Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Managed users

Delegate provider connections and synchronization resources to managed-user accounts.

CW supports managed users through a delegation model.

One CW installation stays centrally managed.

A User Profile delegates selected resources to a managed user.

CW is an advanced synchronization tool. It is not a tracker.

Managed users need to understand provider connections, synchronization resources, and their delegated scope. For that reason they dont get to create their own sync pairs etc. You only need user profiles if your goal is to link them and create Managed Users. Else dont use them!

Provider instances
        ↓
Sync Pairs, Watchers, and Webhooks
        ↓
User Profile
        ↓
User Account
        ↓
Read Only or Full Access

Remember these three concepts:

User Profile = what belongs to the user
User Account = who signs in
Access Mode = what the user may do

A provider profile stores a connection to one provider account or server.

A User Profile defines a managed user's delegated CrossWatch scope.

When using managed users, create: Dedicated provider instances, Sync Pairs, Watchers, and Webhooks for each account.

Each provider instance belongs to exactly one managed user.

Set up a managed user

An administrator can create a managed user's resources before creating the account. A Full Access user can also create and manage supported resources within their delegated scope.

1

Create provider instances

Create a provider instance for each account CrossWatch should manage.

For Alex, you might create Alex Plex, Alex Trakt, and Alex SIMKL. The built-in default instances is only for the administrator and cannot be used.

Use clear names. These instances appear in sync resources and User Profiles. Never assign them to another user's profile.

See Profiles for creating provider connections.

2

Create synchronization resources

Create the Sync Pairs, Watcher routes, and Webhook routes for that user's instances.

For example:

These are normal CrossWatch resources. Creating a user account does not create them automatically.

See Configure Pairs and Watcher.

3

Create a User Profile

Create a User Profile, such as Alex, then assign Alex's resources.

The User Profile is the delegation boundary. Assigning a synchronization resource also includes its required provider instances.

Add provider instances directly when a user needs them outside a synchronization resource.

4

Create the User Account

Create the login and assign its User Profile.

The account provides the identity. The assigned User Profile determines the available resources.

User Profiles and User Accounts

User Profile

A User Profile defines the delegated resource scope. It answers: Which CrossWatch resources belong to this user?

It can include:

  • Provider instances

  • Sync Pairs

  • Watcher routes and Webhook routes

Every included provider instance must belong only to that user.

User Account

A User Account is the login identity. It defines:

  • Username and password

  • Assigned User Profile

  • Enabled status

  • Access Mode

It answers: Who signs in, and what may they do?

Access Modes

Access Mode controls actions within the assigned User Profile. It does not control the resources a user can see.

Read Only

Read Only allows users to view their delegated environment.

This can include dashboard, watchlist, playback, activity, insights, status, and synchronization information. Read Only users cannot change normal CrossWatch resources.

Full Access

Full Access is the default for new managed users. It permits supported write actions within the delegated User Profile.

Users can create, edit, and run Sync Pairs using their delegated provider instances. They can also manage supported Watcher routes, Webhook routes, watchlists, playback, and editor functions.

A resource always stays within the User Profile boundary. Users cannot use another user's provider instances or resources.

Full Access is not administrator access.

Managed users cannot access global configuration or application user management unless delegated functionality supports it.

Example: Alex and Sam

An administrator uses one CrossWatch installation for Alex and Sam.

Both users share the installation. Each User Profile isolates the resources delegated to that user.

Provider instance ownership

A provider instance must belong to one managed user and one User Profile.

Do not share provider instances between users. This is unsupported in the UI.

config.json can represent a shared provider instance. Do not use this configuration. It creates an unsupported ownership model.

Create dedicated instances for each user. Prefer names such as Alex Plex and Sam Plex.

Assign each Sync Pair, Watcher route, and Webhook route to the profile that owns its workflow. Do not cross user boundaries.

Existing installations

You do not need to rebuild an existing CrossWatch installation.

Existing provider instances and synchronization resources can remain in use. Assign each provider instance to only one user's scope.

Create dedicated provider instances and resources when stronger separation is required.

Add another managed user

  1. Create provider instances for the user.

  2. Connect them to the correct external accounts.

  3. Create a User Profile and assign the provider instances.

  4. Create a User Account and assign the profile.

  5. Choose Read Only or Full Access.

  6. Create Sync Pairs, Watchers, and Webhooks as an administrator or Full Access user.

  7. Sign in as that user and verify the delegated scope.

Summary

Assign each provider instance to one user only. Delegate resources through a User Profile. Full Access users can create and manage supported synchronization resources within that scope.

PreviousProfiles
NextLibrary Whitelisting

Last updated

Was this helpful?