Skip to content

Commit

Permalink
Language review
Browse files Browse the repository at this point in the history
  • Loading branch information
Dmitri Popov committed Feb 4, 2025
1 parent 0d6aadf commit 0ccc8e3
Showing 1 changed file with 31 additions and 33 deletions.
64 changes: 31 additions & 33 deletions trento/xml/trento-user-manage.xml
Original file line number Diff line number Diff line change
Expand Up @@ -9,25 +9,24 @@
<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:xi="http://www.w3.org/2001/XInclude" xml:id="sec-trento-user-management">
<title>User management</title>
<para>
Trento provides a local permission-based user management feature with
optional multi-factor authentication. This feature allows for segregation of
duties in the Trento console and ensures that only authorized users with the
right permissions can access it.
&trento; provides a local permission-based user management feature with
optional multi-factor authentication. This feature enables segregation of
duties in the &trento; interface and ensures that only authorized users with

This comment has been minimized.

Copy link
@abravosuse

abravosuse Feb 4, 2025

Collaborator

interface > console (?)

the right permissions can access it.
</para>
<para>
User management actions are performed in the <guimenu>Users</guimenu> view
in the left-hand side panel of the &t.web;.
</para>
<para>
By default, a newly created user is granted display access rights except for
the
<guimenu>Users</guimenu> view. Whenever available, a user with default access can set up
filters and pagination settings matching their preferences.
the <guimenu>Users</guimenu> view. Where available, a user with default
access can configure filters and pagination settings matching their
preferences.
</para>
<para>
Additional permissions must be added to a user profile, so that the user can
perform the corresponding protected activities. The following permissions
are currently available:
To perform protected actions, the user must have additional permissions added
to their user profile. Blow is the list of currently available permissions:

This comment has been minimized.

Copy link
@abravosuse

abravosuse Feb 4, 2025

Collaborator

"Blow" > "Below"

</para>
<itemizedlist>
<listitem>
Expand Down Expand Up @@ -82,21 +81,21 @@
<formalpara>
<title>User managers:</title>
<para>
users with <constant>all:users</constant> permission
users with <constant>all:users</constant> permissions
</para>
</formalpara>
</listitem>
<listitem>
<formalpara>
<title>SAP Basis administrator with Trento display-only access:</title>
<title>SAP Basis administrator with &trento; display-only access:</title>
<para>
users with default permissions
</para>
</formalpara>
</listitem>
<listitem>
<formalpara>
<title>SAP Basis administrator with Trento configuration access:</title>
<title>SAP Basis administrator with &trento; configuration access:</title>
<para>
users with <constant>all:checks_selection</constant>, <constant>all:tags</constant> and
<constant>all:settings</constant> permissions
Expand All @@ -105,23 +104,22 @@
</listitem>
<listitem>
<formalpara>
<title>SAP Basis administrator with Trento operation access:</title>
<title>SAP Basis administrator with &trento; operation access:</title>
<para>
users with <constant>all:check_execution</constant> and <constant>cleanup:all</constant>
permissions.
users with <constant>all:check_execution</constant> and <constant>cleanup:all</constant> permissions.
</para>
</formalpara>
</listitem>
</itemizedlist>
<para>
The default admin user created during the installation process is granted
<constant>all:all</constant> permissions and cannot be modified or deleted.
Use it only to create a first user manager. That is, a user with
Use it only to create the first user manager (the user with

This comment has been minimized.

Copy link
@abravosuse

abravosuse Feb 4, 2025

Collaborator

"Use it only to create the first user manager (the user with" > "Use it only to create the first user manager (a user with": there can be many user managers

<constant>all:users</constant> permissions who creates all the other
required users. Once a user with all:users permissions is created, the
default admin user must be regarded as a fall-back user to be used only in
required users). Once a user with <constant>all:users</constant> permissions
is created, the default admin user must be treated as a fallback user in
case all other access to the console is lost. If the password of the default
admin user is lost, it can be reset by updating the helm chart or the web
admin user is lost, it can be reset by updating the Helm chart or the web
component configuration, depending on which deployment method was used to
install &t.server;.
</para>
Expand All @@ -136,8 +134,8 @@
</listitem>
<listitem>
<para>
The same number or letter must not be repeated three or more times in a row (for example:
111 or aaa)
The same number or letter must not be repeated three or more times in a
row (for example: 111 or aaa)
</para>
</listitem>
<listitem>
Expand All @@ -149,28 +147,28 @@
</itemizedlist>
<para>
The <guimenu>Create User</guimenu> and <guimenu>Edit User</guimenu> views
provide a built-in generation password action button that allows user
provide a built-in password generation button that allows user
managers to easily generate secure and compliant passwords. The user manager
must provide the user with their password through an authorized secure
channel.
</para>
<para>
A user can reset their password in the <guimenu>Profile</guimenu> view.
Here, they can also update their name and email address as well as activate
multi-factor authentication using an authenticator app. Multi-factor
authentication increases the security of a user account by requesting a
temporary second password or code when logging in the console. User managers
can disable multi-factor authentication for any given user that has it
enabled. However, user managers cannot enable multi-factor authentication on
their behalf. The default admin user cannot enable its own multi-factor
authentication.
A user can reset their password in the <guimenu>Profile</guimenu> view. In
this view, they can also update their name and email address as well as
activate multi-factor authentication using an authenticator app.
Multi-factor authentication increases the security of a user account by
requesting a temporary second password or code when logging in the console.
User managers can disable multi-factor authentication for any given user
that has it enabled. However, user managers cannot enable multi-factor
authentication on their behalf. The default admin user cannot enable its own
multi-factor authentication.
</para>
<note>
<title>Security Tip for Multi-Factor Authentication</title>
<para>
Since multi-factor authentication cannot be enabled for the default admin
user, keeping its password safe is imperative. If the default admin user's
password is compromised, reset it immediately by updating the helm chart
password is compromised, reset it immediately by updating the Helm chart
or the web component configuration, depending on which deployment method
was used to install &t.server;.
</para>
Expand Down

1 comment on commit 0ccc8e3

@EMaksy
Copy link
Collaborator

@EMaksy EMaksy commented on 0ccc8e3 Feb 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey great job, besides abravosuse comments nothing to add 👍

Please sign in to comment.