Differences

This shows you the differences between two versions of the page.

--- admin:managing_users [2024/09/03 12:09] – [Open mSupply permissions tab] Gary Willetts
+++ admin:managing_users [2025/07/28 08:29] (current) – [Active] Mark Glover
@@ Line 2: / Line 2: @@
 ====== 25.15. Managing users ======
 ===== About users and groups =====
+mSupply has a comprehensive system of controlling user access, allowing you to manage in fine detail what each user can do and see in the system. You can manage users individually, in groups or a mixture of both - whichever is most suitable for your situation.
 User permissions are per-store, so a user can have different permissions when logged into different stores.
-If you have many users that need to have the same permissions (because they carry out the same role, for example), you can create a group and assign the users to the group. Once a group is set up and permissions for the group assigned, any users that are assigned to the group will inherit the group's permissions, rather than having to set permissions for each user individually. When you change a group's permissions, you change the permissions for all users who belong to that group.
+If you have many users that need to have the same permissions (because they carry out the same role, for example), [[admin:managing_users#user_groups|User groups]] is for you.
-<WRAP center round tip 95%>
+==== Users and sync ====
-If you want to change a user's permissions and find out that all their permissions are greyed out and uneditable then it means they are a member of a group. To edit their permissions separately from the group, they must first be removed from the group:
+A few points to remember if you are working with users on a [[synchronisation:introduction|synced system]] and with newer versions of mSupply:
-  * Edit the user, change the **Is a member of** drop down list to ''None'', click **OK** (see below for details).
+  * Users are //normally// created and configured on the Legacy mSupply Central server.  These settings are then copied to remote sites when the store is transferred to the remote site.
-  * Open the user again and their permissions will be editable.
+  * //Normally//, when these configuration settings are altered on the Legacy mSupply Central server after a store has been migrated, the settings do not get synced to the remote site.  It is now possible to sync user permission settings across all stores that they have permission to log in to, regardless of which site the store is on (on the Edit user > Login rights tab).  As mSupply is currently configured, this setting defaults to ‘off’, and needs to be turned on every time a user is edited.
-Refer to [[admin:managing_users#using_groups|Using groups]] below for more details. If the user is to remain part of the group then you must change the group's permissions (see [[admin:managing_users#editing_a_group|Editing a group]] below) but beware, this will change the permissions for all users who belong to the group, not just the user you're interested in.
+  * Users can be created and edited on a Legacy mSupply remote site.  Name details of any newly created user on a remote site will sync back to the Legacy mSupply Central server.  This is primarily for the sake of reporting transactions.  Any permission edits made on the remote site will //not// sync back to the Legacy mSupply Central server.
-</WRAP>
+  * As of 2025-07-28, users can not be created or permissions edited on [[https://docs.msupply.foundation/mobile/introduction/introduction/|mSupply Mobile (Deprecated)]] or [[https://docs.msupply.foundation/docs/introduction/introduction/|Open mSupply]] sites.
-<WRAP center round important 95%>
-If you want to disable a user, perhaps because the staff member has left the organisation, then they must be made 'inactive':
-  * Edit the user, uncheck the **Active** checkbox, click **OK**.
-If the **Active** checkbox is greyed out, it is because they are a member of a group. You will need to first remove them from the group before you can make them 'inactive':
-  * Edit the user, change the **Is a member of** to ''None''
-  * Edit the user, uncheck the **Active** checkbox, click **OK**.
-Of course, if the whole group of users needs to be made inactive then you can just uncheck the **Active** checkbox for the group.
-</WRAP>
 ===== Adding and editing users and groups =====
-mSupply has a comprehensive system of controlling user access, allowing you to manage in fine detail what each user can do and see in the system. You can manage users individually, in groups or a mixture of both - whichever is most suitable for your situation.
 User access is managed by choosing **File > Edit users** from the menus, or by choosing **Admin > Edit users** in the Navigator. When clicking on this option you are presented with a list of current users:
@@ Line 52: / Line 43: @@
 ===== User details window =====
+<WRAP center round tip 95%>
+If you want to change a user's permissions and find out that all their permissions are greyed out and uneditable then it means they are a member of a group. To edit their permissions separately from the group, they must first be removed from the group:
+  * Edit the user, change the **Is a member of** drop down list to ''None'', click **OK** (see below for details).
+  * Open the user again and their permissions will be editable.
+Refer to [[admin:managing_users#using_groups|User groups]] below for more details. If the user is to remain part of the group then you must change the group's permissions (see [[admin:managing_users#editing_a_group|Editing a group]] below) but beware, this will change the permissions for all users who belong to the group, not just the user you're interested in.
