Administering users within an organisation

All features of Cocoon Data technologies are accessed through a Cocoon Data user account. The core of these features include the ability to:

• Create encrypted files (also known as file objects or Secure Objects ⁽¹⁾ ) within an organisation,
• Access and decrypt an encrypted file’s data and
• Utilise Cocoon Data SafeShare applications, as well as
• Administer the Cocoon Data Platform (through Organisation Administration, as well as SafeShare Administration).

A Cocoon Data user:

• Has permission to access these features based on their roles.
• Is represented by an account which can be added to, edited ⁽²⁾ within, or removed from an organisation (and re-added again) by an Organisation administrator through the Users page of Organisation Administration.
  Notes:
  • Users may also be added and updated through an LDAP connection (on its server/user directory). However, the roles of an LDAP user account within an organisation are managed through Organisation Administration.
  • Both LDAP connections and the SafeShare administrator role on Cocoon Data user accounts can only be configured/managed through SafeShare Administration. For more information, see the SafeShare Administrator’s Guide.
  • ⁽²⁾ A Cocoon Data user account’s editable fields fit into two categories:
    • non-role-related fields - edited by the user themselves through, for example, SafeShare for Web or other SafeShare products with user account editing features and
    • role-related fields (within an organisation) - editable by any user with the Organisation administrator role for that organisation.

⁽¹⁾ A file object / Secure Object is defined by the following:

• Cocoon Data-encrypted data that has been registered on the Cocoon Data Platform.
  Note: Cocoon Data-encrypted data is data from a file or stream, which has then been encrypted either:
  • Using Cocoon Data technologies (i.e. with a Cocoon Data SafeShare product or another client application that utilises the Cocoon Data Platform’s API for encryption via the Content Service), or
  • According to Cocoon Data’s encryption requirements (i.e. a client application with its own encryption implementation). For more information about Cocoon Data’s encryption requirements, see the Requirements for encrypting data locally section on the Working with files and folders (fundamentals) page of the Cocoon Data API documentation.
• The properties associated with this encrypted data. Some of these properties can be determined by the creator/owner of the file.

​

An organisation user’s fields

Each Cocoon Data user’s account which is a member of your organisation is defined by a set of fields described in the table below, of which only a subset (Email, Role, Is Organisation Admin? and Plan) requires configuration when an Organisation administrator (of your organisation):

• Adds a new user to your organisation (thereby making this user and their account a member of the organisation) or
• Edits any existing user account within your organisation (with the exception of their Email field).

These subset of fields constitute the ‘role-related’ fields of a user’s account. With the exception of users with the Ad hoc role, any Cocoon Data user can configure the other (i.e. non-role-related) fields (also described in the table below) for their own account when they edit their account through Organisation Administration, SafeShare for Web, as well as other SafeShare products with user account editing features. Unless stated in the table below, these fields and their values are visible on the Users page of Organisation Administration. ⁽³⁾ While an Organisation administrator can modify these fields’ values for their Cocoon Data user account via the My Account feature through Organisation Administration, the user can also modify these values via equivalent features in SafeShare for Web, other SafeShare products with user account editing features, as well as SafeShare Administration (if the user has access to these features).

​

An organisation user’s roles

Each Cocoon Data user must be assigned a role, which grants the user access to different sets of features available through Cocoon Data technologies. A Cocoon Data user’s roles within an organisation can be modified by editing their user account. If you would like users in your organisation to utilise client applications (other than Cocoon Data SafeShare applications) that interact with your organisation through the Cocoon Data Platform’s API, request that a SafeShare administrator of your Cocoon Data Platform instance configure these client applications for you (since only SafeShare administrators can perform these configurations). For more information about configuring client applications, see Configuring client applications in the SafeShare Administrator’s Guide.

​

An organisation user’s activities

Upon selecting a Cocoon Data user account on the Users page, a history of activities performed by this user on their own account (or by an Organisation administrator, including a SafeShare administrator if applicable, on the user’s account) is shown in reverse chronological order in the History panel on the right of the page. If the administrator is not a member of the organisation, then ‘An Administrator’ is shown instead of the Cocoon Data user’s name. The History panel on the right can be collapsed and expanded by clicking the respective > / < icon at the top of this panel. The types of activities recorded on the user’s account include the user’s own changes to their account’s:

• details,
• password,
• multi-factor authentication settings, or
• other settings.

