Docs

Users

What this screen is for

The Users tab is the register of everyone who may sign in to this Fenwave install. An administrator creates the account here first; the person then signs in with GitHub or Bitbucket and Fenwave fills in their profile.

Users cannot create their own account

There is no self-registration and no self-service profile editing. If someone is not in this table, they cannot sign in — no matter how valid their GitHub account is.

Before you start

To do this You need
See the tab platform-settings.user.read
Add a user platform-settings.user.create
Edit a user platform-settings.user.update
Delete a user platform-settings.user.delete
Put a user in a group platform-settings.user.assign-group

You also need at least one role to exist before adding anyone — a user without a role can sign in and see almost nothing. See Roles.

Opening it

  1. Settings › People & Access
  2. Select the Users tab (it opens here by default).

Direct URL: /platform-settings/access

The interface

📸 Screenshot Placeholder: The Users tab. Mark: (1) Add User button, (2) the search field, (3) the role chip on a row, (4) the profile chip showing Dev or DevOps, (5) the edit and delete icons at the end of a row.

# Control What it does When you’d use it
1 Add User Opens the creation dialog Onboarding someone
2 Search Filters the table Any install past a screenful of people
3 Role chip Shows the roles the user holds Checking access at a glance
4 Profile chip Dev or DevOps — the user’s profile type Telling apart the two permission families
5 Edit / delete icons Change or remove the user Role changes, offboarding

The delete icon is disabled on your own row when you are an administrator, with a tooltip explaining why: an admin cannot delete their own account. This exists so an install cannot be locked out of its own administration.

Walkthroughs

Add a user

Requires platform-settings.user.create.

  1. Go to Settings › People & Access › Users.
  2. Click Add User.
  3. Fill in:
    • Username — the exact GitHub or Bitbucket username. Not a display name, not an email prefix.
    • Display name — how they appear in the UI.
    • Email — must match the email on their OAuth account exactly.
    • Profile — Dev or DevOps. Set this before picking roles, because it filters them: a Dev profile cannot hold a role marked DevOps, and switching the profile to Dev clears an incompatible role that was already selected. Roles you cannot pick are listed as “— requires DevOps profile”.
    • Roles — at least one, or they will sign in to an empty platform.
  4. Save.

Profile decides which licence seat is consumed

Dev and DevOps seats are counted from separate pools. A user whose profile was never set counts against the dev pool regardless of what they actually do — so a team of DevOps hires with unset profiles will appear to fit a licence they are in fact exceeding. Set the profile explicitly on every user. 5. Tell them to sign in with the matching provider. Their profile is created on first login.

Change what a user can do

Requires platform-settings.user.update.

  1. Find the user, click the edit icon.
  2. Add or remove roles. Permissions are never edited on the user directly — change the role, or give them a different one.
  3. Save. Ask them to reload; permission results are cached for their session.

Remove a user

Requires platform-settings.user.delete.

  1. Find the user, click the delete icon.
  2. Confirm.

You cannot delete your own administrator account. If you are handing over administration, add the new administrator first and have them remove you.

Scenario

Offboarding a developer who is leaving on Friday.

  1. Settings › People & Access › Users, search for their username.
  2. Note which roles they hold — you will want this if their replacement needs the same access.
  3. Check the Groups tab for groups that list them as the only member; a group with no members leaves its components unowned.
  4. Delete the user. They lose access on their next request; no cluster credentials are affected, because access is resolved per request rather than issued to them.
  5. Verify in Access Explorer that lookups for their username now return nothing.

When it doesn’t work

Symptom Cause How to check Fix
User added, but sign-in fails Email does not match the OAuth account Compare against their GitHub/Bitbucket profile Edit the user and correct the email
Sign-in works, but the platform is empty No role assigned, or the role has no policies Access Explorer for that username Assign a role that carries policies
Add User button is absent Missing platform-settings.user.create Access Explorer for yourself Ask for a role granting it
Delete icon disabled on your own row Administrators cannot delete their own account Tooltip on the icon Have another administrator do it
Role change made, user sees no difference Session permission cache — Ask them to reload the page

Next

  • Groups — organise users into teams
  • Roles — what you are actually assigning here