Upcoming changes to access control within Kissflow

In the next two weeks, we're rolling out critical changes to how access control functions within Kissflow. 

The issue: Kissflow currently manages access control via user types, inadvertently granting some users more access than intended. For instance, a User Admin, whose primary function was to manage users, also had access to billing data.

The solution: Moving from user types to user roles will ensure more granular and accurate access control of your Kissflow users.

Note:

All existing user types will be automatically mapped to the corresponding user roles. Ex: Super Admin to Super Admin, User Admin to User Admin. 

What’s changing?

1. Optional role assignment: Unlike before, where every user was assigned one of the four user types, role assignment will now be optional.

   

2. Multiple role assignment:  Users can have multiple roles assigned to them. For example, if you want a User Admin to have access to the billing page, you can assign them the Billing Admin role in addition to their User Admin role.

3. New roles and updated permissions: 

   • Introducing IAM Admin and App Store Admin roles.

     • IAM Admin: Manages access control and is responsible for security and user provisioning.

     • App Store Admin: Can install apps from the App Store.

   • Shifting some permissions from User Admin to IAM Admin.

Note:

No permission changes exist for the Billing Admin and Super Admin roles. 

Updated permission list

Permission/Role	IAM Admin	Existing User Admin	New User Admin
View/Update account details	✕	✕	✕
View Account Owner	✕	✕	✕
View/Customize account	✕	✕	✕
View/Update mobile branding	✕	✕	✕
View/Update connected domains	✓	✕	✕
View/Update format settings	✕	✕	✕
Manage weekends	✕	✕	✕
View/Update holidays	✕	✕	✕
View/Update geo-location settings	✕	✕	✕
Chat settings	✕	✕	✕
File upload settings	✓	✕	✕
View/Update account security	✓	✕	✕
Notification settings	✕	✕	✕
View/Update flow settings	✓	✕	✕
Add/Update user	✕	✓	✓
Update user role	✓	✓	✕
Activate user	✕	✓	✓
Deactivate user	✕	✓	✓
2FA enrollment	✕	✓	✓
Reset password	✕	✓	✓
Resend verification email	✕	✓	✓
Delete user	✓	✓	✓
Export user data	✓	✓	✓
View user data	✓	✓	✓
SCIM IdP	✓	✓	✕
Configure SCIM IdP	✓	✓	✕
Sync SCIM IdP	✓	✓	✕
Enable SCIM IdP	✓	✓	✕
View group	✓	✓	✓
Create group	✕	✓	✓
Update group	✕	✓	✓
Delete group	✓	✓	✓
Update group role	✓	✕	✕
Update members	✕	✓	✓
User management logs	✕	✓	✓
Group management logs	✕	✓	✓
Account management logs	✓	✓	✕
Install Apps	✕	✕	✕
Enquire	✓	✓	✓
View App Store (and Apps)	✓	✓	✓
Create Service Account	✓	✕	✕
View Service Account	✓	✕	✓
View/Edit App environment	✓	✕	✕
Manage App environment users	✓	✕	✕

Roles in user groups

You will have the ability to add roles to user groups. Every user and sub-group within a parent group will inherit the roles assigned to the parent group

Deprecation of UserType field

As we transition to roles, the UserType field will be deprecated and replaced with a Roles field. This may affect instances where UserType field was previously used.

Impact and actions required 

Component	Impact	Required action
Advanced filter	The filter will remain but won’t function correctly	Clear the Advanced filter
Basic filter	The filter will remain but won’t function correctly	Clear the Basic filter
Form field	The UserType field will not be populated correctly	Remove the field UserType from the form
Analytics report	The report will not function properly	Remove UserType from the report/query
Integration	Conditional step - The condition will always be evaluated as false   Field mapping - A null value will be passed instead of the actual User type	Remove the field UserType for both instances
Developer APIs	Create a user - Roles will replace User Type in the response.     Get user list - Roles will replace User Type in Query parameters and API response. Get user details - Roles will replace UserType in the response.	Replace any existing APIs that you have preconfigured

These changes won't affect how roles within Processes, Boards, Datasets, and Applications work. We will roll out these changes around the second week of October, 2023. 

If you're looking forward to this upcoming change, go ahead and like this topic. If you have any questions or queries about it, please comment below, and we'll be happy to assist you.

FAQ

I have used fields such as User Field and User.FirstName in my form. Do I need to fix them?

No. You must only remove the field User.userType from your forms and integrations.