Administrator Portal Documentation

Transcription

1 Administrator Portal Documentation Version 1.9 ( ) grouptime GmbH Tittmoninger Straße München Germany

2 Administrator Portal Documentation ii Contents 1 Intro URL Registration Dashboard Tab Metrics Users Tab Inviting Users Importing Users Groups Tab 4 5 Circles Tab 5 6 Admins Tab 6 7 Settings Tab Communication Restrictions Organizational Privacy Allow Registration of New Users Registration Token Templates Permissions LDAP Synchronisation Synchronisation Status Server and Authentication Settings Schema and Directory Settings Synchronisation Restrictions Support Tab 13

3 Administrator Portal Documentation 1 / 13 Chapter 1 Intro Teamwire enables IT to manage all users of their enterprise via an administrator portal. IT can easily invite, administer and block users, pre-configure the app as well as set general communication guidelines and restrictions for the company. The users get a fast, easy to use and secure app for all their internal messaging needs, and IT can manage Teamwire company-wide. This document gives a quick overview of the Teamwire Administrator Portal, its features and what to take care of when configuring it for your enterprise. 1.1 URL In order to visit the Teamwire Administrator Portal please go to: This URL only applies to the public cloud backend of Teamwire. If you run an on-premise solution, the URL of the administrator portal depends on your installation. 1.2 Registration To be granted access and manage the users of your enterprise, you need to register first. Please enter all required details. Teamwire needs this data to authenticate and confirm your registration. Please enter your mobile number in the requested format including the country code, since Teamwire will send a confirmation SMS to this number. Also make sure that your work address is correct, because Teamwire sends a confirmation to your work address as well. Needless to say, due to the confidentiality of your company s information it is important that you choose a very strong password. After you completed the registration form, please a. confirm your mobile phone number by entering the PIN (which Teamwire sent you via SMS) in the window that opens automatically after you completed the registration form, and b. confirm your work address by clicking on the link in the , which you received from Teamwire. When finished, please give Teamwire some time to grant you access to the Teamwire Administrator Portal. You will then be able to login with your work and password. For the on-premise solution of Teamwire, the first administrator who registers will become the Super-Administrator. The Super-Administrator can manage users, circles, and groups of an organization and all its tenants (e.g. subsidiaries). This person will be informed if administrators of new organisations register and can then activate their accounts. Once the first administrator of an organisation was approved, this administrator has to approve subsequent administrators of that organisation.

4 Administrator Portal Documentation 2 / 13 Chapter 2 Dashboard Tab The dashboard gives a quick overview of your company s Teamwire configuration and usage. The blue labels below the individual statistics link to the individual configuration sections of the Administrator Portal. The first column shows the total number of users of an organization and the count of pending invites. Pending invites are the number of users that were created by the administrator (either by inviting, by importing from a CSV file or by LDAP synchronisation), but who did not yet register the Teamwire application on either a mobile device or a desktop client. The second column shows the count of configured circles and groups. The third column shows the configured communications restrictions. The last column shows the company name, its registered administrators and the currently logged in administrator. In the list of administrators, the super-administrators are marked with a star. 2.1 Metrics The diagram on the dashboard shows the messages sent during the last 72 hours, where the x axis shows the hour of the day (where 0h is the first hour of the day) and the y axis shows the numer of messages sent. Each day is shown in a different color and can be removed from the view by clicking on the colored circle in the legend.

5 Administrator Portal Documentation 3 / 13 Chapter 3 Users Tab On the users tab you can manage all the Teamwire users of your company. It gives an overview of all users of your enterprise. You can manage your users and see which users have downloaded the app and registered already (please see the "Confirmed" column). You can easily search for users by first name, last name or address. By clicking on a user you can get additional information like app version, join date date and last usage time. Furthermore, the Super-Administrator gets an overview all users on the server, regardless of the company. You can also disable and delete users with the pause button, which will then IMMEDIATELY revoke the access of these users to the Teamwire server. That means these users will not be able to use Teamwire anymore (e.g. send or receive messages). 3.1 Inviting Users You can invite colleagues to Teamwire either via a manual invite of individual users with the Invite User button or via a bulk import of a CSV file ( Import CSV button). All invited and imported users will receive a message generated from the User Invitation template. As soon as the user is invited, the user will receive an invitation. So please make sure a) that the templates have been adapted to your needs and b) everything is ready for the roll-out of Teamwire. Please use work addresses with your company domain (e.g. username@example.com). However, the Super- Administrator can invite users from outside the company as well. 3.2 Importing Users You can import multiple users by uploading a CSV file. If you invite users via the CSV import, the following file format is expected: ,first_name,last_name,group This also needs to be the first line of the uploaded file, otherwise the file format cannot be recognized. Please ensure the file is encoded with UTF-8, otherwise non-ascii characters might get garbled during the import. The group field is optional and allows you to create groups while importing users. You can safely import a file that contains existing users; existing users are skipped during the import and only users that are not yet present will be created.