+</WRAP>
 {{ :admin:edit_user_general.png?600 |}}
@@ Line 68: / Line 65: @@
 === Active ===
 If this checkbox is checked, then that user has permission to use the system, and their name will appear in the login window. If this checkbox is unchecked the user will not be allowed to login to the system and their name will not appear in the login window.
+<WRAP center round important 95%>
+If you want to disable a user, perhaps because the staff member has left the organisation, then they must be made 'inactive':
+  * Edit the user, uncheck the **Active** checkbox, click **OK**.
+If the **Active** checkbox is greyed out, it is because they are a member of a group. You will need to first remove them from the group before you can make them 'inactive':
+  * Edit the user, change the **Is a member of** to ''None''
+  * Edit the user, uncheck the **Active** checkbox, click **OK**.
+Of course, if the whole group of users needs to be made inactive then you can just uncheck the **Active** checkbox for the group.
+</WRAP>
 === Can be responsible officer ===
@@ Line 123: / Line 130: @@
 === Buttons on the Permissions tabs ===
-  * The //Store// drop down list: Selects the store for which permissions are being displayed and set on the current tab. Select the store you want to see or set permissions for in this drop down list.
+== Store ==
-  * The **All on** button: Checks all the permissions on the current tab i.e. turns them all on. There are exceptions to this for safety reasons; the //Update pack size, cost and sell price//, //Add/edit users// and //Access server administration// permissions on the **Permissions** tab are not turned on with the **All on** button.
-  * The **Copy** button: Copies the state of all the checkboxes on the tab for this store to an internal clipboard for that tab. From version 5.03 onwards, the button opens this window:{{ :admin:pasted:20230509-121327.png?300 }}
-    * In the //Permission tabs// section, select which tabs you want to copy the permissions from by checking their checkboxes.
-    * In the table, select the stores you want to copy the permissions of the current store to by checking them in the //Selected// column.
-    * Click the **OK** button to copy the selected permissions tabs of the current store to the selected stores. Click the **Cancel** button to close the window without doing anything.
-  * The **Paste** button: Only exists for versions before 5.03. Pastes the checkbox settings saved to the clipboard for the current tab to the same tab for another store. In this way, the Copy and Paste buttons are a great way of copying permission settings for tabs between stores - really handy when users have similar permissions in different stores.
+The **Store** drop down list allows you to select the store for which permissions are being displayed and set on the current tab.<WRAP tip center round 90%>
+You can type in the drop down list. If you do this, when you click on the down arrow to open it, you will only be shown stores in the list which start with what you typed. Or, if you prefix it with the mSupply wildcard character, "@", you only see stores which contain what you typed. Very helpful if you have many, many stores and want to find a specific one or group of stores.
+</WRAP>
+== All on ==
+The **All on** button turns on all the permissions on the current tab. There are exceptions to this for safety reasons; the //Update pack size, cost and sell price//, //Add/edit users// and //Access server administration// permissions on the **Permissions** tab are not turned on with the **All on** button.
+== Copy ==
+The **Copy** button copies the permission for this store to an internal clipboard.  The following window opens:{{ :admin:pasted:20230509-121327.png?300 }}
+  - In the //Permission tabs// section, select which tabs you want to copy the permissions **//from//** by checking their checkboxes.
+  - In the table, select the stores you want to paste the permissions of the current store **//to//** by checking them in the //Selected// column.
+  - Click the **OK** button to copy the selected permissions tabs of the current store to the selected stores. Click the **Cancel** button to close the window without doing anything.
+=== Permissions ===
 Most of the permissions are self explanatory. Those that need more explanation are given below:
@@ Line 141: / Line 156: @@
 | Access server administration | If this is checked the user will be able to access the server administration windows, as described on the [[admin:server_administration#when_running_the_server_as_a_service|25.13. mSupply server administration]] page. Only assign this permission to users who really know what they are doing! |
 | Add/edit sync sites | If checked the user is able to edit site settings in a synchronisation system (see the [[synchronisation:sync_sites]] page for details). This includes being able to use the sync site wizard ([[synchronisation:site_wizard|]]). |
-| Disallow adding an unordered item to a Goods Received note | If checked the user is **not** able to add items to a goods received note that are not included on a purchase order (see the [[receiving_goods:goods_receipts|]] page for details). |
+| Disallow adding an unordered item to a Goods Received note | If checked the user is **not** able to add items to a goods received note that are not included on a purchase order (see the [[receiving_goods:goods_receipts|]] page for details) |
 | **Permissions (2) Tab** ||
+| Add patients | If checked, the user can add new patients into the system |
+| Edit patient details | If checked, the user can edit the details of patients already entered into the system. Of course, this means they can also view the details of patients in the system |
+| View patients | If checked, the user can view patients' details in the system. If not checked then the user will not be able to see any patient details. |
 | Change transportation dates on finalised invoice | If checked, the user can edit the **Order written date**, **Order received date**, **Expected arrival date**, **Actual arrival date** and **Ship date** fields on the //Transport details// tab of finalised customer invoices |
 | Edit user fields on finalised invoices | The user fields are the 4 custom transaction fields that can be enabled in the preferences - see [[preferences:invoices#show_custom_transaction_fields|Invoices Preferences]] for details. If this is enabled the user can edit the contents of these fields on transactions that have already been finalised |
@@ Line 172: / Line 190: @@
 {{ :admin:screenshot_2021-10-11_at_15.24.49.png?600 |}}
-To enable a partuclar alert type for a user simply check the checkbox in the //Is enabled// column. Any alert type that has its //Is enabled// checkbox unchecked will not be displayed for a user.
