Managing Users

Scenarios

You can view, modify, enable, disable, and delete a user, and add a user to a user group.

Notes and Constraints

• The administrator of a superior department can add a user in the superior department to a user group in a lower-level department.
• If you have permissions for the User module, you can remove a user of a superior department out of a user group. However, as a user in a lower-level department, you have no permissions to add those removed users back to the user group.

Prerequisites

Your role has the management permission for the User module. You can check permissions of a role in Role.

Searching for and Viewing User Information

1. Log in to your bastion host system.
2. In the navigation pane on the left, choose User > User to go to the user list page.
3. View the user list.

   Table 1 Parameters in the user list

   Parameter	Description
   LoginName	Username for logging in to the system.
   UserName	Username.
   LastLoginTime	The last time when a user logged in to the bastion host.
   Status	User status. Enabled: The user has been enabled. Disabled: The user has been disabled. To enable it, see Enabling or Disabling a User. Ineffective: The user has not taken effect, as the current time precedes its configured effective time. You can change the Period of validity of the user to make it take effect. For details, see Configuring User Login Restrictions. Expired: The user has expired, as the current time is later than the expiration time configured for the user. You can change the Period of validity of the user to make it take effect. For details, see Configuring User Login Restrictions. Locked: The user has been locked.
   Role	Role of a user.
   Department	Department to which a user belongs.
   Operation	Operations that can be performed for the user.

4. Search for the target user.
   • Quick search: Enter a keyword in the search box and search for a user by login name or username.
   • Advanced search: Click Advanced next to the text box and enter keywords in the corresponding attribute search boxes to search for users.

5. View user details.
   1. Click the login name of the target user, or click Manage in the Operation column to go to the details page.
   2. In the Basic Info area, view basic user information, such as the login name, authentication type, and bound mobile number.
      Figure 1 Basic user information
      
   3. In the User Setting area, view login restrictions such as multi-factor authentication and validity period.
      Figure 2 User configuration
      
   4. In the Joined Groups area, view the user groups that the user has been added to.
      Figure 3 User group to which a user is added
      
   5. In the Authorized Account area, you can view information about the resource accounts authorized to the user.
      Figure 4 Authorized resource accounts
      

Modifying User Information

If the mobile number or email address of a user changes, update the user information in the bastion host system in a timely manner. Otherwise, the user may fail to log in to the bastion host system because they cannot receive SMS verification messages.

Adding a User to a Group

You can add users to a user group and grant permissions to the user group so that all the users in the group can inherit permissions assigned to that group. A user can be added to multiple user groups.

1. Log in to your bastion host system.
2. In the navigation pane on the left, choose User > User to go to the user list page.
3. In the Operation column of the target user, click Join.
4. In the Joinable group area, select one or more user groups and click to move them to the Joined group area.
5. Click OK.
   • On the user details page, click the login name of the target user. In the Joined Group area, view the user groups the user added to.
   • For details about how to add multiple users to a user group at once, see Adding a Member to or Removing a Member from a User Group.

Enabling or Disabling a User

Disabled users cannot log in to the bastion host or perform any operations in the bastion host system. Once a user is disabled, their existing connections will be immediately interrupted. To restore the login and operation permissions of a disabled user, you can enable the user.

The admin user cannot be disabled.

1. Log in to your bastion host system.
2. In the navigation pane on the left, choose User > User to go to the user list page.
3. In the user list, select one or more users to be enabled or disabled and click Enable or Disable in the lower left corner.
4. In the displayed dialog box, click OK.

   Return to the user list page. You can check the user status, which is Enabled or Disabled.

Exporting Users

You can export user information in batches so that you can have a local backup and edit basic user information easily.

To ensure user account security, user accounts and passwords cannot be exported.

1. Log in to your bastion host system.
2. In the navigation pane on the left, choose User > User to go to the user list page.
3. (Optional) Select all the target users. If no users are selected, all users are exported by default.
4. Click in the upper right corner to open the configuration window.

   Table 2 Exporting users

   Parameter	Description
   Set encryption password	Set an encryption password for the file to be exported. The file exported to the local PC can be opened only after the encryption password is entered. Password rules: The password must contain 8 to 32 characters. Only uppercase letters, lowercase letters, digits, and special characters (!@$%^-_=+[{}]:,./?~#*) are allowed. At least three of the four character types described above are used.
   User Password	Enter the login password of the current user to ensure the security of the exported data. If you use an IAM, SAML, or Azure AD account to log in to a bastion host, a local password is required. If it is not configured, configure one in the Profile center or contact the administrator. For details, see Changing Your Password/Setting a Local Password.
   Export Format	Select the format of the file to be exported. You can select csv or Excel.

5. Click OK.
6. Click Go to Download Center to go to the download task list.
7. When the download task progress reaches 100%, click Download in the Operation column to download the file to a local PC.

   Open the local file and enter the encryption password. After the verification is successful, you can view the exported user information.

Deleting a User

A logged-in user will be forcibly logged out immediately after it is deleted. Exercise caution when performing this operation.

If a user account is deleted, all permissions associated with the user account become invalid, and files in the user's personal net disk are cleared and cannot be restored. So, ensure that related data has been backed up before deleting the user account.

The admin user cannot be deleted.

1. Log in to your bastion host system.
2. In the navigation pane on the left, choose User > User to go to the user list page.
3. Delete any user that you no longer need.
   • Deleting a user
     1. Click Delete in the Operation column of the target use.
     2. In the displayed dialog box, click OK.
   • Batch deleting users
     1. In the user group list, select all the target users.
     2. Click Delete in the lower left corner.
     3. In the displayed dialog box, click OK.