6 Administrator Portal Documentation 4 / 13 Chapter 4 Groups Tab In the groups tab you can pre-configure groups for your users. A group can be set up for e.g. a team, a unit, a project, etc. and will then be pushed to the devices of group members. That means if a user is part of a group, she will get access to it on her device. A user can then start a new group chat with the group with one-click. In order to define a group you need to first click on Add Group and choose a title for your group (e.g. sales team). Then by clicking on a defined group, you can see all members of that group. If you want to add users to a group, please click Add Member. In the newly opened window please click on the + on the right of the users you want to add, and when finished click Done. In case a user should not see all the groups defined for her or appropriate to the communication restriction option you selected for your enterprise, please ask the user to newly sync the contacts on her device ( Update Contacts & Groups in the app).

7 Administrator Portal Documentation 5 / 13 Chapter 5 Circles Tab If required, in the circles tab you can manage closed communication sections of your company. Users will then only be able to communicate with colleagues in the same circle. A circle could be a unit which has access to confidential corporate information (e.g. research & development), and that should not be allowed to communicate with other sections of the company. In order to define a circle you need to first click on Add Circle and choose a title for your circle (e.g. strategy and planning). Then by clicking on a defined circle, you can see all users assigned to that circle. If you want to add users to a circle, please click Add Member. In the newly opened window please click on the + on the right of the users which you want to add, and when finished click Done. For circles to work, you have to activate "Circles + Groups Only" in the "Restrictions" tab, AND every employee of your company must be assigned to at least one circle.

8 Administrator Portal Documentation 6 / 13 Chapter 6 Admins Tab On the admins tab you can administrate all registered administrative users. The rightmost column shows if an administrator is enabled or disabled; super administrators are marked with a star symbol. By clicking a list entry, you can modify the administrator s details or enable or disable the administrator. When logged in as superadministrator, existing administrators can be promoted to Super Administrators or existing Super Administrators can be demoted to regular administrators. Please note that for security reason you cannot disable or demote the currently logged in administrator.

9 Administrator Portal Documentation 7 / 13 Chapter 7 Settings Tab The settings tab allows to configure various operation parameters of the Teamwire server. 7.1 Communication Restrictions In the Communication Restrictions tab you can configure who the users of your company are allowed to communicate with, and who is allowed to register and use the Teamwire app within your organization. For many companies it is important to define communication barriers for compliance reasons, and to restrict the usage of the app and the distribution of messages and content Organizational Privacy You can select different communication restrictions for your enterprise. As soon as you have selected and saved an option, this communication restriction will be active for your organization. From then onwards, if users newly register for Teamwire or sync the contacts again ( Update Contacts & Groups in the app), the selected option will push the corresponding contacts for Teamwire on a user s device. This means, that you should ideally choose and properly setup a communication restriction, and then invite all the users of your enterprise to use Teamwire in order to avoid potential inconsistencies. You can select one of four different communication options: 1. Internal Use Only A user can only communicate internally with other users of your organization. Only users with your company domain are able to communicate with each other on Teamwire. If this option is selected a user will have access in the app to all other users of your organization and the pre-configured groups, which this user is part of (please see Groups Tab for more details). 2. Circles + Groups Only A user can only communicate with users of your organization in the same circles or in the same groups. A communication with users outside of these circles and groups is not possible on Teamwire. If this option is selected a user will have access in the app to users in the same circles and in the pre-configured groups, which this user is part of (please see Circles Tab and Groups Tab for more details).

