Skip to Content

Users and groups in Jitterbit App Builder

App Builder's security model includes the familiar concepts of users and groups. Users provide the basis for authentication; security groups, authorization. Users are site-level: they do not belong to a specific application. Groups can be configured at the global environment level and also at the individual application level using Application Groups. Application Groups ship automatically along with an application as part of an LP, and are therefore carried to upstream environments whereas Groups are per App Builder environment and do not ship along with applications.

Though App Builder ships with several default users and groups, they are generally defined by the site administrator. Therefore, upgrades will leave users and groups intact.

Users

There are fundamentally two ways in which a user can authenticate:

  1. Internal. The user supplies a user name and password. App Builder validates the credentials against a local credential store.
  2. External. App Builder delegates authentication to a third-party such as a single sign-on provider.

In App Builder, privileges are not directly assigned to users. Instead, group membership determines the user's privileges. See Groups for more information.

Users have the following attributes:

  • User Name - Login user name. Users names must be unique within the system.
  • Full Name - User's full name.
  • Display Name - User's preferred name.
  • Email Address - User's email address. This may be used for sending workflow.
  • Allow Local Authentication - Indicates whether the user may log in using a password associated with the user account. This option is typically disabled for accounts associated with an external authentication provider.
  • Culture - Determines the culture used for formatting dates and numbers.
  • Last Login - The date and time that the user last logged in. Read-only.

In addition, it's possible to set the user's password. Note that this is only necessary if using the local credential store.

Default users

As noted above, App Builder ships with the following default users:

User Name Description
admin System Administrator The system administrator has access to all applications shipped with App Builder. In addition, the administrator user will be granted privileges to any newly created data sources or applications by virtue of its membership in the Administrators security group. See below for more information.
anonymous Anonymous Users The anonymous user account is principal assigned to any unauthenticated request. The anonymous user is not a member of any security groups by default and therefore does not have access to any applications shipped with App Builder. See Anonymous access for more information.
service Local Service User The service account is default user account used to execute scheduled events.

Note

The built-in user accounts cannot be deleted or modified. Any changes to the built-in users will be reverted during an App Builder upgrade.

Passwords

As noted above, App Builder supports forms-based authentication using a local credential store. In forms-based authentication, the web site visitor providers a set of credentials consisting of a user name and password. Upon successful verification of the supplied credentials, App Builder signs the user into the system.

Password storage

App Builder stores passwords securely. Specifically, App Builder uses PBKDF2 with the following parameters:

  • Hash Algorithm: SHA-256
  • Salt Length: 128 bits
  • Iterations: 10,000
  • Key Length: 128 bits

Manually resetting passwords

If access to the system has been lost, it is possible to manually modify the Se_User table, entering a password in plain text. Plain-text passwords are automatically hashed when the user first logs in.

Groups

Security groups organize users. Users can be a member of more than one security group. Administrators grant groups privileges to applications and data sources. If a data source uses roles-based authorization, groups must be granted membership in one or more roles within the data source. See Privileges & Permissions for more information regarding roles.

App Builder has Groups as well as Application Groups that can be configured. Groups are defined at the global environment level, whereas Application Groups are defined at the individual application level.

Groups have the following attributes:

  • Name - Group display name.
  • Description - Informational description displayed beneath the group name in selection lists.
  • Grant On Data Source Create - Indicates whether the group should be granted privileges to new data sources as they are created.
  • Grant On Application Create - Indicates whether the group should be granted privileges to new applications as they are created.
  • Grant On User Create - Indicates whether new users should be added to the group as they are created.

These attributes appear on the group's Edge Case tab. To view or change them, go to IDE > User Management, click the Groups tab, then open the group you want to configure. By default, only the Administrators group has Grant On Application Create and Grant On Data Source Create enabled.

Application Groups have the following attributes:

  • Name - Group display name.
  • Description - Informational description displayed beneath the group name in selection lists.
  • Application - The named application the security group belongs to.

