Getting started with Tehama Administration

Have you completed the Getting Started with Tehama Installation Guide? If not, please go back and do so before proceeding.

Tehama provides an intuitive user administration interface allowing an administrator to perform the tasks that are necessary for getting started with Tehama.

Purpose

So far you have joined Tehama, creating your own Tehama organization, and created and/or connected to or joined a Room.

Now this guide shows you the steps to carry out the following basic and necessary organization and Room set up:

• Step 1: Organization Member Administration
  ...

  • create teams in and invite members to your new organization;

• Step 2: Room Member Administration
  ...

  • grant access to your new Room to organizations and organization members;

• Step 3: Room Administration
  ...

  • configure the firewall rules and the secrets vault in your new Room;

• Step 4: Desktop Administration/Management
  ...

  • learn how to customize your Desktops by requesting additional software be configured in the base Desktop images.
  • create Desktops in your new Room;
  • learn the ways Room members can connect to your Room's Desktops.

This guide also provides the steps for some additional organization and Room administration tasks that are commonly performed by organization admin users and managers:

• Addendum: Additional Admin
  ...

  • resend an invitation to become an organization member (organization administration);
  • delete an organization member (organization administration);
  • edit a Desktop (Desktop management); and
  • delete a Desktop (Desktop management).

When you have completed all the steps and tasks outlined in this guide, Tehama will be operational, and Desktop users and service providers will have configured accounts.

Authorized Service Providers will be able to manage resources and customers will have full control over access to their data and their Room in Tehama, including Tehama Desktop session recordings (see Desktop Session Auditing).

For more information on:

• Organization Member Administration - see the Organization User Guide.
• Room Member Administration - see the Room Membership User Guide.
• Room Administration

  • for Room Administration/Management: see the Room Connection Status Monitoring/Management User Guide.
  • for Firewall Rules: see the Firewall Rules User Guide.
  • for Secrets: see the Secrets Vault User Guide.

• Desktop Administration/Management - see the Desktops User Guide.

1. Organization Member Admin

After the installation and connection of a Tehama Room is completed, the first task is to create teams and add members to your Tehama organization.

• a. Create new teams
• b. Create new members

 • Create teams

Create a new team as follows:

1. Log in to the Tehama Web UI.
2. Click on the MEMBERS tab.
3. Click on the three vertical dots next to the team-selector field. Depending on whether you have "All Members" selected or an existing team selected, you will see
   either
   or
4. Select Add New Team.
5. Type in a name for the team (e.g., DB Admins).
6. Click CREATE.

Repeat these steps for each team needed.

See the Create a Team section in the Organization User Guide for more details.

 • Invite members

After creating one or more new teams, the next task is to invite new members to the organization.

1. Log in to the Tehama Web UI.
2. Click on the MEMBERS tab.
3. Click the NEW dropdown menu to open it.
4. Select Add New Member.
5. Enter the member information:
   • Name
   • Email Address
   • Role (Staff or Manager)
   • Room (Optional - select one or more Rooms from the list of Rooms the organization has access to
     
     Note: You can, from here in the MEMBERS tab, assign additional rooms from this list after the member is created, or you can grant access to members directly from the interface for a Room (first ensuring the organization has access to the Room, of course.)
     
     
   • Team (Select one of the team created in the previous step or leave this blank)
6. Click INVITE.

Repeat these steps for each member you need to invite.

Once invited, new members will receive an invitation email to the address specified. The invitation email contains a link which each new team member must action to gain access to Tehama. The user will also be added/proposed as a member in the selected Room(s) (if you selected one or more Rooms in the dialog).

See the Add Members section in the Organization User Guide for more details.

2. Room Member Admin

To begin using a Room, the next task will be to grant members and/or organizations access to the Room.

• a. Add Organizations
• b. Add Members/Teams

 • Grant access to orgs

The Room's connected organization must handle this task.