Also recorded are changes to the user’s account settings by an Organisation administrator, as well as the creation of an account (or its addition to an organisation) by an administrator. Be aware that sign-in and sign-out activities are not recorded by this feature.

​

Adding an organisation user account

This procedure describes how to add a Cocoon Data user account to your organisation on the Cocoon Data Platform. A Cocoon Data user whose account has been added to an organisation is a member of that organisation. To add a user to your organisation on the Cocoon Data Platform:

1. Ensure you are signed in to Organisation Administration.
2. Click the Users option on the left of the Organisation Administration interface to open the Users page.
3. Click the Add New button.
4. In the Add New User dialog box, complete the required user’s fields (described in detail above).
   Tip: See An organisation user’s roles for more information about the role(s) to specify for this user.
5. Click Save and the Cocoon Data user will appear as a new entry on the Users page.
   Notes:
   • If the user’s email address has not yet been registered on the Cocoon Data Platform, a new Cocoon Data user account is automatically created for them. The user’s:
     • Cocoon Data user account will have the Local Account Type, which is indicated on this Users page of Organisation Administration and
     • email address is sent an ‘account created’ notification, with instructions to the user on how to sign in to SafeShare for Web (applicable to most users added to your organisation whose accounts are created in this manner). The initial sign-in process usually requires the Cocoon Data user to reset their password immediately after signing in.
   • If this user already has a user account on the Cocoon Data Platform, their email address is sent an ‘account updated’ notification, informing the user that their Cocoon Data user account has been added as a member of your organisation. The user can then access SafeShare for Web (as well as other SafeShare products) for your organisation.
   • If the account added has the Organisation administrator role only, then the Organisation Administration interface is displayed as soon as the user of this account signs in.
   • If the account has any combination of the Originator, Collaborator or SafeShare administrator role in addition to the Organisation administrator role, then the user should refer to Signing in to Organisation Administration for more information about accessing the Organisation Administration interface.

​

Adding organisation user accounts in bulk (from CSV)

Cocoon Data user accounts can be added to your organisation in bulk (in a single action) by importing their details from a CSV file. CSV file preparation and requirements

• The Cocoon Data Platform’s CSV user import feature assumes that each line of the CSV file (except the first mandatory ‘header’ line) represents field data for a specific user. (The first line will not be imported as a user.)
• The order of field data for each user in the CSV file (as should be defined by the header line) must be:
  Email, Role
  Notes:
  • White space around each separating comma is not required.
  • You can actually specify any field names/labels for the header line of your CSV file. However, the order of field data for each user (in subsequent lines of your CSV file) must comply with the order above (i.e. email address followed by role).
• For a user to be successfully imported from a CSV file, the following conditions must be met:
  1. Values for both of these fields are mandatory.
  2. The Email field’s value must comply with a valid email format.
  3. The Role field value can only be exactly Originator or Collaborator (i.e. an initial capital letter followed by lower-case letters). It is not possible to import Cocoon Data users with the Ad hoc, Organisation administrator or SafeShare administrator roles.
  4. If a user’s email address appears more than once in the CSV file and the conditions above for each of these entries are still met, then only user data from the first of these multiple entries is imported (and the remainder are reported as duplicates).
  If the CSV user import feature encounters a validation problem when parsing a line (due to any of the conditions listed above failing), then that user is not imported. Like duplicate entries, each user for which a validation problem occurred is also reported.

To add users to your organisation in bulk from a CSV file:

1. Ensure you are signed in to Organisation Administration.
2. Click the Users option on the left of the Organisation Administration interface to open the Users page.
3. Click the (Import from CSV) button.
4. In the Import from CSV dialog box, click the Choose a file button.
5. Navigate to and select your CSV file containing the users to be imported to the Cocoon Data Platform.
   The CSV import feature proceeds to import your users. Upon completion, the number of successfully imported Cocoon Data users are reported, along with each unique invalid data value (if any were encountered).
6. Click Close to close the Import from CSV dialog box. Users imported with the Originator role are automatically assigned the default plan.
   Notes:
   • If any of these users’ email addresses have not yet been registered on the Cocoon Data Platform, a new Cocoon Data user account is automatically created for each of them. For each of these users:
     • their Cocoon Data user account will have the Local Account Type, which is indicated on this Users page of Organisation Administration and
     • their email address is sent an ‘account created’ notification, with instructions to the user on how to sign in to SafeShare for Web. The initial sign-in process usually requires the Cocoon Data user to reset their password immediately after signing in.
   • For any of these users who already have a user account on the Cocoon Data Platform, their email address is sent an ‘account updated’ notification, informing the user that their Cocoon Data user account has been added as a member of your organisation. The user can then access SafeShare for Web (as well as other SafeShare products) for your organisation.

