Bacularis in organizations

Part 2: Teams, organizations and group management

Bacularis makes it possible to manage both individual users and groups of users representing teams, departments, branch offices, or other organizational units. In this article, we present Bacularis features that make it easier to manage such groups and organize user administration.

Key capabilities

Below are some features that can be useful when configuring team-based user management in Bacularis.

Organizations

Organizations are logical units used to group users.

If a company has different teams, departments, or branch offices, employees from each of them can be assigned to a dedicated Bacularis organization. This provides a natural way to group related users and keep user management organized.

Details: Organizations documentation

Authentication for organizations

Organizations can use different identity providers.

For example, if a company has branch offices in different cities or countries and each branch uses a different identity provider, a separate authentication method can be assigned to each organization.

Organizations can also use the same identity provider or other authentication methods, such as LDAP or local Bacularis users.

When signing in, employees assigned to particular groups select the authentication method associated with their organization and authenticate using their organizational credentials.

This allows a single Bacularis instance to serve groups of users belonging to different identity domains or using different authentication methods.

Details:

• SSO OpenID Connect documentation
• Local user documentation
• LDAP user documentation

Bulk actions

After filtering users belonging to a particular group in the Bacularis interface, the administrator can select all or some of them and perform bulk actions.

For example, the administrator can assign a role to multiple users at once.

Bulk actions can be used to:

• assign or remove roles,
• assign or remove API hosts,
• assign or remove API host groups,
• add users to or remove users from organizations,
• remove users.

Bulk actions reduce the time and effort required to modify multiple user accounts individually.

Assigning users to organizations

Users can be assigned to organizations in several ways.

Users of all supported types, including local users, LDAP users, and identity provider users, can be assigned to or removed from organizations by editing their accounts on the Users page or by using bulk actions.

LDAP users can also be assigned to an organization while being imported into Bacularis.

In addition, users can be assigned automatically when user provisioning is enabled. If a user does not yet have a Bacularis account, the account can be created during the first login and automatically assigned to a selected organization.

Details: User provisioning documentation

Organization administrators

Administrator accounts can be assigned within individual organizations.

These users are given roles that provide full administrative access to Bacularis. This makes it possible to have administrators associated with particular groups while still providing them with full access to Bacularis administrative functions.

Organization administrators are not restricted to managing only their own organization. Administrative roles provide access according to the permissions assigned to those roles.

Organization role mapping

If Bacularis organizations use authentication through identity providers, separate role mappings can be configured for each organization.

This makes it possible to use roles provided by an identity provider and map them to local Bacularis roles.

Each organization can independently map roles from its own IAM system to the local Bacularis role model.

Details: Role mapping documentation

Example scenarios

Central IT + branch offices

In this scenario, administrators from the central IT department can manage Bacularis with full access. They belong to an Administrators organization.

Employees working in branch offices belong to separate organizations such as Office 1A, Office 2B, Office 100, and others.

Their accounts can have limited access to selected Bacula resources, allowing them to sign in to Bacularis and access only the data associated with their own computers.

This enables users to restore their own data on demand without gaining access to the data of other employees.

University departments

Employees of individual university departments can belong to separate Bacularis organizations and use either the same identity provider or different identity providers.

Security/audit team

Auditors can belong to a dedicated organization that groups users who require read-only access to the Bacularis interface.

This helps keep user management organized and separates auditor accounts from other users.

Summary

Organizations in Bacularis make it possible to reflect company teams, departments, and branch offices in the Bacularis user management structure.

Each organization can use its own authentication methods and role mappings, while users can be assigned manually, through bulk actions, or automatically during provisioning.

These features make it easier to manage larger numbers of users and keep user accounts organized into logical groups.

Related Bacularis features

• User access configuration examples
• Access to selected Bacula resources
• Access to selected areas of the interface

Previous article part

⇒ Part 1: Authentication and access control

Next article part

⇒ Part 3: Monitoring, reporting and everyday operations