Access model¶
In a Reemo organization, access to a resource results from the combination of an account, a group, a role, and a control level. An approval workflow and a rights review round out the model.
Accounts, groups, and roles¶
Account: a managed user (owned by the organization) or a non-managed user (invited by email). See Users.
Group: organizes users and resources (computers, container profiles, collections) and is used to delegate administration. See Groups.
Role: defines permissions, at the organization level (Member, Support, Administrator) or the group level (Member, Support, Administrator, Extended Administrator). Permissions are cumulative.
Control level¶
Every access carries a control level: Full control or View only. It is set by default on the account and overridden per computer, per container profile, then per user-resource association. A view-only user stays view-only even on a full-control resource.
Collections¶
A Collection groups container profiles and desktops to assign them to a set of users. A user must be assigned to a collection to access its content; removing them revokes access. Its identifier is used for SSO mapping.
Access approval¶
When a resource has at least one approver, access goes through an approval workflow: the user submits a request, an approver handles it, then the connection is allowed. A quorum (Required approvals) and exempt groups refine the rule. Access Requests give the administrator a view to track and revoke.
Rights review¶
The Rights Review shows, as a tree, the access granted on each resource. It is available on the User, Remote Desktop, Container Profile, and Workspace records.