1. Log in to the Tehama Web UI.
2. Click on the ROOMS tab.
3. Click the name of the Room where organization access will be granted.
4. In the resulting screen (the Room interface), click MEMBERS.
   From the 'members' screen, you will see a list of organizations that have access to the Room. (The initial setup will show only one organization.)
5. Click the ADD ORGANIZATION button at the bottom of the list or select Organization from the ADD dropdown menu in the top right corner of the page. You will see the ADD ORGANIZATION dialog.
6. Select the desired Organization from the list in the dialog to invite to the Room.
7. Select the desired Policy for the Organization.
8. Click INVITE.

See the Invite organizations to join a Room section in the Room Membership User Guide for more details.

 • Grant access to members

With members (and teams) now created, the next task is to grant member access to your Room.

If your organization is your Room's connected organization, then you can directly add members.

If your organization is not your Room's connected organization, then you can only propose members, and the connected organization will approve (or reject) your proposals.

Choose one method below to add members or teams to the Room.

• Individual Members
• Entire Teams of Members

Grant Access to Individual Members

1. Log in to the Tehama Web UI.
2. Click on the ROOMS tab.
3. Click the name of the Room for which member access is to be granted.
4. In the resulting screen (the Room interface), click MEMBERS.
   From the 'members' screen, you will see a list of organizations that have access to the Room. (The initial setup will show only one organization.)
5. To the left of the Organization name, Click the drop-down arrow icon to show the list of members for the organization.
6. At the top of the drop-down, click the + MEMBER button.
   (or the + PROPOSE button if you are not part of the connected organization).
7. From the ADD dialog, choose Members.
   (This dialog is the PROPOSE TEAM MEMBER dialog if you are not part of the connected organization.)
   (You may also opt to choose Invite New Member instead of Members, which will allow you, following the steps to 'Invite New Members', to invite a member to join the organization and add them to the Room.)
8. Select the member (or multiple members) from the list to add to the Room.
9. Click the ADD button.
10. Close the list of members by clicking on the drop-down arrow. icon.

Grant Access to an Entire Team of Members

1. Log in to the Tehama Web UI.
2. Click on the ROOMS tab.
3. Click the name of the Room for which member access is to be granted.
4. In the resulting screen (the Room interface), click MEMBERS.
   From the 'members' screen, you will see a list of organizations that have access to the Room. (The initial setup will show only one organization.)
5. To the left of the Organization name, click the drop-down arrow icon to show the list of members for the organization.
6. At the top of the drop-down, click the + MEMBER button
   (or the + PROPOSE button if you are not a part of the connected organization).
7. From the ADD dialog, choose Teams.
   (this dialog is the PROPOSE TEAM MEMBER dialog if you are not part of the connected organization).
8. Select the Team (or multiple teams) from the list to add to the Room.
9. Click the ADD button.
10. Close the list of members by clicking on the drop-down arrow icon

See the Request Room access for users section and the Add Room access for users section in the Room Membership User Guide for more details.

Also see the Assign members to one or more Rooms section in the Organization User Guide for details on how to assign a member to one or more rooms from the MEMBERS tab.

3. Room Administration

After assigning members (or whole teams) to the Room, the next task is to enable connectivity (through the creation of firewall rules) and add secrets/passwords for assets/resources in the connected network.

• a. Create a Firewall Rule
• b. Configure the Secret/password Store

 • Create firewall rules

The Room's connected organization must handle this task.

Before the Room's Desktops (workspaces) can communicate with network resources, you need to configure firewall rules. By default, all outbound traffic is restricted. (Note, configuring a secret (below) also allows the creation of a firewall exception.)

1. Log in to the Tehama Web UI.
2. Click on the ROOMS tab.
3. Click the name of the Room for which you want to add firewall rules.
4. In the resulting screen (the Room interface), click CONNECTION.
5. Click on the FIREWALL RULES sidebar item.
6. