Users and permissions¶
MRBS uses three access levels:
| Level | Meaning | Typical capabilities |
|---|---|---|
| 0 | Unknown user | View information permitted to the public |
| 1 | Authenticated user | Create bookings and manage their own bookings |
| 2 | Administrator | Manage rooms, areas, users, and other users' bookings |
The exact permissions depend on authentication, session, and booking-policy settings.
Database users¶
With the default db authentication method, users and access levels are stored
in the MRBS database and managed through the user administration interface.
Administrators can create users, change access levels, reset passwords, and manage protected profile fields.
External users¶
With LDAP, SAML, WordPress, Joomla, or another external provider, credentials are managed outside MRBS. MRBS still needs a way to identify administrators, usually through configuration, external groups, roles, or attributes.
Do not create duplicate local credentials when the external provider is the source of truth.
Area and room administrators¶
Area and room contacts can receive notifications and, depending on policy, manage bookings for their resources. Use these roles to delegate day-to-day work without granting system-wide administration.
Restrict capabilities¶
MRBS 1.12.2 includes settings for restricting:
- public access;
- who can create bookings;
- repeated, multiday, or multiroom bookings;
- copying other users' bookings;
- visibility of other users and registrants;
- registration on behalf of another user;
- administrator exemptions from booking policy; and
- booking types reserved for administrators.
Review these controls together rather than enabling them in isolation.
Principle of least privilege¶
- Keep the number of system administrators small.
- Use separate administrator and normal accounts where practical.
- Remove access promptly when responsibilities change.
- Protect password reset and email settings.
- Test public and authenticated views separately.