shonindocs

Manage access

People and groups

Administrators manage people and groups by asking the Assistant in the dashboard. See Assistant.

#Invite people

Invite bob@acme.example, Bob Jones
Invite alice@acme.example, Alice Smith, as an administrator

First and last name are required. The person gets an email with a link to choose a password: it works once and expires in 7 days. Their username is their email. With single sign-on on, people of your domains get an email to sign in with Google instead.

The same email can be a person in several Shonin orgs: each Shonin org has its own account.

#Roles

  • Administrator: people, groups, permission sets, assignments, delegations, the AWS organization, and the Assistant.
  • User: only the AWS accounts and permission sets assigned to them.

New people are users unless you ask for an administrator. The last administrator can never be demoted, turned off or deleted.

Primary admins always keep a password and an authenticator app. Only a primary admin makes or removes another primary admin, in Org settings, and a Shonin org always keeps at least one. See Second factor.

#Change, turn off, delete

  • Rename someone: only first and last name change.
  • Turn someone off: they are signed out everywhere, and can be turned on again.
  • Delete someone: it cannot be undone, and removes their assignments. The Assistant asks you to confirm.

#Passwords

Nobody chooses or sees a password for someone else. A person who forgot theirs chooses Forgot your password? on the sign-in page: the link works once and expires in 1 hour. Signed in, they change it in Personal settings → Change password.

#Groups

Create a group developers
Add bob@acme.example to developers
Assign ReadOnly to the group developers on the account staging

A permission set assigned to a group works for every member of the group. Groups live in Shonin, also with single sign-on on.

View as Markdown