​

Finding user accounts within your organisation

As more Cocoon Data users are added to your organisation, it can become difficult to locate specific users through the Users page of Organisation Administration. The Users page therefore offers features to help you locate specific user accounts within your organisation more rapidly. To find specific user accounts within your organisation:

1. Ensure you are signed in to Organisation Administration.
2. Click the Users option on the left of the Organisation Administration interface to open the Users page.
3. Use either of the following features to find a specific user account (or subset of these accounts):
   • Filter user accounts - In the Search By box (right of the Users page), begin typing a series of characters contained in any of the users’ Email, First Name, Last Name, Role or (Organisation) Admin fields, followed by the ‘Enter/Return’ key. This filters the list of users within your organisation to those whose Email, First Name, Last Name, Role or (Organisation) Admin (i.e. ‘yes’ or ‘no’) contains the subset of characters entered into the Search By box.
     By default, the Email, First Name, Last Name, Role or (Organisation) Admin fields are used for filtering (i.e. All), although filtering can be restricted to just one of these fields using the adjacent drop-down.
   • Navigate to specific user accounts - If available, use the page navigation buttons (lower-right of the Users page).

​

Editing an organisation user account

This procedure describes how to edit the role-related fields (i.e. Role, Is Organisation Admin? and Plan) of any existing Cocoon Data user account within your organisation. To edit the role-related fields of a user account in your organisation:

1. Ensure you are signed in to Organisation Administration.
2. Click the Users option on the left of the Organisation Administration interface to open the Users page.
3. Find the user account whose role-related fields are to be edited and select their check box on the left.
4. Click the (Edit User) button which appears at the top.
5. In the Edit User dialog box, update the user’s relevant role-related fields (described in detail above).
6. Click Save and the user’s fields will be updated.

​

Removing a user account from your organisation

Removing a Cocoon Data user account removes the user from your organisation, with the option to either:

• transfer all file objects and folders (including their content) currently owned by this user to that of another Cocoon Data user, or
• permanently delete all of this user’s content.

To remove a Cocoon Data user account from your organisation:

1. Ensure you are signed in to Organisation Administration.
2. Click the Users option on the left of the Organisation Administration interface to open the Users page.
3. Find the user whose account is to be removed from your organisation and select their check box on the left.
4. Click the (Remove User) button to open the Remove User… dialog box.
   Note: If this Cocoon Data user has the Originator role and has one or more items (i.e. files and/or folders), then the Remove User… dialog box indicates the number of items this user owns and requests whether or not you would like to transfer these items to another user’s account (which also has the Originator role).
   • If you wish to transfer these items to another user’s account:
     1. Select the Transfer all content to another Originator check box.
     2. Select the user (i.e. their email address from the list) to transfer the items to:
        • Only users with the Originator role are listed.
        • This list can be filtered by typing a series of characters contained in the users’ email addresses.
   • If you do not wish to transfer these items and would prefer them to be permanently deleted, then leave the Transfer all content to another Originator check box cleared.
5. After confirming your decision to either transfer or permanently delete the user’s items, click Remove.
   • If you chose to transfer these items to another user’s account, then:
     • the user’s account is removed from your organisation and
     • the items that the removed user owned are transferred to a folder at the root level of the recipient user’s storage area. The name of this folder is the removed user’s email address along with the date the transfer occurred.
   • If you chose not to transfer these items, then:
     • the user’s account is removed from your organisation and
     • the encrypted files and folders that belonged to this user are permanently deleted.

