.. _create_a_user: .. rst-class:: chapter-with-expand Create a User ------------- .. _20.1.1|VOSS-551: .. _20.1.1|EKB-6059: Users are typically added or updated on VOSS-4-UC from the sync source, e.g. LDAP, CUCM, CUC, etc. See :ref:`user-sync-source` for more details. The **Users** form is primarily used to add or update Administrator (Admin) Users using VOSS-4-UC (see *How to Create an Administrator User* below). .. important:: Sync Source precedence may override user input. If you update a user on VOSS-4-UC: * that exists on a sync source * has mapped fields * has a higher precedence than LOCAL (VOSS-4-UC) data the data of these fields will be updated from the sync source and not the user input added in VOSS-4-UC. The Admin Portal would typically render these fields read-only. .. rubric:: Sync Source Scenarios * :ref:`add-user-sync-scenarios` * :ref:`update-user-sync-scenarios` * :ref:`ldap-add-sync-scenarios` * :ref:`ldap-update-delete-sync-scenarios` See also: * :ref:`user-field-mapping` * :ref:`user-login-auth-method-srv-auth-scope` .. rubric:: How to Create an Administrator User To manually create an Admin User: 1. Log in at the hierarchy node where you want to create the Admin user. #. Open the **Users** form (default menu **User Management > Users**). #. Click **Add**. #. Complete the required mandatory and optional fields required for an Admin user on the tabs below. .. note:: The interface of the **Role** will set the **User Type**. To add an Admin user, the interface of the **Role** needs to be "administrator". #. Click **Save** when complete. The Admin user is created. User Details ............ .. tabularcolumns:: |p{2.5cm}|p{12.5cm}| +--------------------------+-------------------------------------------------------------------+ | Fields | Description | +==========================+===================================================================+ | User Name\* | Sign-in username. This field is mandatory. | +--------------------------+-------------------------------------------------------------------+ | Role\* | Choose the user's role. This field is | | | mandatory. | +--------------------------+-------------------------------------------------------------------+ | | Choose the entitlement profile that | | Entitlement Profile | specifies which devices and services the | | | user is entitled to. | +--------------------------+-------------------------------------------------------------------+ | | Choose the user's language. | | | | | | Note: | | | | | | If no language is selected, the language is | | | inherited from the nearest hierarchy node | | | (at or above the user) that has a default | | | language configured. If no default language | | | is configured anywhere in the hierarchy at | | | or above the user, the user's language is | | Language | English. | | | | | | Note: | | | | | | If a language is manually set for a user, | | | that language remains unchanged even if the | | | user is moved to a new place in the | | | hierarchy. However, if the language is | | | inherited, then the user's language changes | | | when the user is moved to a hierarchy node | | | that has a different default language. | +--------------------------+-------------------------------------------------------------------+ | Exclude from | If this check box is selected, the user will **not** appear in | | Directory | the corporate directory accessed via VOSS-4-UC Phone Services | | | - [#]_ | +--------------------------+-------------------------------------------------------------------+ | Sync Source | Identifies the application from which the | | | user (and user data) was synced, i.e. LOCAL | | | (VOSS-4-UC), CUCM or MS-LDAP. This field is | | | read only. | +--------------------------+-------------------------------------------------------------------+ | User Type | Cannot be edited - determined by the | | | Role interface (administration / selfservice). | +--------------------------+-------------------------------------------------------------------+ | Auth Method | Identifies the authentication method for the | | | user - [#]_ | | | | | | This section is *applicable to End Users only*. | | | | | | * Local - VOSS-4-UC User | | | * Automatic - If LDAP or SSO set at hierarchy or above, use this | | | * LDAP - [#]_ | | | * SSO - [#]_ | +--------------------------+-------------------------------------------------------------------+ | LDAP Server and Username | Only editable when **Auth Method** is LDAP | +--------------------------+-------------------------------------------------------------------+ | LDAP Username | Only editable when **Auth Method** is LDAP | +--------------------------+-------------------------------------------------------------------+ | SSO Identity Provider | Only editable when **Auth Method** is SSO | +--------------------------+-------------------------------------------------------------------+ | SSO Username | Only editable when **Auth Method** is SSO. Defaults to VOSS-4-UC | | | username. | +--------------------------+-------------------------------------------------------------------+ .. [#] See :ref:`phone-services-feature-setup` .. [#] See :ref:`user-authentication-methods` .. [#] See :ref:`view_and_update_ldap_authentication_users` .. [#] See :ref:`sso-overview` Account Information ................... .. tabularcolumns:: |p{2.5cm}|p{12.5cm}| +--------------------------+-------------------------------------------------------------------+ | Fields | Description | +==========================+===================================================================+ | Account Information | The administrator can manage the user's | | | account information, including: | | | | | | * Change Password on next Login | | | * Credential Policy | | | * Disabled (Y/N) | | | * Reason for Disable | | | * Time Locked Due to Failed Login Attempts | | | * Time of Last Successful Login | | | * Locked (Y/N) | | | * Security Questions | | | * Used Passwords | +--------------------------+-------------------------------------------------------------------+ Contact Information ................... User contact information such as employee number, employee type, country, state, state, street, department, manager, Fax number, directory URL, Jabber ID, telephone number, mobile, IP phone, etc. This tab is **applicable to End Users only**. Provisioning Status ........................ Provides a view showing the composition of the user, this typically includes: * CUCM * CUC * VOSS User Hierarchy * CUCM User Hierarchy * CUC User Hierarchy * CUCM 1 to N Select the **Provisioned** check box to view additional CUCM's if applicable. This tab is **applicable to End Users only**. If the user is added to an LDAP server (see the **LDAP** section below), then the provisioning status will also show the server here next to the **LDAP** label. Links ....... Provides direct hyperlinks to the associated user apps, such as: CUCM Subscriber, CUC User Voicemails, WebEx Teams user and UCCX Agent. This tab is **applicable to End Users only**. Custom ....... User defined customized strings and booleans. This tab is **applicable to End Users only**. LDAP .... If a secure Microsoft Active Directory LDAP server (port ``636``) is configured higher in the user hierarchy and the server has **Enable Write Operations** checked, user details can be managed on the server if it is selected from the **LDAP Server** drop down list. Only secure LDAP servers are listed. If no suitable servers have been set up, then the tab will not display any fields. If no such Microsoft Active Directory LDAP server is configured and enabled, the tab will show a message to indicate this. For setup server details, see: :ref:`set_up_an_ldap_server`. If the Microsoft Active Directory LDAP server is configured and the user already exists on this server, the tab will show a message to indicate this. The **User Account Control** dropdown supports the following values: **Normal Account**, **Enabled, Password Not Required** and **Enabled, Password Doesn't Expire**. .. important:: * User management on the LDAP server from this tab is *not* supported if the **LDAP server** is not secure, in other words if indicated with port ``389``. * When adding a user to the LDAP server for the *first* time: * A **Password** is required. * The **Action > Push To Ldap** menu must be used to add the user. The **Save** menu can then be used upon subsequent user updates on the LDAP server. (If the **Save** button is used the first time, other user details will be saved, but no LDAP user is added.) When the LDAP user is added, the **User Details** tab will show the **Sync Source** and **Sync Type** of the user as ``LDAP``. For details on updating and deleting the user on the LDAP server, see: :ref:`update-a-user`. .. note:: * If SSO is enabled for the hierarchy node where the user is added, the corresponding SSO user is created. * IdPs are not configured at the site hierarchy node. Therefore, you can enable SSO for a user created at the site level only by performing these steps. Open the **SSO User** form (default menu **Single Sign On > SSO User**), click **Add**, and choose the IdP that can authenticate the user. See also: :ref:`update-a-user`