Users & Permissions

Presswerk uses a role-based access model with granular permissions at the folder and environment level.

Users

Automatic Creation

Users are automatically created in the Presswerk database on first login via the identity provider (Keycloak/OIDC). First name, last name, and email are taken from the JWT token.

Pre-creating Users

Admins can also pre-create users (e.g. for invitations):

1. Navigate to Users in the sidebar
2. Click Add User
3. Enter the email address
4. Optionally: assign the admin role

The user must then be created in the identity provider (Keycloak) to be able to log in.

Roles

Roles are assigned in Keycloak and read from the JWT claim realm_access.roles.

Role	Permission
admin	Full access within the tenant — user/group management, environments, permissions. Bypasses all permission checks.
platform_admin	Tenant management, cross-tenant access (SaaS edition only)
(none)	Regular user — access controlled by folder and environment permissions

Groups

Groups bundle users for shared permissions.

Note

Groups require at least a Starter license. Without the groups feature, the app runs in single-user mode.

Creating a Group

1. Navigate to Users → Groups tab
2. Click New Group
3. Enter a name and optionally a description
4. Add members

External Mappings (automatic sync)

Groups can have external mappings — a list of external group names that match the identity provider.

When a JWT contains a group name that matches an external mapping, the user is automatically added to the Presswerk group.

Example: The Presswerk group “Sales” has the external mapping sales-team. When a user logs in and their JWT contains the group sales-team, they are automatically added to the “Sales” group.

This enables automatic synchronization with:

• LDAP / Active Directory groups
• Microsoft Entra ID (Azure AD) groups
• Keycloak groups

Folder Permissions

Folder permissions control who can view and edit which resources (reports, data sets, data sources). Permissions are assigned per folder and inherited by subfolders.

Permission Levels

Level	Read	Write	Delete	Manage Permissions
viewer	Yes	No	No	No
editor	Yes	Yes	No	No
owner	Yes	Yes	Yes	Yes

Assigning Permissions

Permissions can be assigned to individual users or groups:

1. Navigate to the desired folder
2. Open the folder settings / permissions
3. Add a user or group
4. Select the permission level

Resolution

• When multiple sources apply (direct + group), the highest permission wins
• Permissions are inherited along the folder hierarchy (parent → child)
• Admins bypass all permission checks

Environment Permissions

Environment permissions control who can deploy to which environments. They are binary — a user either has access or not (no levels like folder permissions).

Assigning Permissions

1. Navigate to Environments
2. Open an environment
3. Add users or groups that should be able to deploy to this environment

Users without environment permission do not see the environment in the deploy drawer.

Putting it Together

To deploy a report to an environment, a user needs:

1. Folder permission (editor or owner) on the report’s folder
2. Environment permission for the target environment

Admins bypass both checks.