Assign administrator level access

PaperCut NG/MF sets up one administrator account called admin. This is the master administrator account, with access to all features, whose password is assigned during the configuration wizard. In large organizations it is likely that administrator level access is granted to more than one person. One solution is to give all persons the master password; however, the recommended approach is to assign administrator rights to these individual's network user accounts. The advantages of this approach are:

They can access the administration pages using their own username and password (they don't have to remember another password!).
You can assign different levels of administrator access to the user. PaperCut NG/MF includes an advanced Access Control List (ACL) allowing different administrators access to different functions and areas of the application.
Most activity is audited so changes can be sourced to an individual.

You can assign administrator access at the group or user level. Assigning admin access to a group is convenient for giving the same permissions to multiple users. Assigning admin access to a user is useful when specific permissions are required. See the following sections for more detail.

TIP

Administrative users should login via http://servername:9191/admin rather than http://servername:9191/, http://servername:9191/app or http://servername:9191/user so that they are directed to the correct interface.

IMPORTANT

PaperCut NG/MF allows different levels of administrator access to be defined via access control list. The access list is presented as a series of check boxes enabling or disabling access to selected features or application areas. For security reasons it is advisable to:

Grant the user's own accounts administrator level rights rather than have them use the general built-in admin account.
Grant the administrator the minimum level rights need for them to perform their job.
ACL configuration can be complex. Always test that the ACL rights assigned work as expected by asking the administrator to log in and verify that they can access the required program functions, and only those functions.

WARNING

Granting permission to Access users section > Perform bulk changes allows the selected admin to change several user attributes including:

Edit credit balance—adjust or set users' account balances.
Change settings—change restrictionsRestrictions are a type of print filter that ensures jobs meet certain criteria (denying those that don't). For example, you can restrict access to one or more printer, define a maximum number of pages allowed in a single job, or allow only duplex., change overdraft limits, change account selection settings, override printer/device settings, enable delegated print release, change unauthenticated user status, and enable/disable user printing.
Generate new card/ID numbers—generate primary and secondary card/ID numbers.
Reset statistics—reset users count statistics back to zero.
Delete users—permanently delete users.

Assigning administrator access to a group

Assigning administrator access to a group is useful when many users all require access to the same functionality. For example, the Administrators group might be assigned access to reporting functionality only.

Groups in PaperCut NG/MF are mirrored from the domain / directory server. Before you can use a group, you must add it to PaperCut NG/MF (see Groups in PaperCut NG/MF for more information). By default PaperCut NG/MF synchronizes users' group membership with the domain / directory server overnight. If a user has been added to a group in the domain / directory and requires group level admin access on the same day, run a manual synchronization. See Synchronize user and group details for more information.

Example: assigning the Administrators group access to reporting features:

Log in to the system as the built in admin user.
Ensure that the Administrators group has been imported into PaperCut NG/MF (see Groups in PaperCut NG/MF for more information).
Select Options > Admin Rights.

The Admin Rights page is displayed.
In Assign administrator access to this group, select the Administrators group from the list; then click Add Group.
By default the Administrators group has access to all features. To change this, click the edit link to the right of the Administrators entry or the name of the group itself.
Click Clear All.
Select the Access reports section check box.
Click Apply.
Test by logging into the Admin web interface as a user in the Administrators group, and checking that access is allowed just to the Reports area.

TIP

The scheduled reports feature can automatically deliver selected reports via email to interested parties. See Schedule and email reports for more information.

Assigning administrator access to a user

Assigning access to an individual user is suitable when the access rights are specific to that user. For example, the junior SysAdmin mary might be assigned access to all functionality except the ability to grant administrator rights to other users.

Assigning the user with login name mary all admin rights except the ability to grant admin rights to other users:

Select Options > Admin Rights.

The Admin Rights page is displayed.
In Assign administrator access to this user, enter mary; then click Add User.

By default mary has access to all features. To change this, click the edit link to the right of mary's entry or the name of the user.
Clear the Access admin rights settings check box.
Click Apply.
Verify that Mary can now log in to the Admin web interface, but is unable to access the Admin Rights page.