Access management¶

The Access Management module (eyssen_access_management) gives administrators three additional tools to control what a user can reach, on top of the standard access rights:

IP subnets from which a user is allowed, or not allowed, to log in;
restricted menus, to hide menu items from a user;
model domain rules, to reserve a set of records for some users in the views.

It also keeps a log of the logins of every user.

Note

To install the module, go to Settings ‣ eYssen ERP, and, in the General Modules section, enable Access Management. See eYssen ERP settings.
All the features described on this page are only available to users whose Administration access right is set to Access Rights or Settings.

The rules can be managed from two places:

on the user: go to Settings ‣ Users & Companies ‣ Users, open a user, and click the Access Management tab, which contains the IP Subnets, Restricted Menus, and Model Domain Rules sub-tabs;
for all users at once: from the Settings ‣ Access Management menu.

screenshot: general-access-management-user-tab

menu: Settings ‣ Users & Companies ‣ Users ‣ (open a user) ‣ Access Management tab
shows: The Access Management tab of a user form with its three sub-tabs; the IP Subnets sub-tab is open with one green "Allow" line and one red "Deny" line, and the instructions list below it. The "Logins" smart button is visible at the top of the form.
highlight: The "Access Management" tab and the "Logins" smart button (red frames).
data: User "Marc Demo"; Allow IPv4 192.0.2.0/24 "Office"; Deny IPv4 192.0.2.66 "Guest Wi-Fi gateway".
module: eyssen_access_management
notes: English UI, light theme, 1440px width. Use documentation-range IP addresses only.

IP subnets¶

An IP subnet rule restricts the network addresses from which a user can log in through the login page.

To create a rule, go to Settings ‣ Access Management ‣ IP Subnets, click New, and fill in the following fields:

Rule: Allow or Deny;
Type: IPv4 or IPv6;
IP Subnet: the subnet in CIDR notation, e.g., 192.0.2.0/24. To target a single address, enter the address alone (192.0.2.78) or with a /32 suffix. An invalid subnet is refused when the rule is saved;
Users: the users the rule applies to;
Company: optionally, the company the rule belongs to;
Description: a free text, e.g., the name of the office.

The same rule can be assigned to several users. In the lists, Allow rules are displayed in green and Deny rules in red.

When a user logs in, the rules assigned to them are evaluated as follows:

If the user has no rule, they can log in from anywhere.
If the user has at least one Allow rule, they can only log in from an address that belongs to one of the allowed subnets.
If the user only has Deny rules, they can log in from anywhere, except from the denied subnets.
A Deny rule always wins: use it to exclude a smaller subnet, or a single address, from an allowed subnet.

A user who tries to log in from a forbidden address gets the message Access from this IP address is not allowed, and the attempt is recorded in the login log.

Warning

Overlapping subnets are not checked. Review the rules of a user as a whole before saving, in particular for your own administrator account, to avoid locking yourself out.
The address taken into account is the one transmitted by the reverse proxy in front of the database. If all logins appear to come from the same internal address, ask your system administrator to check the proxy configuration.

Restricted menus¶

Menu items can be hidden user by user, without creating a dedicated user group.

Open the Restricted Menus sub-tab of the user’s Access Management tab and choose how the list works with the Hide all menu items toggle:

disabled (default): all the menu items the user has access to are displayed, except the ones added to the list;
enabled: all menu items are hidden, except the ones added to the list (and provided the user has access to them).

Then, click Add a line and select the menu items. Both applications (top-level menus) and sub-menus can be selected.

Tip

When Hide all menu items is enabled, remember to add the parent menus as well: a sub-menu whose application is hidden cannot be reached.

The reverse view is available on the menu items: in developer mode, go to Settings ‣ Technical ‣ User Interface ‣ Menu Items, open a menu item, and click the Restricted Users tab. A user displayed in red sees everything but this menu item; a user displayed in green sees nothing but the menu items explicitly allowed, including this one.

Important

Menu restrictions are ignored for users whose Administration access right is Access Rights or Settings.
Hiding a menu item only removes it from the navigation. It does not change the user’s access rights on the underlying records; use groups and access rights for that.
The user has to reload the page for a change to be taken into account.

screenshot: general-access-management-restricted-menus

menu: Settings ‣ Users & Companies ‣ Users ‣ (open a user) ‣ Access Management tab ‣ Restricted Menus
shows: The Restricted Menus sub-tab with the "Hide all menu items" toggle disabled, the blue information banner explaining the mode, and a list of three hidden menu items.
highlight: The "Hide all menu items" toggle (red frame).
data: Hidden menus: "Invoicing/Configuration", "Sales/Reporting", "Employees".
module: eyssen_access_management
notes: English UI, light theme, 1440px width, crop to the tab.

