Assign administrator level access

PaperCut NG/MF sets up one administrator account called admin. This is the built-in administrator account, with access to all features, whose password is assigned during the configuration wizard. In large organizations it is likely that administrator level access is granted to more than one person. One solution is to give all persons the built-in admin account password; however, the recommended approach is to assign administrator rights to these individual’s network user accounts. The advantages of this approach are:

• They can access the administration pages using their own username and password (they don’t have to remember another password!).
• You can assign different levels of administrator access to the user. PaperCut NG/MF includes an advanced Access Control List (ACL) allowing different administrators access to different functions and areas of the application.
• Most activity is audited so changes can be sourced to an individual.

You can assign administrator access at the group or user level. Assigning admin access to a group is convenient for giving the same permissions to multiple users. Assigning admin access to a user is useful when specific permissions are required. See the following sections for more detail.

Assigning administrator access to a group

Assigning administrator access to a group is useful when many users all require access to the same functionality. For example, the Administrators group might be assigned access to reporting functionality only.

Groups in PaperCut NG/MF are mirrored from the domain / directory server. Before you can use a group, you must add it to PaperCut NG/MF (see Groups in PaperCut NG/MF for more information). By default PaperCut NG/MF synchronizes users’ group membership with the domain / directory server overnight. If a user has been added to a group in the domain / directory and requires group level admin access on the same day, run a manual synchronization. See Synchronize user and group details for more information.

Example: assigning the Administrators group access to reporting features:

1. Log in to the system as the built in admin user.

2. Select Options > Admin Rights.

   The Admin Rights page is displayed.

3. In Assign administrator access to this group, select the Administrators group from the list; then click Add Group.
   
   If the group is not visible in this list, make sure it has been imported into PaperCut NG/MF (see Groups in PaperCut NG/MF for more information).

   

4. By default the Administrators group has access to all features. To change this, click the edit link to the right of the Administrators entry or the name of the group itself.

5. Click Clear All.

   

6. Select the Access reports section check box.

7. Click Apply.

8. Test by logging into the Admin web interface as a user in the Administrators group, and checking that access is allowed just to the Reports area.

Assigning administrator access to a user

Assigning access to an individual user is suitable when the access rights are specific to that user. For example, the junior SysAdmin mary might be assigned access to all functionality except the ability to grant administrator rights to other users.

Assigning the user with login name mary all admin rights except the ability to grant admin rights to other users:

1. Select Options > Admin Rights.

   The Admin Rights page is displayed.

2. In Assign administrator access to this user, enter mary; then click Add User.

   By default mary has access to all features. To change this, click the edit link to the right of mary’s entry or the name of the user.

3. Clear the Access admin rights settings check box.

4. Click Apply.

5. Verify that Mary can now log in to the Admin web interface, but is unable to access the Admin Rights page.