Users and administrators
Every account comes from Casdoor; Casvisor has no user list of its own. What a signed-in user may do depends on one question: is this user an administrator?
Administrators
A user is an administrator when either is true:
- Is admin is turned on for them in Casdoor, which makes them an administrator of their organization.
- They belong to Casdoor's
built-inorganization.
Administrators:
- see Assets, Permissions, Sessions and Records (the operation log);
- can connect to every asset of their organization, with every action, without a permission;
- can stop anyone's session.
An administrator of one organization cannot manage the assets or permissions of another. built-in users can, which is why they should be few.
Everyone else
Users who are not administrators:
- land on the workbench, which lists only the assets a permission gives them Connect on;
- can call only the API needed to list those assets and connect to them;
- cannot see stored passwords, other people's sessions, or the operation log.
A user with no permission at all signs in to an empty workbench.
Groups
Casdoor groups carry over. The token Casdoor issues at sign-in lists the user's groups, and a permission that names a group applies to every member.
When changes in Casdoor take effect
Casvisor reads the user's groups and administrator flag from the token it gets at sign-in, and keeps that sign-in until the user signs out or the browser session ends. Adding someone to a group, removing them, turning Is admin on or off, or disabling the user in Casdoor therefore applies the next time they sign in to Casvisor, not at once.
To cut someone off now:
- Take them out of the permissions that name them, or turn those permissions off. Permissions are checked again on every connection, so this applies immediately.
- Stop their open connections under Sessions.
Signing out of Casvisor ends its own cookie only. It does not sign the user out of Casdoor, so the next visit may go through without a password, as with any single sign-on.
Protocols
Casvisor connects to SSH, RDP and VNC natively in Go and to Telnet through guacd. What each protocol supports today, how it logs in and where clipboard control is enforced.
Permissions
A permission gives users or Casdoor groups a set of actions on assets or asset tags, optionally only from certain IP addresses and only inside a time window. Casvisor evaluates permissions with Casbin on every connection.