needed

Tracked actions include:

• Login/logout events
• Product changes
• Vulnerability acknowledgments
• Configuration changes
• User management actions

Session Management¶

See Configuration for all session settings.

Next Steps¶

• Set up LDAP/SSO authentication
• Configure organizations for multi-tenant access
• Set up notifications for user alerts