Is it possible to grant full Access Management ability without granting Admin?

Question

I have a requirement where we need to create a Tridion group, let's call it "Limited Production Support", that can only administer users in Tridion. Their activities would be limited to:

1. adding new users into Tridion
2. assigning users to existing groups
3. enabling/disabling users

Can this be achieved without having to grant Administrator privileges, e.g. by creating a special group?

The reason for this requirement is that the Production Support department has some team members who are not so savvy with Tridion and have a record of doing stuff they're not supposed to in Production environments. So we don't want them to "accidentally" mess up existing configurations.

Answer 1

Yes - it is possible to do what you want, but not in the way you describe. Assuming that the groups are created/configured by a Tridion system administrator, you can manage all of those things in an external directory using Tridion's LDAP integration functionality. Taking your requirements in turn:

Adding new users

Ensure that Group synchronisation is configured, add your new user to a group that is mapped in Tridion, and the user will be added on first logon.

Assigning users to existing groups

Add the user to a group in the directory (obviously also one with a Tridion mapping)

Enabling/disabling users

As long as all your permissions are granted via an external mapping, then removing all group memberships will effectively disable a user.

Obviously, you'd want to work through your design in detail to check that all your needs are met, but that's it in broad strokes.

Answer 2

Unfortunately this is not possible OOTB. You may need to create a separate UI for user/group management - good candidate for a power tool IMHO.

Answer 3

Apart from @Nuno answer, I want to add one more suggestion.

Create a Core Services Page for Production Support Department which should allow

• Adding new users
• Assigning users to existing groups
• Enabling/disabling users

Restrict this page with a specific user group access, so that no other user can misuse this page.