Enabling and Disabling UI User Management

Enabling and Disabling UI User Management#

Squirro offers the option of managing permissions via inherited third-party Single Sign-on (SSO) settings, or managing users via the management functionality in the user interface (UI), found in Server → Users.

With SSO enabled, users should not be manually managed on a Squirro instance, as the identity provider handles user provisioning instead. To prevent user editing in the user interface, Squirro offers a corresponding setting, found in Server -> Users.

Follow the steps below to enable or disable the UI user management functionality:

  1. Log in to your Squirro installation as a server administrator.

  2. Navigate to the Server space.

  3. Click Configuration in the left menu.

  4. Search for SSO; the results list should include frontend.userapp.sso-disable-user-edit.

  5. Hover over frontend.userapp.sso-disable-user-edit and click Edit.

  6. Check or uncheck the box as desired, then click the checkmark button to save.

Squirro SSO Default Enablement

Warning: Disabling SSO SAML on Squirro Self-Service instances for permission management is not recommended as it will prevent some administrative tasks from working well. If you would like to replace authentication on Self-Service instances with your own identity provider, visit the Squirro Support website and submit a technical support request.

Customizing the Profile Page Message#

While frontend.userapp.sso-disable-user-edit is turned on, the Profile page tells users where their account is managed:

Your account is currently managed by Acme SSO. Contact your administrator to modify your account details.

Squirro resolves the provider name automatically from your identity provider. To override that name, replace the whole sentence, or hide it, edit the frontend.userapp.sso-disable-user-edit-message server setting in Server → Configuration, in the same way as frontend.userapp.sso-disable-user-edit. The setting holds one value with three keys:

Key

Description

Default

providerName

Name of the identity provider shown in the message. Leave empty to use the name published by your identity provider.

empty

text

Replaces the whole message with your own wording. Leave empty to keep the default message. Set it to a single space to hide the message.

empty

link

Address that the link in the message points to. Must be an http:// or https:// URL. Any other value is ignored, and the message is shown as though no link were set.

empty

For example:

{
  "providerName": "Acme SSO",
  "text": "",
  "link": "https://accounts.example.com/profile"
}

Note

Editing the setting replaces its whole value, so always include all three keys and leave the ones you do not use empty. The message itself appears only while frontend.userapp.sso-disable-user-edit is turned on.

Where the Provider Name Comes From#

The name in the message is resolved in this order, using the first one available:

  1. The providerName key, if set.

  2. The name that your identity provider publishes about itself. That name is available for SAML only, and only when the provider publishes an organization name in its metadata.

  3. If no name is available, the message falls back to a provider-agnostic sentence: Your account is currently managed by your organization’s identity provider.

Set providerName whenever you want to control the wording exactly, for example when your identity provider publishes no organization name, or publishes one that your users would not recognize.

Note

The published name is read when a user logs in, and is kept for the duration of that user session. After you change the metadata of your identity provider, users need to log out and log in again before the new name appears. The three keys above, by contrast, take effect the next time the Profile page is opened.

On an instance where user editing is turned off but users do not log in through an external identity provider, the message names Squirro ID and links to the Squirro ID account page. Set providerName to replace that name.

Replacing the Whole Message#

Set text to replace the default sentence with your own wording. Two placeholders are available:

  • %provider%

    Replaced by the resolved provider name.

  • %link% and %endlink%

    Wrap the words that become the link. Set link as well whenever you use those markers.

For example:

{
  "providerName": "Acme SSO",
  "text": "Your account is managed by %provider%. Open the %link%account portal%endlink% to change your details.",
  "link": "https://accounts.example.com/profile"
}

Note

A custom message is used as written for every interface language, so it is not translated. Leave text empty to keep the default message, which is available in all supported languages.

Hiding the Message#

To remove the message without replacing it, set text to a single space. That replaces the older workaround of overriding the user:settings:profile:squirroId translation key from a dashboard loader, which is no longer needed.

Contents