+To enable a particular alert type for a user simply check the checkbox in the //Is enabled// column. Any alert type that has its //Is enabled// checkbox unchecked will not be displayed for a user.
-**Show notifications window on login**: If this is checked, as soon as a user logs in, the notifications window (displaying all the notifications they have selected in the table above), will be displayed for them. If this is unchecked, the notifications window will only be shown when the user click on the notifications icon on the Navigator:
+**Show notifications window on login**: If this is checked, as soon as a user logs in, the notifications window (displaying all the notifications they have selected in the table above), will be displayed for them. If this is unchecked, the notifications window will only be shown when the user clicks on the notifications icon on the Navigator:
 {{ :admin:screenshot_2021-10-11_at_15.36.59.png?400 |}}
-<WRAP center round important 60%>
-The notifications displayed in the desktop interface will only be for the store that the user has logged in to.
+Please note that the notifications displayed realte only to the store that the user is logged in to.
-</WRAP>
+**Show cold chain breach alerts**: If this is checked the user will see temperature breach alerts (in the store in the **Store** drop down list above the table - this is a per store permission) passed to mSupply by the cold chain app (see [[https://docs.msupply.foundation/coldchain/introduction/]] for details). If this is not checked then a user will not see temperature breach alerts that occur in this store. Please note that a user must have login rights to a store to be able to see breach alerts, whether this permission is turned on or not.
@@ Line 220: / Line 236: @@
   * "Supervisor - All stores" stores is a special mode to allow users to view information in and run reports over multiple stores. See [[other_stuff:misc_topics#supervisor_mode_-_all_stores|here]] for more information.
+**Sync user across all login stores:** This checkbox is only displayed if the currently logged in user is designated as a "special user" and they are logged into the primary server in a synchronisation system (the server where the system data iis edited). If this is checkbox is checked, when the **OK** button is clicked the user's details are synchronised with all the stores they are allowed ot login to. In this way, an administrator in a synchronisation system is able to edit user permissions and settings and have them automatically synchronised to all relevant sites.
 ==== Details tab ====
 {{ :admin:details_tab.png?600 }}
@@ Line 256: / Line 273: @@
 Note that you won't be able to delete a group that has users belonging to it. If you really want to delete the group, remove all users from the group first by editing their //Is a member of// fields.
-===== Managing and using groups =====
+===== User groups =====
 mSupply allows for a high granularity of user permission configuration.  There are literally hundreds of user permissions possible for each store in an mSupply system.  User groups assist with management of these user permissions.
@@ Line 267: / Line 284: @@
 <WRAP center round important 60%>
-A user can have permission to view or edit data while logged in to a particular store, either directly or through membership of a group.  If you want the user to //exercise// these permissions then they will also need to have permission to //log in// to the store ;-).
+A user can have permission to view or edit data while logged in to a particular store, either directly or through membership of a group.  If you want the user to //exercise// these permissions then they will also need to have permission to //log in// to the store ;-).\\
+This can be very helpful if you have a common set of permissions that you want a class of users to have, and this class of user exists in hundreds of stores.  For example, the position and duties of the Officer in Charge (OIC) will often be common to all stores.  However, you don't want the OIC of one store being able to exercise those same permissions in the 'wrong' store.  To achieve this, you can:
+  - Log in to one store and configure an **OIC** group with all the necessary OIC permissions
+  - [[admin:managing_users#copy|Copy and paste]] these permissions to //every// relevant store
+  - Create an OIC user for each store, make them a member of the **OIC** group
+  - Configure them to be able to have [[admin:managing_users#login_rights_tab|login rights]] to only the store in which you want them to exercise these permissions
 </WRAP>