Default groups

As noted above, App Builder ships with the following default groups:

Group Description
Administrators Users assigned to the Administrators group can access any applications or data sources shipped with App Builder. In addition, members are automatically granted access to new applications and data sources as they're created, though role permissions for those applications and data sources must still be granted manually.
Deployment Grants the Deployment role. Use this group instead of a custom group for the account a target environment authenticates as during a one-click deployment, since that account only needs to receive deployed releases.
Developers Grants the Developer role, letting members build and edit pages, tables, rules, and other components in any application, but not create or delete applications or data sources. Access to view an application's pages or a data source's results isn't included by default and must be granted separately. Use this group instead of a custom group for developers who need broad build access without administrative privileges.
Service Accounts Users assigned to the Service Accounts group can execute App Builder's scheduled events. This security group can be granted privileges and permissions to execute scheduled events in other data sources as well.
Silo Developers Restricts a developer's access to a defined set of applications and data sources. As with Developers, viewing an authorized application's pages or a data source's results isn't included by default and must be granted separately. Use this group instead of Developers when a developer's access should be limited to specific applications. See Developer silos for configuration steps.
Translators Grants the Translators role. Members can edit translation values on the Language Translations page without requiring developer-level access to the IDE. Use this group instead of a custom group for translators who only need to manage translations. See Translations for more information.
Users Members of the Users security group are granted the minimum set of privileges required to run an App Builder application. However, they don't have access to any specific App Builder applications on a default install. New users are added to the Users group as they are created.

Note

The built-in security groups cannot be deleted or modified. Any changes to the built-in security groups will be reverted during an App Builder upgrade.

Since App Builder 4.65, the default groups don't accept anonymous users. Trying to add one results in the following message being displayed:

Error text

The changes could not be saved. The anonymous user cannot be added to the security group.

See Anonymous access for information on how to grant limited access to anonymous users.

To modify a group

Modifying a group typically means granting or revoking roles for an application or data source it already has access to, or granting the group access to a new application or data source in the first place.

To grant or revoke a role:

  1. Navigate to the IDE.
  2. Click User Management.
  3. Click the Groups tab.
  4. Locate the Group you're looking to modify from the Groups panel. For example: Developers.
  5. Click the corresponding Manage Privileges button.

  6. Locate the application or data source, then locate the Role you need to add or remove, and click the Grant or Revoke button as needed.

    For example, the Audit role isn't granted to any default group by default. You might grant it to the Developers or Users group so members can view the full audit history for records.

To grant a group access to an application or data source it doesn't already have:

  1. Follow steps 1-5 above to open the group's Manage Privileges popup.
  2. Click Create.
  3. For Type, select either Application or Data Source.
  4. Use the menu that appears to select the specific application or data source.
  5. Click Save. A Roles pane appears, listing the roles available for that application or data source.
  6. In the Roles pane, click Grant for each role you want to assign to the group.

Note

Except for the Administrators group, App Builder doesn't automatically grant a default group access to any application or data source. For example, members of the Developers group can build and edit pages, tables, and rules in any application by default, but can't view an application's pages as an end user, or view rule results, until an administrator grants that application or data source to the group using the steps above.

Application groups

Application Groups are created and maintained by the application developer and are tied to singular applications. The creation and maintenance of Application Groups is primarily done through the App Workbench, with the exception of managing users belonging to the group, which is done through the IDE.

Application Groups ship automatically along with an application as part of an LP, and are therefore carried to upstream environments.

Application Groups can be viewed from IDE > User Management > Groups to provide information to an administrator or System Admin user.

To create an application group

  1. Navigate to the App Workbench
  2. Click the Roles tile
  3. Click the Application Groups button
  4. Click the Create button
  5. Assign a Name for the group. Our recommendation is to include the application name followed by the group role type. For example: Global Imports Admin
  6. Provide a Description. For example: Administrative users
  7. Click the checkmark icon to save
  8. Review the Roles panel and determine which role(s) belong in the Group. Click the Grant button for any role to add to the group. For example: Administrator
  9. Click the Open record icon for the Application Group
  10. Click the More button and select View Permissions. From this Group Permissions screen you can see all the datasource tables and objects that members of the group have access to.

To assign users to an application group

  1. Navigate to the IDE
  2. Click User Management
  3. Select the Groups navigation button
  4. Click the + Membership button
  5. Select a User to assign to the Application Group
  6. Click the checkmark icon to save