📖 Navigation: User Guide | Release Notes | https://pantheon.tech/
User Management
User Management
This page describes how to manage users and their permissions in SandWork.
Prerequisites and Permissions
To manage users, you must have the
Administrative adminpermission.During deployment, a RBAC super admin user is created from a Kubernetes secret.
This super admin can:
Configure password policy for local users.
Assign initial roles.
Grant Administrative admin permission to other users.
SandWork supports:
Local accounts (credentials stored in SandWork).
External accounts via OIDC (identity from an external IdP).
Accessing User Management
Log in to SandWork.
Click your user profile (top‑right).
Select Add/remove user.
You are taken to the User Administration page, which shows:
Username, name, surname, email
Whether the user is Administrative Admin, Machine User, or External User
Assigned roles per data center (DC)
Last login time
Actions to Add User, Remove Selected, Edit, and Delete.
User Roles and Scope
User roles are assigned per data center:
Viewer
Read‑only access to the DC.
DC Admin
Day‑to‑day operational tasks.
Cannot perform DC lifecycle operations (e.g., create/delete DC).
DC Super Admin
Full control over the DC, including lifecycle operations.
A single user can have different roles in different DCs.
Adding a User
Open Add/remove user (see Accessing User Management).
Click Add User.
In the Add User dialog, fill in:
Username
Name and Surname
Email
Optional flags such as Machine User and External User (for pre‑provisioned OIDC users).
Assign initial DC roles as needed.
Save.
For local users, credentials are managed by SandWork and follow the configured password policy. For external users, authentication is handled by the IdP; SandWork stores identity metadata and role mappings.
Editing an Existing User
Go to Add/remove user.
In the User Administration table, locate the user.
Click the Edit icon in the user’s row.
The edit dialog has three main tabs:
Edit User Details
Update:
Username (if allowed)
Name and Surname
Email
Machine User flag
External/OIDC identity fields are typically read‑only and controlled by the IdP.
Adjust User Roles
For each Datacenter, set:
DC Viewer
DC Admin
DC Super Admin
Optionally toggle Administrative Admin for global user‑management capability.
Change User Password (local users only)
Set a new password respecting the active password policy.
Click Save to apply changes. The overview table refreshes with updated details and roles.
Password Policy Management (RBAC Super Admin)
Password policy for local accounts is configured centrally by the RBAC super admin.
In the Password Policy Settings dialog the admin can set:
Minimum number of characters.
Minimum number of:
Upper‑case characters
Lower‑case characters
Digits
Special characters
By default, all minimums are 0, effectively allowing any password. After deployment, the RBAC super admin should update these values to align with the organization’s security standards.
External (OIDC) Users and Role Assignment
OIDC integration is configured during SandWork deployment (see the deployment manual for details). The OIDC login is performed by detecting @ character in the login, after clicking Login button the user is redirected to the configured OIDC service.
Role assignment and onboarding work as follows:
When an OIDC user logs in for the first time, SandWork:
Creates the user in the internal RBAC database using identity data from the IdP (including email).
The user can then be assigned roles via the User Administration page.
Alternatively, an admin can:
Pre‑create a user through the UI and mark it as External User.
Assign roles before the first login.
Role mapping for external users is based on the email address:
On login, SandWork matches the authenticated OIDC user to the RBAC user record with the same email and applies the configured roles.
Deleting Users
In User Administration, select one or more users.
Click Remove Selected, or use the Delete icon in a single user’s row.
Confirm the deletion.
Deleting a user removes their RBAC record and associated role assignments. For OIDC users, their account may still exist in the IdP, but they will no longer have access through SandWork roles.