Skip to main content
Version: 3.3

Adding Users

note

This page describes user and security group management for Cherwell (CSM) deployments. Security group configuration for other source systems works differently and is not covered here.

Internal users can be created and managed from the User Management page.

Accessing User Management​

  1. Navigate to the left-hand navigation menu.
  2. Select Admin.
  3. Click User Management.

User Management Screen

Creating a New User​

To manually create a new internal user:

  1. Click Add User.
  2. Enter a Username / Email Address.
  3. Assign the appropriate Security Groups.
  4. Save the user.

Once saved, the user will be able to sign in using Internal authentication.

If the User Already Attempted Login​

If a user has already attempted to sign in to Cortex, they will appear in the Users list automatically.

However, they will not be able to see any records until they are assigned a Cherwell Security Group.

To assign security groups:

  1. Click the Edit icon next to the user.
  2. Assign the appropriate security groups.
  3. Save changes.

Adjust Security Groups

Understanding Security Groups​

There are two types of security groups that can be assigned to users.

Cherwell Security Group​

  • Pulled directly from your Cherwell database
  • Controls access to Cherwell data
  • Determines which tables a user can access, record-level conditions, and data visibility permissions
  • These configurations are read-only within Cortex

Cortex Security Group​

  • Controls permissions specific to Cortex functionality
  • Examples include the ability to define global saved searches and access to Cortex-specific features
  • Configurable under Admin -> Security Groups

By default, most non-admin users can be assigned to the Default User Cortex security group.

Disabling a User Account​

Removing access does not mean deleting the account. The user list has a Disabled column - a disabled account shows a cancel icon, and editing a row gives you a checkbox for it. A disabled account stays in the list and keeps its settings, and clearing the checkbox restores access.

Disabling is enforced on every way into Cortex, not only the Internal login page:

  • An Internal sign-in is refused, and SAML or OpenID Connect sign-ins are refused before a session is created.
  • Windows authentication is refused on each request, and an API key mapped to the account stops authenticating.
  • A session the account already holds is rejected and signed out when its cookie is next validated, so disabling an account takes effect within about 30 seconds rather than at the next sign-in.

Two behaviours are worth knowing:

  • If you disable the account you are signed in with, Cortex asks you to confirm before saving. If it cannot read that account's stored state it abandons the save with an alert rather than applying a change you may not intend.
  • A sign-in from someone who has no Cortex user row yet is not treated as disabled, so first-time single sign-on users are still provisioned normally.

Disabling an account in Cortex does not change anything in your identity provider or in Cherwell. If the provider keeps signing the user in, Cortex refuses them at the door.

Important Notes​

  • Users must have a Cherwell Security Group assigned before they can access any data.
  • Cortex Security Groups control Cortex behavior only - not Cherwell data access.
  • Cherwell permissions always originate from the Cherwell system itself.