User Groups

This section of the admin panel is used to create user groups that are subject to the role model rules.

Creating a User Group

Field	Description
Group name	Specify a unique name that describes the user group.
Platform	Web, Desktop, iOS, Android. You can select all at once.
Connection type	Select the Corporate Data Transmission Network (CDTN) contour, which is configured in the File Service section: Internal loop — users within the CDTN contour will be selected: their IP address is included in the mask list from the Contour section; External loop — users outside the CDTN contour: their IP address is not included in the mask list from the Contour section. To prevent the CDTN settings from interfering with the role model, in the File Service section, enable Contour by selecting the Enabled checkbox. In all the fields of the contour rule settings, specify any. Then specify the IP masks of your corporate network.
Corporate device status	An indication that the user's device is corporate. For the attribute to work, generate and configure corporate certificates on client devices in advance, and additionally configure the server side. For details, please contact eXpress support or refer to the administrator documentation.

What Does “Corporate Device Status” Look Like on the User Side?

If the server administrator has enabled corporate status verification and the user's device has not yet been confirmed as corporate, a Confirm corporate device option appears in the app settings. When the user clicks it and confirms:

• If a valid corporate certificate is installed on the device, the OS requests the password for the private part of the certificate and permission for the eXpress app to use the certificate. If successful, the user sees a Corporate device role confirmed notification, and the item disappears from settings;
• if there is no certificate or it is invalid — the user sees the message Client certificate is invalid. This device cannot be confirmed as a corporate device;

A confirmed device can lose its corporate role, for example, if the certificate is revoked or the same certificate was confirmed on another device. Then the Confirm corporate device option appears in the settings again, and a dot marker is displayed next to the user's avatar, like the “Server maintenance in progress” indicator.

Adding Users to a Group

Field Descriptions

Field	Description
Groups of which the user is a member Groups of which the user is not a member	Search is available only for global Active Directory groups. You can manually enter values for universal groups using Enter. User membership in the group is not yet verified. User Groups from Active Directory When you create a group in Active Directory for the role model, set the Scope parameter to Universal. The Domain Local and Global options are not suitable for the role model. For now, only universal AD groups are supported, while search in the field finds only global groups. Therefore, enter the universal group manually and press Enter. You can't yet view who is in the group or select an AD group from the list. This is planned for the future. Currently, it is not checked whether the user is a member of an Active Directory group. Therefore, it is easier to start checking the rule with a specific user in the group: search for their login or enter their HUID, and press Enter.
Roles the user has Roles the user does not have	OpenID roles. Start typing the role name and select it from the suggestion or enter it manually and press Enter. User membership in the group is not yet verified. User Roles From OpenID (Keycloak) A user's OpenID role, like an AD group, must be specified in the user profile in the admin panel of CTS. Roles are synchronized from OpenID fields under the Role mapping tab in the Users section of the Keycloak admin console. If a role is missing from the user's profile in the CTS admin panel: Run a standard synchronization: click Sync in the registration settings. Ask the user to log into the app again. If this does not help, contact eXpress support.
Position	No search available. User membership in the group is not yet verified. These field values are entered manually. They can be copied from the user profile. To save added values, click Save Group.
Company
Department
Domain
Specific users	Search by login is available. You can manually enter HUID values using Enter. User membership in the group can be verified by the HUID value. ⚠️ The Specific users field can contain no more than 100 users. To find specific users or excluded users, start typing the login and select the appropriate option from the dropdown, or enter the user's HUID and press Enter. You can upload user lists from CSV files in the same format as for the Users section.
Exception users

How to Create a Group with All Users?

For the rule to apply to all server users, do not select anything: neither an AD group, nor an OpenID role, nor a property, nor a specific user.

How Do AD Group and OpenID Role Selection Work Together?

The filtering works on the principle of logical “AND”: a user will be included in the role model user group only if they have a match in both the AD group and the OpenID role.