Previous Topic Next Topic

Technicians

Technicians are end users with specific privileges that allow them to carry out product-related administrative tasks. To log in to the ADSelfService Plus portal and perform administrative tasks, technicians need to be assigned an ADSelfService Plus license. The Technician Settings report (Configuration > Administrative Tools > Technician) enables you to monitor the licenses assigned to technicians from the Licensing Status column, which shows the licensing status of each technician.

1. Domain-based Technicians: These are technicians who have an account in AD. Domain-based Technicians only have control over the domain to which they belong.
2. Product-based Technicians: These technician accounts are created in ADSelfService Plus and use their product account credentials for authentication. Product-based Technicians have control over all the domains configured in ADSelfService Plus.

Technicians can be assigned one of these roles:

1. Super Admin: Has full control over the entire application by default.
2. Operator: Can audit operations and view reports in the application by default.

How to assign permissions to technician roles

1. Go to Configuration > Administrative Tools > Technician..
2. Click Role Settings.
3. Select the required role from the drop-down.
4. You can now choose to assign or remove the displayed permissions.

How to create a technician

1. Go to Configuration > Administrative Tools > Technician.
2. Click the + Add New Technician button.
3. Select the technician type, role, domain, and users/groups from the respective drop-downs.

Important: When Domain-based Technician is selected, the created technician can use their Windows login credentials to log in to ADSelfService Plus.
4. If you select Product-based Technician in the Technician Type field, you will be required to enter the login credentials for that technician.

Important: When Product-based Technician is selected, this only creates an account in ADSelfService Plus. The technician will not have an AD account and needs to use the credentials that you configure.
5. Click Add.

Advanced settings

The Advanced option on the Technician Settings page allows you to configure login MFA and password policy settings for technicians who use product authentication.

Login MFA

You can configure specialized MFA for technicians using this section.

1. Go to Configuration > Administrative Tools > Technician.
2. Click Advanced in the bottom-right corner and click the Login MFA tab.

3. Enable MFA during login for technicians who use product authentication: Enable this option if you want ADSelfService Plus to prompt product technicians for the configured MFA authenticators during login for additional security.These MFA settings will be applied to all product technicians, including the default administrator account.

Note: These MFA settings will be applied to all product technicians, including the default administrator account. This will result in accounts without backup codes being locked out upon MFA failure. Please reset the password to the default admin account or contact support if this occurs.

4. Technician has to satisfy __ authentication factor(s) during login: Choose the number of authenticators to prompt technicians for during login from the drop-down.
5. Select the authenticators required: Choose the authenticators you wish to apply to the technician from the drop-down.
6. Click Advanced to open up more options to customize settings for technicians.

7. Hide CAPTCHA during the login MFA process on <drop_down>: Specify the MFA pages on which you do not want the CAPTCHA to be displayed.
8. Idle time limit for login MFA process is __ min: Specify the idle time limit for the login MFA process. Once the specified time has lapsed, if the technician failed to complete the verification process, they will have to go through the MFA verification process again.
9. Trust this browser option expires after: When this option is enabled, users will not be asked to go through MFA for the specified length of time when they log in to ADSelfService Plus using trusted browsers. Specify the duration of the trust period in days, hours, or minutes.
10. Keep the 'Trust this browser' option selected by default: Enable this option if you want the Trust this browser check box to be selected by default on the MFA verification screen.
11. Enable MFA Backup Verification Codes: Click this option to let admins generate backup codes for technician accounts via the MFA Enrolled Users Report. Admins can choose to display the MFA Backup Code column in the MFA Enrolled Users Report and generate backup codes from the report.

Password policy

1. Go to Configuration > Administrative Tools > Technician.
2. Click Advanced in the bottom-right corner and click the Password Policy tab.
3. Restrict Characters: Specify how many special characters, numbers, and Unicode characters should be used in a password.

4. Restrict Repetition: Limit the use of:
• Consecutive characters (e.g., aaaa).
• A string of consecutive characters from the username and old password (e.g., user01).

5. Restrict Pattern: Restrict technicians from using palindromes, dictionary words, and other custom patterns in their passwords.

6. Restrict Length: Specify the maximum and minimum password length.

7. Enable Password Strength Analyzer: Enable this setting to provide a visual representation of the strength of the password, encouraging technicians to create complex passwords.
8. You can also configure the settings to override all the complexity rules, if the password meets a predefined password length. You can also specify the number of complexity rules a password must satisfy.

General

1. Hide the CAPTCHA in the Change Password pages: You can choose to hide the CAPTCHA on the Change Password page, using this option.
2. Prevent Technician from copy-pasting the password in the Change Password fields: Ensure extra security by preventing Technicians from copy-pasting the passwords in the Change Password fields.

Previous Topic Next Topic