yCrash Teams

Effectively analyzing Java application and server logs often involves handling sensitive and highly confidential information. The yCrash Teams feature provides a secure and collaborative environment for organizing and restricting access to log analysis reports.

Core Features

• Team Collaboration: Create teams and invite members to collaborate seamlessly.
• Data Isolation: Each team's data is securely isolated, ensuring members from one team cannot access reports of another.
• Role-Based Access Control: yCrash Teams provides three user roles—Super Admin, Admin, and Member—each with distinct privileges.

User Roles and Privileges

1. Super Admin

• Access all reports across teams.
• Upload and analyze logs using any team.
• Perform administrative tasks:
  • Create or delete teams.
  • Add or remove members from any teams.
  • Change user roles in any team.

2. Admin

• Access reports only in their respective teams.
• Upload and analyze logs in their respective teams.
• Manage team operations:
  • Create or delete teams.
  • Add or remove members in their teams.
  • Change user roles in their teams.

3. Member

• Access reports only in their respective teams.
• Upload and analyze logs in their respective teams.

Note:

The yCrash Teams feature is available only when Single Sign-On (SSO) is enabled.

Integrating yCrash Teams with AD/IdP Groups

For enterprises that rely on Active Directory (AD) or Identity Provider (IdP) groups for user authorization, managing teams manually can become a daunting task, especially when dealing with large numbers of users already organized within these groups. To streamline this process, yCrash offers seamless integration with AD/IdP groups, simplifying team creation and management.

How Integration Works?

• Group Attribute Configuration: Configure your IdP to include a custom attribute such as "group" in the SAML response and map it to the group name.

• Automated Team Creation:

  • After successful Single Sign-On (SSO) authentication, the IdP includes the "group" attribute in the SAML response sent back to the service provider, which in this case is yCrash.
  • When yCrash receives the SAML response, it reads the "group" attribute to determine the user's group.
  • If a team with the specified group name doesn’t exist, yCrash automatically creates the team and adds the logged-in user to it. The first user in the team is assigned the Admin role.

This integration ensures effortless alignment with enterprise group configurations while saving time on manual team management.

Note:

Ensure that the SAML response includes an email attribute, allowing yCrash to automatically register logged-in users in the database.

Strict AD/IdP Group Authorization Configuration

In large enterprises, users may belong to multiple groups, but not all groups should have access to yCrash. You can configure allowed groups using the yc-sso-config.json file.

Example:

If a user belongs to 50 groups but only three should have access, configure:

{
	"authorizedGroups": ["Group10", "Group20", "Group30"]
}  

Strict Authorization Configuration.

The strict authorization feature enhances control over user access based on their association with AD/IdP groups. Configure it using the -DstrictAuthorization system property in the yCrash launch script.

Scenarios and Outcomes

1. Strict Authorization Enabled (-DstrictAuthorization=true)

   • If the logged-in user is not part of any AD/IdP group (group attribute is empty in the SAML response):
     • Access to yCrash is restricted.
       • Ensures that only users associated with authorized groups can access the application.

2. Strict Authorization Disabled (-DstrictAuthorization=false)

   • If the logged-in user is not part of any AD/IdP group (group attribute is empty):
     • The user is added to a common team shared among non-group users.
     • All users in this common team will have shared access to view and analyze each other's reports.

3. No Strict Authorization Configuration (Property Not Set)

   • If the logged-in user is not part of any AD/IdP group:
     • yCrash creates a private default team for the user.
     • This team is unique to the user, ensuring that their log analysis remains secure and accessible only to them.
     • The user can also invite other members to join this private team for collaborative analysis.

Configuring Super Admin Role

Super Admins have elevated privileges for managing teams and performing administrative tasks. This role can be configured by integrating yCrash with AD/IdP groups.

Steps to Configure Super Admin Role

1. Define a Super Admin Group:

• Create a dedicated group in your AD/IdP system for users who should have Super Admin privileges in yCrash.
• Add all users who require Super Admin access to this group.

2. Assign Roles Automatically:

• When users from the specified group log in to yCrash via Single Sign-On (SSO), yCrash will automatically:

  • Creates a new team corresponding to the Super Admin group.
  • Adds users from the group to this team with Super Admin roles.

3. Configure Super Admin Group Name:

To enable this functionality, specify the Super Admin group name in the yCrash launch script using the system property -DsuperAdminGroupName

-DsuperAdminGroupName="your-super-admin-group-name"

Replace your-super-admin-group-name with your AD/IdP group name.

Creating Teams Manually

If you are not using AD/IdP groups or need to create additional teams for specific purposes, yCrash provides a convenient option to manually create teams. This flexibility allows you to customize your team structure according to your requirements.

Steps to Create a Team

1. Navigate to the My Team Page:

• Open the My Team page in the yCrash application.

2. Use the Create Team Option:

• Click Create Team to begin.
• Enter the desired team name and configure settings as required.

3. Invite Members:

• Add users to the team by entering their email addresses or selecting from existing users.

For detailed instructions, visit the My Teams page.