Differences

This shows you the differences between two versions of the page.

--- admin:managing_users [2025/07/28 08:16] – [About users and groups] Mark Glover
+++ admin:managing_users [2025/11/04 05:14] (current) – [Sync user across all login stores] Mark Glover
@@ Line 8: / Line 8: @@
 If you have many users that need to have the same permissions (because they carry out the same role, for example), [[admin:managing_users#user_groups|User groups]] is for you.
-<WRAP center round tip 95%>
+==== Users and sync ====
-If you want to change a user's permissions and find out that all their permissions are greyed out and uneditable then it means they are a member of a group. To edit their permissions separately from the group, they must first be removed from the group:
+A few points to remember if you are working with users on a [[synchronisation:introduction|synced system]] and with newer versions of mSupply:
-  * Edit the user, change the **Is a member of** drop down list to ''None'', click **OK** (see below for details).
+  * Users are //normally// created and configured on the Legacy mSupply Central server.  These settings are then copied to remote sites when the store is transferred to the remote site.
-  * Open the user again and their permissions will be editable.
+  * //Normally//, when these configuration settings are altered on the Legacy mSupply Central server after a store has been migrated, the settings do not get synced to the remote site.  It is now possible to sync user permission settings across all stores that they have permission to log in to, regardless of which site the store is on (on the Edit user > Login rights tab).  As mSupply is currently configured, this setting defaults to ‘off’, and needs to be turned on every time a user is edited.
-Refer to [[admin:managing_users#using_groups|User groups]] below for more details. If the user is to remain part of the group then you must change the group's permissions (see [[admin:managing_users#editing_a_group|Editing a group]] below) but beware, this will change the permissions for all users who belong to the group, not just the user you're interested in.
+  * Users can be created and edited on a Legacy mSupply remote site.  Name details of any newly created user on a remote site will sync back to the Legacy mSupply Central server.  This is primarily for the sake of reporting transactions.  Any permission edits made on the remote site will //not// sync back to the Legacy mSupply Central server.
-</WRAP>
+  * As of 2025-07-28, users can not be created or permissions edited on [[https://docs.msupply.foundation/mobile/introduction/introduction/|mSupply Mobile (Deprecated)]] or [[https://docs.msupply.foundation/docs/introduction/introduction/|Open mSupply]] sites.
-<WRAP center round important 95%>
-If you want to disable a user, perhaps because the staff member has left the organisation, then they must be made 'inactive':
-  * Edit the user, uncheck the **Active** checkbox, click **OK**.
-If the **Active** checkbox is greyed out, it is because they are a member of a group. You will need to first remove them from the group before you can make them 'inactive':
-  * Edit the user, change the **Is a member of** to ''None''
-  * Edit the user, uncheck the **Active** checkbox, click **OK**.
-Of course, if the whole group of users needs to be made inactive then you can just uncheck the **Active** checkbox for the group.
-</WRAP>
@@ Line 53: / Line 43: @@
 ===== User details window =====
+<WRAP center round tip 95%>
+If you want to change a user's permissions and find out that all their permissions are greyed out and uneditable then it means they are a member of a group. To edit their permissions separately from the group, they must first be removed from the group:
+  * Edit the user, change the **Is a member of** drop down list to ''None'', click **OK** (see below for details).
+  * Open the user again and their permissions will be editable.
+Refer to [[admin:managing_users#using_groups|User groups]] below for more details. If the user is to remain part of the group then you must change the group's permissions (see [[admin:managing_users#editing_a_group|Editing a group]] below) but beware, this will change the permissions for all users who belong to the group, not just the user you're interested in.
+</WRAP>
 {{ :admin:edit_user_general.png?600 |}}
@@ Line 69: / Line 65: @@
 === Active ===
 If this checkbox is checked, then that user has permission to use the system, and their name will appear in the login window. If this checkbox is unchecked the user will not be allowed to login to the system and their name will not appear in the login window.
+<WRAP center round important 95%>
+If you want to disable a user, perhaps because the staff member has left the organisation, then they must be made 'inactive':
+  * Edit the user, uncheck the **Active** checkbox, click **OK**.
+If the **Active** checkbox is greyed out, it is because they are a member of a group. You will need to first remove them from the group before you can make them 'inactive':
+  * Edit the user, change the **Is a member of** to ''None''
+  * Edit the user, uncheck the **Active** checkbox, click **OK**.
+Of course, if the whole group of users needs to be made inactive then you can just uncheck the **Active** checkbox for the group.
+</WRAP>
 === Can be responsible officer ===
@@ Line 230: / Line 236: @@
   * "Supervisor - All stores" stores is a special mode to allow users to view information in and run reports over multiple stores. See [[other_stuff:misc_topics#supervisor_mode_-_all_stores|here]] for more information.
-**Sync user across all login stores:** This checkbox is only displayed if the currently logged in user is designated as a "special user" and they are logged into the primary server in a synchronisation system (the server where the system data iis edited). If this is checkbox is checked, when the **OK** button is clicked the user's details are synchronised with all the stores they are allowed ot login to. In this way, an administrator in a synchronisation system is able to edit user permissions and settings and have them automatically synchronised to all relevant sites.
+=== Sync user across all login stores ===
+The **Sync user across all login stores** checkbox is only displayed if the currently logged in user is designated as a '**special user**' and they are logged into the primary server in a synchronisation system.  If this checkbox is checked, when the **OK** button is clicked the user's details are synchronised to all the stores that the user is allowed to login to, whichever sites those stores are Active on.  In this way, an administrator in a synchronisation system is able to edit user permissions and settings and have them automatically synchronised to all relevant sites, rather than having to log in remotely to those sites and configure permissions locally.  <WRAP center round tip 60%>
+As you can imagine, **Sync user across all login stores** is a powerful feature, and can have unintended consequences.  Therefore as of 2025-11-04, there are restrictions on who can be configured as a '**special user**'.  Contact [[support@msupply.foundation]] for assistance.
+</WRAP>
+<WRAP center round important 60%>
+**Sync user across all login stores** will propagate:
+  * Group permissions
+  * User group membership (which group the user is a member of)
+  * User permissions, if the user is not a member of a group
+  * User store login permissions
+**Sync user across all login stores** will <wrap em>NOT</wrap> propagate:
+  * User deletion
+  * Group deletion
+Deleting the user or group on remote sites must be carried out by either of:
+  * Manually logging in to those sites and editing users, or
+  * Development and execution of custom 'footrunner' code on the Central server that will propagate these changes.  Contact [[support@msupply.foundation]] for assistance.
+</WRAP>
 ==== Details tab ====
 {{ :admin:details_tab.png?600 }}