Roles and permissions

A user of Nexus Telemetry Fleet has one of 4 roles: Owner, Admin, Operator or Viewer. Each role has a fixed set of the 6 permissions below. Owner and Admin differ in billing, which has no interface yet, in an Owner’s account, which only an Owner changes, and in the sign-in policy: with Password set to Owners only, an Owner signs in with a password and an Admin signs in with Microsoft. See Users and roles for adding users and setting their roles.

Permission matrix

Permission Allows Owner Admin Operator Viewer
View Reading the dashboard, a terminal’s page, the Certificates page and the Settings page yes yes yes yes
Terminal actions Every action on one terminal: rename, update, reboot, speed test, acknowledge and silence its alerts, set its location, rotate or revoke its certificate, decommission it, remove its record, and re-admit it. See Retire and revoke yes yes yes no
Manage certificates and tokens Generating and revoking enrolment tokens, rotating the CA certificate and the Fleet Server Certificate, and the actions on the root key. See Best practice yes yes no no
Manage groups and organisation settings Creating and changing groups, alerts, group maintenance windows, connectivity check targets and fleet-wide settings, and opening the availability report and the audit trail yes yes no no
Manage users Adding, changing and deleting users, and creating organisations yes yes no no
Billing Nothing yet. The permission exists for billing, which has no interface yes no no no

A role the fleet server does not recognise is treated as Viewer.

Conditions that override the matrix

Condition Effect
The user is not in the platform organisation, the one that manages the fleet server The user cannot change fleet-wide settings, the Fleet Server Certificate or the fleet server’s own root key, and cannot open Server health, Licence or Operator Audit, whatever the role. See Organisations
The user has group access set The user sees only the terminals in those groups, whatever the role. A terminal in no group is not seen. Group access on an Owner narrows what the owner sees
The address of another organisation A request for a parent, a sibling or an unknown organisation gets a not found response, 404, never a forbidden one, 403
No licence key is stored Every page redirects to Licence. The API answers 402
The licence key expired more than 2 weeks ago Every request that changes anything is refused with 402, whatever the role. See Private deployment
No user exists yet Anyone who can reach the dashboard is let in with every permission, until the first user is created
A password must be set Every page redirects to the password form until it is
The organisation, or an organisation above it, is suspended or cancelled Sign-in is refused, with the same message as a wrong password
The last Owner Cannot be deleted or given another role
The target account is an Owner and the user is an Admin Adding it, changing its role, and resetting its password or second factor are refused with Only an Owner changes an Owner’s account.
The user is in the platform organisation and the host is not in NF_PLATFORM_SIGN_IN_HOSTS Sign-in is refused, with the same message as a wrong password. A session is not honoured, and no reset code is sent. With the variable unset, every host is allowed
The user’s own account A user cannot change their own role, or delete their own account

Pages by role

Platform means the user must be in the platform organisation as well as have the role.

Page Owner Admin Operator Viewer
The dashboard and its views yes yes yes yes
A group’s page yes yes yes yes
A terminal’s page, reading it yes yes yes yes
A terminal’s actions yes yes yes no
Certificates, reading it yes yes yes yes
Certificates actions, and the root key panel yes yes no no
Settings, the page yes yes yes yes
Settings, the sign-in policy, alerts and connectivity checks yes yes no no
Settings, the fleet server sections platform platform no no
Groups yes yes no no
Alerts yes yes no no
Maintenance, for one terminal yes yes yes no
Maintenance, for a group yes yes no no
Availability Report yes yes no no
An organisation’s audit trail yes yes no no
Operator Audit platform platform no no
Users yes yes no no
Tokens yes yes no no
Organisations yes yes no no
Server health platform platform platform platform
Licence, reading it platform platform platform platform
Licence, applying or removing a licence key platform platform no no

Groups, Alerts, Availability Report, Users, Tokens and Organisations cannot be opened without the permission. Certificates and Settings open for every role. A section a role cannot open is not shown, and in the platform organisation a section a role cannot change is disabled with a line saying so. The account page opens for every role.

← Files and repositories Log events →