9

Upcoming changes to access control within Kissflow

In the next two weeks, we're rolling out critical changes to how access control functions within Kissflow. 

The issue: Kissflow currently manages access control via user types, inadvertently granting some users more access than intended. For instance, a User Admin, whose primary function was to manage users, also had access to billing data.

The solution: Moving from user types to user roles will ensure more granular and accurate access control of your Kissflow users.

Note:

All existing user types will be automatically mapped to the corresponding user roles. Ex: Super Admin to Super Admin, User Admin to User Admin. 

What’s changing?

  1. Optional role assignment: Unlike before, where every user was assigned one of the four user types, role assignment will now be optional.

  2. Multiple role assignment:  Users can have multiple roles assigned to them. For example, if you want a User Admin to have access to the billing page, you can assign them the Billing Admin role in addition to their User Admin role.

  3. New roles and updated permissions: 

    • Introducing IAM Admin and App Store Admin roles.

      • IAM Admin: Manages access control and is responsible for security and user provisioning.

      • App Store Admin: Can install apps from the App Store.

    • Shifting some permissions from User Admin to IAM Admin.

Note:

No permission changes exist for the Billing Admin and Super Admin roles. 

Updated permission list

Permission/Role

IAM Admin

Existing User Admin

New User Admin

View/Update account details

βœ•

βœ•

βœ•

View Account Owner

βœ•

βœ•

βœ•

View/Customize account

βœ•

βœ•

βœ•

View/Update mobile branding

βœ•

βœ•

βœ•

View/Update connected domains

βœ“

βœ•

βœ•

View/Update format settings

βœ•

βœ•

βœ•

Manage weekends

βœ•

βœ•

βœ•

View/Update holidays

βœ•

βœ•

βœ•

View/Update geo-location settings

βœ•

βœ•

βœ•

Chat settings

βœ•

βœ•

βœ•

File upload settings

βœ“

βœ•

βœ•

View/Update account security

βœ“

βœ•

βœ•

Notification settings

βœ•

βœ•

βœ•

View/Update flow settings

βœ“

βœ•

βœ•

Add/Update user

βœ•

βœ“

βœ“

Update user role

βœ“

βœ“

βœ•

Activate user

βœ•

βœ“

βœ“

Deactivate user

βœ•

βœ“

βœ“

2FA enrollment

βœ•

βœ“

βœ“

Reset password

βœ•

βœ“

βœ“

Resend verification email

βœ•

βœ“

βœ“

Delete user

βœ“

βœ“

βœ“

Export user data

βœ“

βœ“

βœ“

View user data

βœ“

βœ“

βœ“

SCIM IdP

βœ“

βœ“

βœ•

Configure SCIM IdP

βœ“

βœ“

βœ•

Sync SCIM IdP

βœ“

βœ“

βœ•

Enable SCIM IdP

βœ“

βœ“

βœ•

View group

βœ“

βœ“

βœ“

Create group

βœ•

βœ“

βœ“

Update group

βœ•

βœ“

βœ“

Delete group

βœ“

βœ“

βœ“

Update group role

βœ“

βœ•

βœ•

Update members

βœ•

βœ“

βœ“

User management logs

βœ•

βœ“

βœ“

Group management logs

βœ•

βœ“

βœ“

Account management logs

βœ“

βœ“

βœ•

Install Apps

βœ•

βœ•

βœ•

Enquire

βœ“

βœ“

βœ“

View App Store (and Apps)

βœ“

βœ“

βœ“

Create Service Account

βœ“

βœ•

βœ•

View Service Account

βœ“

βœ•

βœ“

View/Edit App environment

βœ“

βœ•

βœ•

Manage App environment users

βœ“

βœ•

βœ•

Roles in user groups

You will have the ability to add roles to user groups. Every user and sub-group within a parent group will inherit the roles assigned to the parent group

Deprecation of UserType field

As we transition to roles, the UserType field will be deprecated and replaced with a Roles field. This may affect instances where UserType field was previously used.

Impact and actions required 

Component

Impact

Required action

Advanced filter

The filter will remain but won’t function correctly

Clear the Advanced filter

Basic filter

The filter will remain but won’t function correctly

Clear the Basic filter

Form field

The UserType field will not be populated correctly

Remove the field UserType from the form

Analytics report

The report will not function properly

Remove UserType from the report/query

Integration

Conditional step - The condition will always be evaluated as false

 

Field mapping - A null value will be passed instead of the actual User type

Remove the field UserType for both instances

Developer APIs
 

Create a user - Roles will replace User Type in the response.
 

 

Get user list - Roles will replace User Type in Query parameters and API response.

Get user details - Roles will replace UserType in the response.
 

Replace any existing APIs that you have preconfigured
 

These changes won't affect how roles within Processes, Boards, Datasets, and Applications work. We will roll out these changes around the second week of October, 2023

If you're looking forward to this upcoming change, go ahead and like this topic. If you have any questions or queries about it, please comment below, and we'll be happy to assist you.

FAQ

I have used fields such as User Field and User.FirstName in my form. Do I need to fix them?

No. You must only remove the field User.userType from your forms and integrations. 

 

Content aside