User Management Page

The User Management page enables you to administer user accounts, roles, and domains for Riverbed IQ Ops. On tenants that use Single Sign-On (SSO) with an identity provider (IdP), User Access Administrators can also map IdP attributes to built-in roles on the SSO GROUPS tab.

Open the User Management Page

Navigate to the User Management page:

  1. Click System (the gear icon) at the bottom of the left menu.

  2. Open User Management.

Invite Users

Click Invite User to send Email to a specified account, asking the owner to register with Riverbed IQ Ops as a user.

Note: The Email account must be a member of a previously authorized domain.

You can also assign one or more roles appropriate for that account.

Assigning Roles

Role-Based Access Control (RBACClosed Role-Based Access Control) determines what features and content users can access throughout the applicationClosed An entity type representing software applications deployed in the customer environment that are monitored for performance and anomalies.. When you invite a user or manage existing users, you can assign one or more built-in roles to control their access level.

The role picker lists every assignable built-in role grouped by product area (for example, Scheduling, Automation, Metadata, Gen AI, Analytics, and PCM). Assign the combination that matches each user's job. A single account often has several roles at once, especially after migration from legacy platform roles.

Note: You can assign multiple built-in roles to a single user. For example, one user can have Schedule Contributor, Metadata Reader, and PCM Operator at the same time. The product evaluates the full set of assigned roles together.

For how RBAC works platform-wide and how assigned roles combine, see Role-Based Access Control. For every built-in role name and description, including feature-by-role tables, see Riverbed Console Built-in Roles. For a UI-area summary that points to the relevant role areas, see User Role Definitions.

User list and assigned roles

The User Management page lists each account with the roles currently assigned to it. After granular roles are enabled, migrated users may show several roles per account instead of a single platform role.

User Management page listing users with multiple granular roles assigned to each account.

Invite User role picker

When you click Invite User, the role assignment control lists all available built-in roles. In the Assigned Role(s) field, select every role the new account needs before you click Submit.

Invite User dialog with the Assigned Role(s) dropdown expanded to show granular built-in roles.

Edit roles for an existing user

On the user list, click the Edit (pencil) icon for the account you want to change. The Edit Roles dialog opens with the same Assigned Role(s) control used when you invite a user. Add or remove roles, then click Submit.

Edit Roles dialog showing multiple assigned granular roles and the role picker dropdown for an existing user.

Manage SSO groups

SSO groups connect attributes from your identity provider to the same built-in Role-Based Access Control (RBACClosed Role-Based Access Control) roles you assign when you invite a user. When a user signs in through Security Assertion Markup Language (SAML) or OpenID Connect (OIDC), the product compares the assertion to your group matching rules. Matching groups supply the roles for that session. You do not need to invite those users first.

Note: The SSO GROUPS tab is shown only when your tenant uses SSO with an identity provider, and only to users who have the User Access Administrator role.

Use the two tabs on the User Management page as follows:

  • USERS: Invite accounts, manage authorized domains, and assign roles directly to a user.

  • SSO GROUPS: Define group matching rules so users who sign in through the identity provider receive roles automatically.

For role names and what each role allows, see Riverbed Console Built-in Roles. For how assigned roles combine, see Role-Based Access Control.

Matching rules

Each SSO group stores one matching rule and one or more roles. A rule has three parts:

  • IdP / SAML Attribute: The claim name in the identity provider assertion, for example memberOf or department. Type the name as it appears in the assertion.

  • Operator: Equals requires an exact match. Contains matches when the claim value includes the text you enter.

  • Value: The group name, department, or other claim value to match, for example eng-admins.

If more than one group matches a user, the product applies the roles from every matching group. Group membership is evaluated each time the user signs in. After you add, change, or delete a group, affected users pick up the new mapping on their next sign-in.

Note: Group names must be unique in the tenant. You also cannot create two groups that use the same matching rule.

Add an SSO group

Create a group when users in the identity provider should receive a set of built-in roles without an invitation on the USERS tab. The steps below open the Add SSO Group dialog, define the matching rule, and assign roles.

To add an SSO group:

  1. Open the User Management page, then select the SSO GROUPS tab.

  2. Click Add Group.

  3. Under Group Info, type a Group Name. Optionally type a Description.

  4. Under Matching Rule, type the IdP / SAML Attribute, select Equals or Contains, and type the Value to match.

  5. Under Assigned Roles, add at least one built-in role. You can assign several roles to the same group.

  6. Click Add.

Find, edit, or delete an SSO group

The SSO GROUPS table lists group name, IdP attribute, match type, value, description, and assigned roles. Use search to filter the list by those fields, including role display names.

To change or remove a group:

  1. On the SSO GROUPS tab, locate the group.

  2. To change the group, click the edit (pencil) icon, update the group information, matching rule, or assigned roles, then click Save.

    1. Saving replaces the entire group definition, including the full role list.

  3. To remove the group, click the delete (trash) icon, then confirm. Users who matched only that group no longer receive those roles after their next sign-in.

Manage Authorized Domains

Only Email accounts that belong to authorized domains can be used to invite users to access Riverbed IQ Ops.

Click Manage Authorized Domains to add or delete domains that your organization trusts for authorizing users and sending and receiving Email.