Productify

Appearance

User Management ​

The Manager provides comprehensive user management with role-based access control at project, tenant, and application levels.

Overview ​

Users in the Productify Framework are managed through Pocket ID. The Manager integrates with Pocket ID to handle authentication and user information.

User Roles ​

The Manager implements hierarchical role-based access control (RBAC):

Project Roles ​

  • Admin - Full control over the project and all child resources
  • Editor - Can modify resources but cannot manage users
  • Viewer - Read-only access to project resources

Tenant Roles ​

  • Admin - Full control over the tenant and its applications
  • Editor - Can modify tenant resources but cannot manage users
  • Viewer - Read-only access to tenant resources

Application Roles ​

  • Admin - Full control over the application
  • Editor - Can modify application resources
  • Viewer - Read-only access to application resources

Managing Users ​

Adding Users to Projects ​

  1. Navigate to Projects in the sidebar
  2. Select the project
  3. Click the Users tab
  4. Click Add User
  5. Search for the user by name or email
  6. Select the appropriate role
  7. Click Add

Via API:

graphql
mutation {
  addUserToProject(
    projectID: "project-uuid"
    userID: "user-uuid"
    role: admin
  ) {
    id
    role
    user {
      username
      email
    }
  }
}

Adding Users to Tenants ​

  1. Navigate to Tenants
  2. Select the tenant
  3. Click Users tab
  4. Click Add User
  5. Select user and role
  6. Click Add

Via API:

graphql
mutation {
  addUserToTenant(tenantID: "tenant-uuid", userID: "user-uuid", role: editor) {
    id
    role
  }
}

Adding Users to Applications ​

  1. Navigate to Applications
  2. Select the application
  3. Click Users tab
  4. Click Add User
  5. Select user and role
  6. Click Add

Via API:

graphql
mutation {
  addUserToApplication(
    applicationID: "app-uuid"
    userID: "user-uuid"
    role: viewer
  ) {
    id
    role
  }
}

Updating User Roles ​

Changing Project Roles ​

  1. Navigate to Project → Users
  2. Find the user in the list
  3. Click the role dropdown
  4. Select the new role
  5. Changes are saved automatically

Via API:

graphql
mutation {
  updateUserProjectRole(id: "user-project-relation-uuid", role: editor) {
    id
    role
  }
}

Changing Tenant/Application Roles ​

Follow the same process as projects, navigating to the respective resource's Users tab.

Removing Users ​

Removing from Projects ​

  1. Navigate to Project → Users
  2. Find the user
  3. Click the Remove button
  4. Confirm the removal

Via API:

graphql
mutation {
  removeUserFromProject(id: "user-project-relation-uuid")
}

WARNING

Removing a user from a project also removes their access to all child tenants and applications within that project.

The Manager can search for users in Pocket ID:

graphql
query {
  userProviderSearch(name: "john") {
    id
    username
    email
    displayName
    disabled
  }
}

This is useful when adding new users who haven't yet accessed the Manager.

Current User Information ​

Get information about the authenticated user:

graphql
query {
  me {
    id
    username
    email
    displayName
    disabled
  }
}

Access Control ​

Hierarchical Permissions ​

Access control follows a hierarchical model:

  • Project access grants access to all tenants and applications within the project
  • Tenant access grants access to all applications within the tenant
  • Application access grants access only to that specific application

Permission Inheritance ​

Permissions do NOT automatically inherit down the hierarchy. Users must be explicitly granted access at each level, unless they have project-level access.

Example:

  • User has Project Admin role → Can access all tenants and applications
  • User has Tenant Editor role → Can edit tenant and applications, but not other tenants
  • User has Application Viewer role → Can only view that specific application

Best Practices ​

Role Assignment ​

  • Grant the minimum required role for users to perform their tasks
  • Use Project Admin sparingly - only for project owners
  • Prefer Tenant/Application roles for focused responsibilities
  • Use Viewer role for auditors and observers

User Lifecycle ​

  • Onboarding - Add users to appropriate projects/tenants when they join
  • Role Changes - Update roles as responsibilities change
  • Offboarding - Remove access when users leave or change teams

Security ​

  • Regular Audits - Review user access periodically
  • Principle of Least Privilege - Grant minimal necessary permissions
  • Segregation of Duties - Separate administrative and operational roles
  • Disable Unused Accounts - Remove inactive users

Organization ​

  • Document Roles - Maintain documentation of role responsibilities
  • Naming Conventions - Use consistent naming for users
  • Group Management - Consider organizing users by team/function

Audit Logging ​

All user management operations are recorded in the audit log:

graphql
query {
  auditLogs(
    projectID: "project-uuid"
    filters: [{ field: "entity_type", value: "User2Project" }]
    order: { field: "created_at", direction: DESC }
    pagination: { limit: 50, offset: 0 }
  ) {
    id
    action
    description
    user {
      username
    }
    createdAt
  }
}

See Audit Logs for more details.

Troubleshooting ​

User Not Found ​

Issue: User cannot be found when searching

Solutions:

  • Verify user exists in Pocket ID
  • Check Pocket ID connection
  • Ensure user has logged in at least once
  • Verify spelling of username/email

Access Denied ​

Issue: User cannot access resources

Solutions:

  • Verify user has appropriate role at correct level
  • Check role permissions match required action
  • Confirm user is not disabled in Pocket ID
  • Review audit logs for permission changes

Cannot Add User ​

Issue: Unable to add user to project/tenant/application

Solutions:

  • Verify you have Admin role at that level
  • Check user is not already added
  • Ensure user exists in system (may need to login first)
  • Verify Pocket ID is accessible

Integration with Pocket ID ​

The Manager integrates with Pocket ID for user management:

Configuration ​

Pocket ID API connection is configured in the Manager's config file:

yaml
pocket_id:
  host: http://pocketid:1411
  api_key: your-api-key

User Authentication

User login via OAuth/OIDC is handled by the Proxy component. See Proxy Configuration for OIDC client setup.

See Configuration for details.

API Reference ​

Complete user management API documentation:

See the full API Reference for all user management operations.