User management and access permissions

Trento provides local, permission-based user management to secure your console. With this feature, you can create accounts, enforce strict password policies, and assign role-based permissions. This ensures only authorized users perform protected actions such as running checks or managing SAP systems.

User management actions are performed in the Users view in the left-hand side panel of the Trento console. This entry is only visible to users with the required administrative permissions.

How Trento user access works

Access to the Trento console relies on authentication to verify the user identity, and permissions to define what the user can do.

Available authentication methods

Trento secures user profiles with strict password rules and optional multi-factor authentication (MFA). Authentication responsibilities differ based on the login method.

Local passwords

Access requires a local account and password by default. User managers with the all:users permission generate compliant passwords during the account setup. Users change these passwords securely from their profiles later.

All passwords must contain at least 8 characters. They cannot contain 3 identical sequential characters (such as 111 or aaa). They cannot contain 4 consecutive characters (such as 1234 or abcd).
Multi-factor authentication

For added security, local users can enable MFA in their Profile view. User managers cannot enable MFA for other users, but they can disable MFA for accounts to restore lost access.

Single Sign-On accounts

Third-party identity providers (IDP) manage authentication entirely when configured. Trento user managers only control the local permissions for these SSO users. For more information, see [integrating-single-sign-on].

Default access and permissions

Newly created users receive default display access to all views except the Users view. Default users can adjust filters and pagination settings to match their preferences.

To perform protected actions, the user must have additional permissions added to their user profile.

Available permissions

You can grant the following permissions to a user:

all:users

Full access to user management actions under the Users view.

all:checks_selection

Check selection capabilities for any target in the registered environment that has checks available.

all:checks_execution

Check execution capabilities for any target in the registered environment that has checks available and selected.

all:checks_customization

Customization of the expected values for configuration checks.

all:tags

Creation and deletion of the available tags.

cleanup:all

Housekeeping actions on hosts whose agent heartbeat is lost, and on SAP or SAP HANA instances that are no longer found.

operation:cluster, operation:database, operation:host, operation:sap_system

Performing operations on the specified resource type (clusters, databases, hosts or SAP systems).

operation:all

Performing operations in all resources.

all:settings

Changes to any system settings in the Settings view.

activity_log:users

Visibility of all users in the Activity Log. Without this permission, a user only sees their own user name and the user system.

all:all

All the previous permissions.

Example user roles

Combine permissions to match specific team responsibilities. You can create the following common user roles:

  • User managers: users with all:users permissions

  • SAP Basis administrator with Trento display-only access: users with default permissions

  • SAP Basis administrator with Trento configuration access: users with all:checks_selection, all:tags and all:settings permissions

  • SAP Basis administrator with Trento operation access: users with all:checks_execution, cleanup:all and operation:all permissions

Initial configuration with the default admin user

The installation process creates a default admin user with the all:all permissions. This user cannot be modified or deleted.

The default admin user is intended only for the initial configuration of user access:

  • Use it only to create the first user manager, that is, a user with the all:users permission. The user manager then creates all other required users.

  • Treat the admin user as a fallback account. Use it only if all other access to the console is lost.

You cannot enable Multi-factor authentication for the default admin user. The password provides the only security. You must keep this password safe.

If the password is lost or compromised, reset it immediately through Helm or Web component configuration, depending on which deployment method was used to install Trento Server.

Managing user access and accounts

User managers with the all:users permission can create and maintain accounts and permissions, control system access by enabling or disabling users or intervene if a user account is compromised.

Creating and editing users

Create and maintain accounts from the Users view. It requires the all:users permission.

  1. In the left sidebar of the Trento Web console, click Users.

  2. Click Create User, or select an existing user to edit.

  3. Enter the user details.

  4. Set a password or click Generate Password for a compliant one. For more information, see Available authentication methods.

  5. Select the permissions to grant.

  6. Enable or disable the user by setting their status.

  7. Optionally, set a preferred timezone. If no preference is set, the console defaults to UTC. This setting only affects how timestamps are displayed in the console. Backend storage, API payloads, logs and scheduled tasks always use UTC.

  8. Click Create for a new user, or Save for an existing user.

  9. Share the password with the user through an authorized secure channel.

When editing an existing user, the view provides additional capabilities:

  • Disable multi-factor authentication.

  • View information about the user, such as the account creation date, last login or whether they are opted into analytics collection.
Resolving access and security issues

User managers with the all:users permission can intervene when users lose access or compromise their accounts. You can perform the following security actions from the Edit User view:

Disable the user

Change the user status to disabled. This terminates active sessions immediately.

Reset the password

Generate a new password and share it with the user through a secure channel.

Disable multi-factor authentication

Turn off the MFA setting if the user loses access to their authenticator app. The user can log in with password and re-enable MFA afterward.

Delete the user

From the main Users view, remove unnecessary accounts entirely by clicking Delete (except for the default admin user, which cannot be deleted).

Managing personal profile settings

Every user can manage their own profile settings. You do not need additional permissions for these actions.

  1. In the Trento Web console, click your user icon and select Profile. In the profile view, users can edit the following options:

    • Update name and email address.

    • Change password.

    • Enable multi-factor authentication.

    • Set preferred timezone. This adjusts how dates and times are displayed for your user in the console. Backend storage, API payloads, logs and scheduled tasks always use UTC.

  2. Click Save.

Additionally, the Profile view also provides settings for the following features: