Users (IRPCUsersAdmin)

View as Markdown

Adds, reads, modifies and removes the user accounts of a vault: who may use the vault, with which vault roles.

Use this interface to add, modify and delete user accounts in a vault.

A user account is always associated with a login. The login defines the authentication type and password (if not a Windows login). The user account in a vault just grants a login access to that vault and specifies the vault-level roles of the user. The user account has an ID that remains constant and is used to identify the user in the database (such as 'Last modified by' entry of document). The user account can be associated with a different login without changing the user ID in the vault.

Use the IRPCLoginsAdmin and/or IRPCVaultLoginsAdmin interface to manage logins.

Overview

M-Files Admin uses this service for the Users node of a vault; administration scripts can use it to provision users. All methods need a vault session whose user has the vault right manage_users (VaultAccess); the write methods also need license_allows_modifications. The vault role full control (and a system administrator's full_control_of_vaults) grants both.

Login accounts and user accounts. M-Files separates who can authenticate from who may use a vault:

• A login authenticates; a user account grants that login access to one vault. A login without a user account in the vault cannot open the vault.
• UserAccount.login_name is the login's account name: the user name of an M-Files login (MikeT) or the down-level logon name of a Windows login (domain and user name separated by a backslash).
• The user ID never changes. Objects refer to it (Created by, Last modified by, permissions), so pointing a user account to another login keeps all references.
• Managing server login accounts needs the system administrator server role (server right manage_logins); managing user accounts and vault login accounts needs only the vault right manage_users.

Methods by task:

• Read: GetUsers, GetUser, SearchForUser (by login name).
• Add or bring back: AddUser (preferred), AddOrUndeleteUser, UndeleteUserByGUID.
• Change and remove: ModifyUser, RemoveUser.
• Follow changes: GetChangedUserAccounts.

Typical provisioning: make sure the login exists (server or vault login), then AddUser with login_name set to the login's account name, then add the user to groups with AddMemberToUserGroup.

Users who lack manage_users read users and groups through IRPCVault, for example GetUsersAndUserGroups and GetUserGroups.

Accounts with an External ID. UserAccount.external_id links the account to an identity in an external system such as Microsoft Entra; identity synchronization (M-Files Manage) maintains it. These methods cannot change it, and removing such an account can fail with "Access denied" ("... should be deleted via Manage").

Methods