Administrative Roles

Overview

Administrative roles control which actions an administrator can perform in the Admin Portal. A role contains one or more capabilities, while a role assignment connects that role to a user and defines whether it applies globally or only to selected tenants.

Administrative roles are separate from Group Admin and Share Admin permissions. Those permissions control what a user can do inside a Psono group; administrative roles control access to the Admin Portal and its management functions.

Only a superuser can create or modify administrative roles and role assignments. A user with an active role assignment can access the Admin Portal without being promoted to superuser.

Built-In Roles

Psono provides the following built-in roles:

Role	Description	Scope
Full Administrator	Access to all capability-protected administrative functions.	Global only
User Administrator	Manage users and their authentication resources, sessions, recovery resources, link shares, and security reports.	Global or selected tenants
Group Administrator	Manage groups, memberships, and group share rights. The Enterprise Edition also allows this role to create managed groups.	Global or selected tenants
Read-only Auditor	View system, user, group, security-report, and fileserver information without modifying it.	Global only
Fileserver Administrator	View and manage fileserver infrastructure.	Global only

The Enterprise Edition adds these built-in roles:

Role	Description	Scope
Identity Provider Administrator	View and manage LDAP, SAML, OIDC, and SCIM integrations.	Global only
Policy Administrator	View and manage policies.	Global only
Gateway Administrator	View and manage gateways.	Global only

Built-in roles are maintained by the server and cannot be changed or deleted.

WARNING

The Full Administrator role is not the same as a superuser. Tenant management, administrative-role management, and role assignments remain restricted to superusers.

Capabilities And Scope

Capabilities determine the individual operations granted by a role. The Admin Portal groups them by area and displays a description for each capability.

The following capabilities can be limited to selected tenants:

• User access, creation, updates, deletion, and Enterprise Edition user wiping
• User sessions, second factors, recovery and emergency codes, and link shares
• Security reports
• Group access, updates, deletion, memberships, and share rights
• Enterprise Edition managed-group creation

The following areas always require global scope:

• System information and system-wide statistics
• Fileserver infrastructure
• Enterprise Edition identity providers, policies, and gateways
• Full access

A role containing any global-only capability can only be assigned globally. If a custom role already has tenant-scoped assignments, global-only capabilities cannot be added until those assignments are changed or removed.

Create A Custom Role

1. Log in to the Admin Portal as a superuser.
2. Open Settings -> Administrative roles.
3. On the Roles tab, create an administrative role.
4. Enter a unique name and an optional description.
5. Select only the capabilities required for the role.
6. Save the role.

Custom roles can be edited or deactivated. Deactivating a role immediately removes the access provided by all of its assignments without deleting them. A custom role cannot be deleted while it is assigned to a user.

Assign A Role

1. Open Settings -> Administrative roles.
2. Select the Role assignments tab and create an assignment.
3. Select an active role and the user who should receive it.
4. Keep Global scope selected to grant the role across the server, or clear it and select one or more active tenants.
5. Save the assignment.

An administrator does not need to be a member of a tenant to administer it. Access comes from the role assignment.

A user can receive multiple different roles. If several assignments grant the same capability, their tenant scopes are combined. A global grant takes precedence over tenant-limited grants. The same role can only be assigned to a user once; edit the existing assignment to add or remove tenants.

Inactive roles do not grant access. Inactive tenants are ignored when calculating an assignment's effective tenant scope.

Tenant-Scoped Access

A tenant-scoped capability applies to a user or group when at least one of the object's active tenants matches the administrator's assigned tenants. A user or group can belong to multiple tenants, so more than one tenant administrator may be able to manage the same underlying object.

Tenant-scoped administrators cannot manage superusers or users with an active administrative-role assignment. Operations outside the capabilities and tenants assigned to them are hidden or rejected by the server.

Remove Administrative Access

Delete a role assignment to remove its access permanently. Deactivate the custom role instead when access should be suspended for every user assigned to that role while preserving the assignments for later use.