Users and Groups

The Users and Groups tab in the web interface manages accounts: create, edit, and delete users and groups, and connect AD/LDAP. The group a user belongs to determines what that user can do in the system.

Figure 29 — Users section

Roles and Permissions

Every user belongs to one group, and the group defines a set of permissions. Any user can view sections, tasks, statistics, dashboards, logs, and reports. Creating, changing, deleting, starting, and stopping objects requires the matching permission.

The controller checks permissions on every action. If the user lacks the permission, the action is rejected with the message Insufficient permissions for this action. This also applies to direct API calls. Buttons for unavailable actions are not shown in the web interface.

Built-in Groups

The controller creates three ready-made groups that match typical roles. The group names are stored in Russian and are shown the same way in any interface language:

Group	Intended for	What is available
Администраторы (Administrators)	Test bench administrators	All sections and actions, including the Settings section and user and group management
Операторы (Operators)	Engineers who prepare and run tests	Tasks: create, edit, start, stop, duplicate, delete, import, protocol actions, dump requests. Projects and task templates. Library: networks, tunnels, MAC addresses, SSL certificates, dictionaries, files, applications, agents and their licenses. The Settings and Users and Groups sections are view-only
Только чтение (Read-only)	Observers, customer representatives, auditors	Viewing all sections, statistics, dashboards, logs, and reports, and exporting reports and tasks. No changes are allowed

The built-in groups are created once. You can rename, change, or delete them, and the controller does not recreate them afterwards. If a group with the same name already existed, the controller leaves it unchanged.

Figure 29a — Built-in groups «Администраторы», «Операторы», and «Только чтение»

Group Permissions

The following permissions allow actions that change data:

Permission	What it allows
Manage tasks, projects and library	Creating, editing, starting, stopping, duplicating, importing, and deleting tasks. Protocol and interface actions while a task is running. Requesting traffic dumps from agents. Working with projects and task templates. Creating, editing, and deleting library objects: networks, tunnels, MAC addresses, SSL certificates, dictionaries, user files, PCAP files, applications, malware files, and vulnerability signatures. Deleting agents and uploading their licenses
Edit settings	Changes in the Settings section: uploading PTI packages, the storage limit, forced file synchronization on agents, and system dashboard selection. Editing dashboards in the embedded Grafana
Create users	Creating accounts
Edit users	Changing a user's e-mail, name, and group, and resetting the password
Delete users	Deleting accounts
Block users	Blocking and unblocking accounts
Create groups	Creating groups
Edit groups	Changing a group's name and permissions
Delete groups	Deleting groups

The Access to dashboards, Read settings, Read logs, Read tasks, Read users, and Read groups permissions cover viewing. In the current version every user can view data, so these permissions are included in all built-in groups, and what a user can do is limited by the change permissions.

How Permissions Work

• Actions that concern only the user themselves are available to everyone: signing in and out, changing their own password, accepting the user agreement, configuring table columns, viewing and clearing notifications, and exporting reports and tasks.
• A user without a group (No group (view only) in the user form) can only view data.
• The administrator account created during installation always has full access regardless of its group. This prevents a group misconfiguration from locking everyone out of the system. This account cannot be edited, blocked, or deleted.
• Changes to a group's permissions take effect on the controller immediately. The set of buttons in the user's web interface updates after the page is reloaded.
• If a user's permissions match a built-in role, the account menu (the icon in the top-right corner) shows the role under the e-mail: Administrator, Operator, or Read-only.
• A blocked user cannot sign in and sees the message User is blocked. An open session ends on the next action.

Working with Read-Only Permissions

A member of the Только чтение (Read-only) group sees the same sections as an operator, but without the buttons that change data:

• the task list has no New task button or delete action; tasks can only be opened for viewing;
• the task page has no Start task or Add plugin buttons, and the ⋮ menu contains only report export, task export, and link copying. Plugin settings open for viewing without the option to save changes;
• the library has no create, upload, edit, or delete buttons, while user and PCAP files can still be downloaded;
• the Settings and Users and Groups sections are view-only.

Figure 29b — Task page for a read-only user

Configuring Groups

Creating a Group

1. Go to Users → Groups.
2. Click Create Group.

Figure 30 — Create Group button

3. Enter a Group Name.
4. In Role template, select Administrator, Operator, or Read-only, and the permissions are filled in automatically. The description of the selected role is shown below the template. To set permissions manually, select Custom and check the permissions in the User permissions in the group list (see Group Permissions).
5. Adjust the permission list if needed. If the set no longer matches the template, the selection switches to Custom.
6. Click Create.

Figure 30a — Selecting a role template when creating a group

Editing a Group

1. Go to Users → Groups.
2. Click the edit button next to the group.
3. Change the name and/or permissions. The role template is detected automatically from the group's current permissions.
4. Click Save.

The new permissions apply to all members of the group.

Deleting a Group

1. Go to Users → Groups.
2. Click the delete button next to the group.
3. Confirm the action in the Delete Group dialog.

Configuring Users

Creating a User

1. Go to Users → Users.
2. Click Create User.

Figure 31 — Create User button

3. Enter the Email Address and Username.
4. Select a group. The group defines the user's permissions (see Roles and Permissions). A user with No group (view only) can only view data.
5. Click Create.
6. The Sign-In Details dialog displays the username and temporary password.
7. At first sign-in, the user is prompted to change the password. Enter the new value in Password and Confirm Password.

Figure 32 — Password Change Required dialog

Editing a User

1. Go to Users → Users.
2. Open the action menu next to the user and select Edit.
3. Change the settings, for example the group, and click Save.

The items in the action menu depend on the current user's permissions: without the edit, block, or delete permission, the corresponding items are not shown.

Blocking a User

1. Go to Users → Users.
2. Select Block from the action menu.
3. In the Status column, the value changes from Active to Blocked.

A blocked user cannot sign in, and their open session ends on the next action. To restore access, select Unblock from the action menu.

Deleting a User

1. Go to Users → Users.
2. Select Delete from the action menu, then click Delete in the Delete User dialog.

AD/LDAP Integration

Peresvet ST integrates with Active Directory and LDAP for centralized account management.

Connecting to AD/LDAP

Configure the connection under Users and Groups. Specify the server address, Base DN, service-account credentials, and TLS parameters.

Importing Groups from AD/LDAP

After connecting, you can import groups. The selected groups are created in Peresvet ST and can be assigned permissions. Group membership is synchronized when a user signs in.

Importing Users from AD/LDAP

Members of imported groups gain access through domain authentication. You do not need to create accounts manually; a profile is created from directory attributes when the user first signs in.