10 Administrator Portal Documentation 8 / 13 A user who is not a member of any group or circle will not be able to communicate with other users. The circles and groups can include people from other companies. However, it is required that these other companies are hosted on the same backend (e.g. the same public cloud, the same data center or the same on-premise installation). 3. Address Book Only A user can communicate with users from her device address book using Teamwire. These users can be internal and external contacts. If this option is selected a user will have access in the app to the users of your organization, which are in her device address book and use Teamwire. In addition a user will have access in the app to users from other companies, if these users are in her device address book and use Teamwire. However, it is required that the other companies are hosted on the same backend (e.g. the same public cloud, the same data center or the same on-premise installation). 4. Internal + External Contacts A user can communicate with all users from your organization, and with external users which they have in their device address book. If this option is selected a user will have access in the app to all other users of your organization and the pre-configured groups which this user is part of (please see Groups Tab for more details). In addition a user will have access in the app to users from other companies, if these users are in her device address book and use Teamwire. However, it is required that the other companies are hosted on the same backend (e.g. the same public cloud, the same data center or the same on-premise installation). Overview of the communication options and which users get synced to a user s device: When you select an option, please make sure to save your changes by clicking on Save Restrictions. Once you change the setting here, it will become active for all users of your company. So please make sure you have set up other required configurations beforehand (e.g. for "Circles + Groups Only" you need to configure Circles beforehand). In case a user should not see all the contacts appropriate to the option you selected, please ask the user to newly sync the contacts on her device ( Update Contacts & Groups in the app).

11 Administrator Portal Documentation 9 / Allow Registration of New Users If this box is NOT checked, only the users which have been invited by the IT administrator or got synchronised from an LDAP directory can register and use the Teamwire app within your organization. If this box is checked, users with an address of your organization s domain(s) can register and use the Teamwire app without an invitation by the IT administrator. A new user account will be automatically created during the registration Registration Token The registration token enables you to restrict the usage of Teamwire to devices that are managed by an EMM system. Please enter an alphanumeric value (e.g. 5cg72am34toh81px15s) in the field Registration Token. You need to configure the identical value within your EMM systems for the users and devices for which the usage of Teamwire should be allowed. Please ONLY configure this value when using an EMM system that is supported by Teamwire. Please refer to the Registration Token description in the document "MobileIron Support Documentation" for details on the steps required to complete the configuration Templates In the Templates tab you can modify the templates that are used to generate the s sent by the Teamwire Server to new users and administrators of your organisation. The following templates can be modified: New Admin Registration New Admin Address Verification Admin Confirmation User Invitation New User Address Verification To modify a template, select it from the drop-down list of available templates. The Template section will show the template. To test the result of your modifications, switch to the Preview tab. If your modifications contain an error, the mistake will be shown instead of the preview. 7.3 Permissions The permissions tab allows to disable certain features available in the mobile application for all users of your organisation. The following list describes the configurable settings. Per default, all features are enabled; unchecking a feature will disable it. These settings are queried by the mobile application every time the application is started, but not more often than once per hour. When the application on the device is managed by MobileIron, the configuration settings configured by MobileIron have higher priority than the settings configured on this page. Please see the Teamwire MobileIron Support documentation for more details. Allow Calender Access Allow attaching calendar entries to messages.

12 Administrator Portal Documentation 10 / 13 Allow Camera Access Allow taking pictures and attaching them to messages. Allow Location Access Allows sending the current location. Allow Microphone Access Allow taking voice messages. Allow Photos Access Allow attaching photos stored on the device to messages. Allow Videos Access Allow selecting videos stored on the device to attach them to messages. Allow Attachments Allow attaching any digital content (see attachment menu in app) objects to messages. Disabling this will override all the individual attachment type settings. Allow Copy/Paste Allow copying message text to the clipboard. Allow File Sharing Allow using the Box integration. Allow Invite Members Allow inviting additional users to existing chats. Allow Leave Conversation Allow users to leave a group chat. Allow Sending Conversations By Allow sending chats (text only) by with the device s default mail client. Allow Sending Message Text In Notifications When disabled, the text of new messages will not be sent with notifications. This setting overrides manual configuration of this feature and disables the option in the applications s settings. Allow Open In Allow using the Teamwire as target for the Open In feature from other apps on the device. 7.4 LDAP Synchronisation The LDAP Synchronisation tab allows to configure a LDAP directory as a source from which users and groups can be automatically imported into Teamwire, thereby avoiding the need to create them manually and allowing for tight integration with existing enterprise infrastructure. Teamwire doesn t need the LDAP directory for authentication purposes. During the synchronisation process, the Teamwire Server will search the configured LDAP groups base DN subtree for groups, applying any configured white and black lists, and creating a Teamwire user account for each group member for which a.) short name and given name can be determined and b.) an address is present and matches the Teamwire organisation s domain. A Teamwire group containing the created Teamwire users will be created only if at least one valid Teamwire user was found. This means that e.g. Active Directory special-purpose groups without actual users will be automatically skipped. Note A User must be member of at least one group below the configured LDAP groups base DN in order to be considered during the synchronisation process. Users and groups imported from LDAP can be recognized in the Users and Groups tabs by having the origin LDAP instead of Native. This allows the synchronisation process to recognize users and groups that have been created in earlier runs and delete them (in case of groups) resp. disable them (in case of users) when their LDAP counterpart (the origin DN) does not exist anymore.