​

Editing your Organisation administrator account

This procedure describes how to edit the non-role-related fields of your (Organisation administrator) user account on the Cocoon Data Platform. To edit the non-role-related fields of your Organisation administrator account:

1. Ensure you are signed in to Organisation Administration.
2. Click your email address at the top-right of the page and choose My Account from the drop-down menu.
3. In the Account Details section of the subsequent page, update any of your user account’s fields (described in detail above).
   Note: The Email addresses of all Cocoon Data user accounts on the Cocoon Data Platform are unique and since this field may be used for auditing purposes, no Cocoon Data user account’s email address field can be edited. However, to update the email address of your user account and/or those of other users within your organisation, then for each of these users:
   1. Add a new Cocoon Data user account (with their new email address but the same role-related field values) to your organisation. For each account whose Account Type is LDAP, obtain the new email address from your LDAP server/user directory administrator in order to add their account (with this email address) to your organisation.
   2. Remove the user’s old Cocoon Data user account. For each Cocoon Data user account (with the Originator role), transfer the user’s content from their old account to their new user account.
4. Click Save and your user account’s fields will be updated.
   Notes: If you cannot edit your user account’s fields, then your Account Type is likely to be LDAP. The fields of LDAP user accounts are edited through their respective LDAP servers’ user directories and are updated on the Cocoon Data Platform during synchronisation events with these user directories.

​

Changing your Organisation administrator account password

Only a Cocoon Data user with the Local Account Type who has signed in to either SafeShare for Web or Organisation Administration can change their own password. To change your Organisation administrator account’s password:

1. Ensure you are signed in to Organisation Administration.
2. Click your email address at the top-right of the page and choose My Account from the drop-down menu.
3. In the Security section of the subsequent page, click the Change password button.
4. On the Set your password… page, specify your current password and then your new password twice (i.e. once more to verify it).
5. Click the Change button and your Cocoon Data user account’s password is now changed.

​

Terminating your Organisation administrator account’s sessions

Terminating your Organisation administrator account’s sessions immediately invalidates all of your currently valid refresh tokens. This action immediately signs you out of your current Organisation Administration session and then every other SafeShare application with which you have an active session (i.e. once these sessions’ access tokens expire). This also includes any other client applications using the Cocoon Data Platform’s resources with access tokens obtained through your account. This feature is useful if your Organisation administrator account is at risk of being compromised - for example, you suspect that you forgot to sign out from a shared computer or you were signed in from a laptop that was either lost or stolen before you signed out. To terminate your Organisation administrator account’s sessions:

1. Ensure you are signed in to Organisation Administration.
2. Click your email address at the top-right of the page and choose My Account from the drop-down menu.
3. In the Security section of the subsequent page, click the Terminate button.
   Your current Organisation Administration session with the Cocoon Data Platform is terminated immediately, which also results in you being signed out from your current session. You will need to sign in again to gain access to SafeShare for Web, as well as your Cocoon Data Platform’s resources.
   Note: Every other SafeShare application with which you have an active session (including any other client applications using the Cocoon Data Platform’s resources with access tokens obtained through your account), will be terminated once these sessions’ access tokens expire.

​

Enabling or disabling MFA on Organisation user accounts

If required, an Organisation administrator can configure multi-factor authentication (MFA) by enabling this feature on:

• their own Cocoon Data user account, or
• all Cocoon Data user accounts which are currently members of their organisation (if a SafeShare administrator has allowed this on the Cocoon Data Platform).

If MFA has been enabled on a Cocoon Data user account, the user is then required to enter both their password (i.e. the 1st authentication factor), as well as an authentication code obtained from an authenticator application (aka authenticator app) running on their mobile device (i.e. the 2nd authentication factor), in order for the user to successfully sign in through this account on the Cocoon Data Sign-in page. The MFA feature supports the following mobile devices and authenticator apps:

• Android-based devices running the Google Authenticator app,
• Apple’s iPhone, iPad or iPod Touch devices running the Google Authenticator app, or
• Microsoft Windows-based devices running Microsoft’s authenticator app.

