Customer would like to limit Help Desk users to only be able to change/reset user password via the webAdmin Dashboard.
This can be done by assigning specific users in the system the User Group Admin role, as well as assigning them the webAdmin Dashboard and User Group Admin links. The best method to accomplish this task, while providing for ease of management, is to use a group to assign these rights to the users.
The following example assigns the ability to modify user objects to the users of a Help Desk.
- Create a group named HelpDeskToManageUsers.
- Assign the group the User Group Admin role* via the group's Roles tab.
- Assign the group the webAdmin Dashboard link (under the Admin Programs menu), via the group's Assignments tab.
Assign the group the User Group Admin link (under the Admin Programs menu), via the group's Assignments tab.
In addition, you can also assign the webAdmin Tree View link*(under the Admin Programs menu), via the group's Assignments tab.
- Assign the Help Desk users to the new group, via the group's Members tab.
The Help Desk users will now see a limited version of the webAdmin Dashboard. With only the User-Group Admin (and Tree Root if assigned) option. The Help Desk users will be able to modify user and group objects, including changing passwords via a user object's Authentication tab.
*Note: Due to a bug recently identified, systems running 6.5.1.x or lower will find that the User Group Admin role is not providing enough rights to change user password.
A temporary workaround is to assign the Stoneware Administrator role to the group.
However, if you use the Stoneware Administrator role the Help Desk users would then have full admin rights to UW. For this reason you will probably not want to assign them the webAdmin Tree View link, as that would give them full admin access to all directory objects. Another downside is that the Help Desk users could just assign themselves any of the webAdmin Dashboard links, thus granting them admin access to any features they want. Therefore this workaround should only be used at your discretion.
This bug has been resolved as of 6.5.2.x, with a planned release for the end of March 2018.