Roles and sessions

Customize roles from the five templates, add scoped exceptions, set session timeouts, see who has access, and end active sessions.

Last reviewed Print view roles permissions scopes sessions timeouts access
Contents

Roles decide what each user may do, and session limits decide how long a browser stays signed in. Roles are in Configure > Roles & permissions, on the Roles and Explain access tabs. To add user accounts, see Users and permissions.

What you need

  • The Administer the system permission.
  • Sites, areas, and groups, if you want to limit permissions to them. See Sites, areas, and groups.

Start from a template

Five role templates come with every installation: Administrator, Operator, Viewer, Technician, and Auditor. They carry a Template badge, cannot be changed or deleted, and can be assigned as they are. To customize one, select Duplicate and change the copy.

Create a role

  1. Select Add role, or Duplicate on the nearest template.
  2. Enter a Name and a Description.
  3. Optionally set an Idle timeout and an Absolute timeout: No timeout, 15 or 30 minutes, or 1, 8, or 24 hours.
  4. In the permission list, grouped by category, set each permission to Not set, Allow, or Deny for the entire installation.
  5. To limit a permission to part of the system, select Add a scoped exception and choose a Site, Area, Group, or single Resource. 22 permissions can be scoped this way.
  6. Select Save changes. Kalytera VMS shows a summary of the change's impact as you save.

Delete role is available only while no one is assigned the role.

Give a user access

  1. In Configure > Users, select the user and then Edit access.
  2. Choose the user's roles and, if needed, Direct exceptions for that user alone.
  3. Set session limits for the user, or keep Inherit from role.
  4. Select Save access.

How session limits work

  • A limit set on the user wins. Otherwise the shortest limit among the user's roles applies.
  • Five minutes before a session ends, the user is warned and can select Stay signed in.
  • Changing a user's access or password, deactivating the account, or revoking a session ends the sessions concerned.

End sessions

A user's Sessions list shows their active sessions. Select Revoke to end one session, or Revoke all to end every session.

Check who has access

On Explain access, Who has access lists everyone who holds a permission: use Find permission and choose a Resource. Explain one user shows why one user can or cannot do something.

Good to know

  • Kalytera VMS will not let you remove the last administrator.
  • You cannot deactivate your own account. Change your own password from the account menu.
  • Role templates are the same on every installation, so a duplicate is the place for your own changes.
All guides