Model domain rules¶

A model domain rule reserves a set of records for one or more users: the records matching the rule are only listed for the users of the rule, and are left out of the views of everybody else.

To create a rule, activate the developer mode (the filter editor is only displayed in developer mode), go to Settings ‣ Access Management ‣ Model Domain Rules, click New, and fill in:

the name of the rule;
Users: the users for whom the records are reserved;
Company: optionally, the company in which the rule applies. A rule without a company applies in every company;
Lines: click Add a line, select a Model (e.g., Sales Order), and define the Filter Domain with the domain editor. A rule can contain lines for several models.

Finally, the rule can also be assigned from the Model Domain Rules sub-tab of a user’s Access Management tab.

For each model, the records displayed to a user are determined as follows:

records that do not match any rule line with users remain visible to everybody;
records that match a rule line are only visible to the users of that rule;
records that match a line of a rule without any user are visible to everybody, even if another rule reserves them.

Example

The rule Key accounts has the users Anita and Marc, and one line on the model Sales Order with the filter Customer > Tags contains "Key account". The quotations and sales orders of the key accounts are now only listed for Anita and Marc; all the other orders remain visible to the whole sales team.

Important

Model domain rules filter the records loaded in the views of the web client (list, Kanban, etc.). They are not a security mechanism: totals of grouped views, pivot and graph analyses, exports, and printed reports are not filtered, and a record can still be opened with a direct link. For a strict restriction, ask your system administrator to set up record rules.

The rules never apply to the Users, Contacts, and Companies models.

screenshot: general-access-management-domain-rule

menu: Settings ‣ Access Management ‣ Model Domain Rules ‣ New (developer mode)
shows: A model domain rule form with its name, two users, the "Manual" type badge and one line for the model "Sales Order" with its domain.
highlight: The "Lines" list (red frame).
data: Rule "Key accounts"; users "Anita Oliver", "Marc Demo"; line model "Sales Order", domain on the customer tag "Key account".
module: eyssen_access_management
notes: English UI, light theme, 1440px width, developer mode enabled.

Note

IP subnets, model domain rules and their lines cannot be deleted from the interface. To stop using an IP subnet rule, remove its users.

Restrict journals to users¶

With the Access Management - Account module (eyssen_access_management_account), a journal can be reserved for some users without writing a domain by hand.

Go to Accounting ‣ Configuration ‣ Journals, open a journal, click the Advanced Settings tab, and select the users in the Limited Users field of the Access Rules section. The field is not available on journals of the Miscellaneous type.

Each time a journal is saved, the rules of the Automatic type are rebuilt: one rule named Access Management Rule for Journals is created per group of users, with lines on the journals, the journal entries (and therefore the invoices and bills), and the journal items. As a result, the limited journals and their entries are only listed for the selected users. Automatic rules are read-only.

In addition, the Accounting ‣ Reporting ‣ Management ‣ Invoice Analysis report only includes the invoices of the journals that are either not limited, or limited to the current user.

Note

To install the module, enable Account under Access Management in Settings ‣ eYssen ERP. In the same place, the PoS option installs the restriction of points of sale by user; see the point of sale configuration.

screenshot: general-access-management-journal

menu: Accounting ‣ Configuration ‣ Journals ‣ (open a bank journal) ‣ Advanced Settings tab
shows: The Advanced Settings tab of a journal with the "Access Rules" section and two users selected in the "Limited Users" field.
highlight: The "Limited Users" field (red frame).
data: Journal "Bank (EUR)"; limited users "Anita Oliver", "Mitchell Admin".
module: eyssen_access_management_account
notes: English UI, light theme, 1440px width, crop to the tab.

User logins¶

Every login attempt made on the login page with an existing user name is recorded with the User, the IP Address, the browser (User Agent), and, for a failed attempt, the Reason: Wrong login/password or Access from this IP address is not allowed. Successful logins are displayed in green and failed attempts in red.

To see the logins of one user, open the user and click the Logins smart button.
To see all logins, go to Settings ‣ Access Management ‣ User Logins. Use the Success and Unsuccess filters, the Date filter, and group the list by User, IP Address, Reason, or Date, e.g., to spot repeated failed attempts from one address.

The log is read-only. Attempts made with a user name that does not exist are not recorded in this list.

screenshot: general-access-management-logins

menu: Settings ‣ Access Management ‣ User Logins
shows: The login log grouped by user, with green successful lines and red failed lines showing the IP address, the reason and the user agent.
highlight: The "Reason" column (red frame).
data: Three users; at least one "Wrong login/password" and one "Access from this IP address is not allowed" line.
module: eyssen_access_management
notes: English UI, light theme, 1440px width, crop to the list. Documentation-range IP addresses only.