Managing users
In order to access the SC//Reliant™ platform, you must have a user account. Each user account is assigned a role that consists of one or more permissions that control access to SC//Reliant resources. The following documentation walks you through creating and updating user accounts and understanding user roles and permissions.
Identity model
Identity is the primary control surface for access to the SC//Reliant platform. Every administrative action is tied to a unique, named user account; shared administrator or operator accounts are not permitted, so each change in the platform can be traced to an individual. Account lifecycle (joiner, mover, leaver) is intended to mirror the source-of-truth identity system rather than drift over time. When the SC//Reliant Platform Manager is federated to a customer-managed identity provider, joiner / mover / leaver de-provisioning can be automated through System for Cross-domain Identity Management (SCIM) integration so that account state in the platform tracks the state of accounts in the upstream directory or HR system.
Authentication
Access to the SC//Reliant Platform Manager requires multi-factor authentication. Two authentication paths are supported:
- Cisco Duo MFA. The built-in MFA option for accounts authenticated directly against the SC//Reliant Platform Manager.
- Federated SAML 2.0. Single sign-on to a customer-managed identity provider. Supported IdPs include Okta, JumpCloud, OneLogin, and Google.
Federation places authentication, MFA enforcement, and conditional-access policy (device posture, geo-restriction, risk-based step-up) in the customer's identity provider so that existing identity policies govern access to the SC//Reliant Platform Manager without duplication. Session logging, role-based access enforcement, and idle-session disconnect timers apply on all administrative access paths.
For the procedural steps to configure SAML federation, see Access using an Identity Provider that supports SAML 2.0.
Authorization
Authorization in the SC//Reliant platform is role-based. Each user is assigned exactly one role, and that role determines the set of capabilities the user can exercise in each of their Assigned Sites. Roles are designed for separation of duties: the available built-in roles distinguish read-only consumers of data, day-to-day operators, security administrators, and installation integrators, and access is granted based on documented job role and business need.
In addition to capability-based permissions, roles can be scoped at the property level to control which specific node and node-group properties the role is allowed to edit. This allows fine-grained delegation, for example a role that can update network configuration on nodes without being able to modify payment-device or store configuration.
Sites and access
Each SC//Reliant Platform Manager tenant appears as a site in the console. An organization can have more than one site, for example separate sites for user acceptance testing (UAT) and production. Two settings on a user account determine which sites the user can reach and how they sign in:
- Assigned Sites. The sites the user can open. A user assigned to more than one site can switch between them in the console. Site access comes only from Assigned Sites; the user's role doesn't grant access to a site.
- Authorization Site. One of the user's Assigned Sites. The user signs in with the authentication method configured for this site, either Cisco Duo MFA or SAML 2.0 federation, and then has access to all of their Assigned Sites.
The user's role then determines what they can do in each of their Assigned Sites. A role can be global or assigned to specific sites, which affects which users can hold it. For more information, see Role scope.
To change a user's Assigned Sites or Authorization Site, contact your SC//Reliant administrator or your Scale Computing Account Manager.
The pages in this section describe how to create and manage users, assign roles, and understand roles and permissions:
- Creating a user
- Updating a user
- Configuring shell access
- Managing user roles
- Managing user permissions