For AI agents: the complete documentation index is available at https://www.jumpserver.com/docs/llms.txt, the full documentation bundle is available at https://www.jumpserver.com/docs/llms-full.txt, and this page is available as Markdown at https://www.jumpserver.com/docs/features/console/policies/authorizations.md.
🎉 JumpServer v5.1.1 is available. See what's new →
  • v5

    • Authorizations

    An authorization maps users or user groups to assets or nodes. It answers "who can reach what, with which account, using which protocols, and for which actions." Once a rule is active, the authorized assets appear in the user's Workbench and can be connected according to the rule's constraints.

    Open the page from Console > Authorizations.

    Figure 1: Authorizations list with asset tree, subjects, and resources.

    Overview

    The asset tree on the left filters rules by node or asset. Columns are Name, Users, User groups, Assets, Nodes, Accounts, Active, and Actions; the user, group, asset, node, and account columns show counts rather than names.

    Quick filters include Invalid, Valid, Expiration date, Disabled, and No valid resources.

    Before you begin

    • Sign in with an account that can manage authorizations.
    • The users or groups and the assets or nodes must already exist. See Users, Groups, and Assets.
    Important

    The list shows only authorizations in the current organization, and rules apply only to users and assets in the active organization.

    Create an authorization

    1

    Click Create.

    2
    In the Create authorization drawer, fill in the fields below.
    3

    Expand Other settings, confirm the activation state and validity period, then click Submit. Use Save and continue adding for more rules.

    Figure 2: Create authorization drawer with users, assets, accounts, and protocol settings.

    Field reference

    GroupFieldDescription
    BasicNameRequired. Rule name.
    UsersUsersJumpServer users allowed to connect to the assets. Multiple selections are allowed.
    User groupsGroups whose members inherit the rule.
    AssetsAssetsAssets the users can connect to.
    NodesAsset nodes the users can connect to; assets under a node follow the node.
    AccountsAccountsAll accounts, Specified accounts, Excluded accounts, or None. Virtual accounts can also be selected.
    ProtocolProtocolsAll protocols or Specified protocols.
    ActionsActionsOperations users may perform: connect, file transfer, clipboard, and share.
    OtherActiveWhen selected, the rule takes effect.
    Start dateWhen the rule starts to apply.
    Expiration dateWhen the rule stops applying.
    CommentOptional.

    Users and groups can be selected together, and so can assets and nodes. A common pattern is one group and one node, with users and assets left empty.

    Account options

    OptionMeaning
    All accountsEvery account added to the asset.
    Specified accountsOnly the listed usernames. Press Enter after each, or click Add from template. Accounts that do not exist are created and pushed when a template is used.
    Excluded accountsEvery account except the listed usernames.
    NoneNo hosted account on the asset.
    Virtual accountsA virtual identity such as manual input, same-name account, anonymous account, or specified account.

    Protocols and actions

    Select Specified protocols to limit the rule to particular protocols. Actions default to All and include Connect, File transfer (upload, download, delete), Clipboard (copy, paste), and Share. Action availability differs by protocol.

    Expiration reminders

    New in v5.1.0

    An asset authorization can carry a configurable expiration reminder. When the rule has an Expiration date, JumpServer sends a reminder ahead of that date so the rule can be extended in time or allowed to expire as planned.

    • Reminders are configured per authorization; a rule without an expiration date has no reminder to send.
    • Use reminders for rules that grant temporary access, so access does not lapse without notice.

    Figure 3: Configure authorization expiration reminders

    Import and export

    The toolbar provides column settings, export, import, and refresh. Import opens the Import & create dialog, where you choose Create or Update, download the CSV or XLSX template, and upload a file up to 10 MB.

    Authorization details

    Click a rule's Name to open the detail drawer. Tabs include Basic, Users/groups, Assets/nodes, Authorized accounts, and Activity.

    • Basic shows identity, actions, start and expiration dates, and creator. Quick update toggles Active.
    • Users/groups and Assets/nodes add or remove members with Add.
    • Authorized accounts switches between all and specified accounts.
    • Activity shows the most recent 30 operations.

    Row actions and bulk actions

    The row menu (...) provides Delete and Duplicate. Select checkboxes and click More actions to delete or edit several rules.

    Warning

    Deleting an authorization removes the access it granted, so users may lose access immediately. If the rule only needs to pause, clear Active instead.

    Version history

    VersionChange
    v5.1.0Added configurable expiration reminders.
    • ACLs for command, login, connection, masking, and clipboard controls layered on top of authorizations.
    • Users
    • Groups
    • Accounts