To enable or disable MFA on your Organisation administrator account (or all Cocoon Data user accounts in your organisation):

1. Ensure you are signed in to Organisation Administration.
2. For your Organisation administrator account only:
   • To enable MFA on it:
     1. Click your email address at the top-right of the page and choose My Account from the drop-down menu.
     2. In the Security section of the subsequent page, click the Enable button (to the right of ‘Multi-factor authentication ( disabled )’).
        Your Organisation administrator account’s email address is sent a notification informing you that MFA has been enabled on your account, along with a time-limited link, with step-by-step instructions for configuring MFA ⁽⁶⁾ .
   • To disable MFA on it:
     1. Click your email address at the top-right of the page and choose My Account from the drop-down menu.
     2. In the Security section of the subsequent page, click the Disable button (to the right of ‘Multi-factor authentication ( enabled )’).
        Your Organisation administrator account’s email address is sent a notification informing you that MFA has been disabled on your account.
   For all Cocoon Data user accounts in your organisation:
   • To enable MFA on these accounts:
     1. Click the Configuration option on the left of the Organisation Administration interface to open the Configuration page.
     2. Click the Edit link to the right of the property ‘Enforce multi-factor authentication for organisation members.’
     3. In the Edit Config Property dialog box, select the Property Value check box.
        Tip: For more information about configuring this and other Organisation Administration properties, see Configuring Organisation Administration properties.
     4. Click Save and all Cocoon Data user accounts within your organisation (including your own) will have MFA enabled on their accounts.
        Each Cocoon Data user within your organisation is sent an email notification informing them that MFA has been enabled for their account. This email message contains a time-limited link, with step-by-step instructions for configuring MFA ⁽⁶⁾ .
   • To disable MFA on these accounts:
     1. Click the Configuration option on the left of the Organisation Administration interface to open the Configuration page.
     2. Click the Edit link to the right of the property ‘Enforce multi-factor authentication for organisation members.’
     3. In the Edit Config Property dialog box, clear the Property Value check box.
     4. Click Save and then only each user themselves can disable MFA on their own account (once they have signed in).

⁽⁶⁾ These step-by-step instructions for configuring MFA guide the user on how to:

1. Configure their mobile device with the appropriate authenticator app.
2. Configure the authenticator app (once installed) with their Cocoon Data user account, so that the authenticator app can generate the appropriate authentication codes (for the 2nd authentication factor).

​

Re-configuring MFA for an organisation user account

While multi-factor authentication (MFA) is enabled on a user’s account, the user might lose the ability to generate authentication codes for their 2nd authentication factor (explained in more detail above) due to any of the following reasons:

• The user deleted their Cocoon Data user account configuration from the authenticator application (app) installed on their mobile device.
• The time-limited link for configuring MFA expired before the user had a chance to complete the MFA configuration process. This is the link contained in the email notification informing the user that MFA has been enabled on their account.
• The user lost their mobile device. The user will require a replacement device in order to continue signing in through the Cocoon Data Sign-in page with MFA enabled on their account.

If one of these scenarios occurs, the user will no longer be able to sign in through the Cocoon Data Sign-in page. The user may likely send you or any other Organisation administrator an email message about one of these scenarios having occurred (via ‘contact your administrator’ feature on the Authentication code request page as they attempt to sign in through the Cocoon Data Sign-in page). Therefore, to resolve this situation, the user requires MFA to be re-configured (aka re-seeded) for their account. To re-configure MFA on a Cocoon Data user account in your organisation:

1. Ensure you are signed in to Organisation Administration.
2. Click the Users option on the left of the Organisation Administration interface to open the Users page.
3. Find the user/s whose account is to be re-configured for MFA.
4. Click the Re-seed button (in the Re-seed column) of the relevant user/s to re-configure MFA for their account.
   Each user with MFA re-configured in this manner is sent an email notification informing them that MFA has been enabled for their account, similar to the email notification they received when MFA was originally enabled on their account. This email message contains a new time-limited link, leading to step-by-step instructions for the user to:
   1. (Re-)configure their mobile device with the appropriate authenticator app (should the user need to conduct this step again).
   2. (Re-)configure the authenticator app (once installed) with their Cocoon Data user account, which allows the authenticator app to generate the appropriate authentication codes for the 2nd authentication factor.

​

Configuring ‘Users’ page columns for organisation users

By default, all columns on the Users page are visible. With the exception of the Email column (which is always shown), if there are other columns whose visibility is not required when administering users on your organisation, then these columns can be selectively hidden from the Users page. To hide one or more columns from the ‘Users’ page, or make these columns visible again:

1. Ensure you are signed in to Organisation Administration.
2. Click the Users option on the left of the Organisation Administration interface to open the Users page.
3. Click the Select Columns drop-down and clear the check boxes next to the column names to be hidden. Conversely, select the check boxes next to the column names to be made visible again.