13 Administrator Portal Documentation 11 / Synchronisation Status This area shows the date and time and the result of the last LDAP synchronization run. With the Play and Stop buttons it is possible to manually start a synchronization or stop a running synchronization. This can be especially useful for testing purposes Server and Authentication Settings This section configures everything related to connecting to and authenticating against the LDAP server. LDAP server URI should begin with either ldap:// (plaintext) or ldaps:// (TLS-encrypted connection) and must contain a hostname. Appending a double colon and the TCP port number the LDAP server is listening on is optional when the default ports are used (389 for ldap, 636 for ldaps). Note Certificate verification of TLS-encrypted connections to the LDAP servers is currently disabled. Synchronisation interval specifies the time in minutes between each automatic synchronisation run. We recommend a value of no less than 240 minutes (four hours). Specify a value of zero to disable automatic synchronisations. You can always start or stop a synchronisation run manually with the controls in the Synchronisation Status area. Max. reconnect attempts, Reconnect delay apply to the case that the LDAP server can not be reached on the network level (eg. the host is down, firewall problems etc.) and are interpreted within one synchronisation run. For example, if max. reconnect attempts is 5, Reconnect delay is 60 and synchronisation interval is 240, then five connection attempts with a delay of 60 seconds are made until the synchronisation process gives up for this run. The next connection attempt would be made within the next run four hours later. LDAP bind DN, LDAP password specify the DN (distinguished name, eg. uid=teamwire, ou=special users, dc=foo, dc=com ) and the password of a LDAP account used to authenticate against the LDAP server. When configuring access to an Active Directory server, you can use the Windows user name (e.g. user@example.com) as bind DN. This LDAP account must have the privileges to: search LDAP groups base DN access the attributes objectclass on the objects below this DN access the attributes dn, cn, member and uniquemember (if present) on those objects below this DN that have the correct objectclass ( groupofnames and groupofuniquenames in case of LDAP schema inetorgperson, group in case of ad ). search the DNs of group members access their objectclass attribute access the cn, sn, givenname and mail attributes on those group member objects that have the correct objectclass ( inetorgperson in case of LDAP schema inetorgperson, user in case of ad ). Note We highly recommended using ldapsearch or similar tools to manually verify the configured LDAP settings and the expected outcome.

14 Administrator Portal Documentation 12 / Schema and Directory Settings This section contains settings needed after successful authentication describing the inner structure of the LDAP directory. LDAP schema abstracts some of the differences in LDAP implementations between different vendors. Choose inetorgperson when using an OpenLDAP or Novell edirectory server and ad when using a Microsoft Active Directory server. LDAP groups base DN specifies the DN of the directory subtree that contains all group objects to be considered. This should in general be as specific as possible and as generic as necessary. For example, if all groups to be considered are below ou=groups, dc=foo, dc=org you d use exactly that. If, however, groups are spread out broadly as in eg. cn=group1, ou=germany, ou=emea, dc=foo, dc=org and cn=group42, ou=us, ou=americas, dc=foo, dc=org it might be necessary to specify a rather high level DN such as dc=foo, dc=org Synchronisation Restrictions The settings in this section can be used to restrict the LDAP groups that will be considered during the synchronisation process. Use LDAP groups whitelist if you want to explicitly allow only a few LDAP groups to be synchronised. Any group not listed here will be ignored. Note that this setting uses group names (ie. the cn attribute), not full DNs. Use LDAP groups blacklist if you want to synchronise all LDAP groups except for those specified here. The synchronisation process already does quite a good job to exclude directory-specific special groups, so you ll most probably not have to list groups such as Domain Controllers here. Note If a group name is specified in both the whitelist and the blacklist, the blacklist will take precedence, causing the group to be ignored.

15 Administrator Portal Documentation 13 / 13 Chapter 8 Support Tab In the support tab you can find the address and phone number to quickly reach the Teamwire support as well as other support information.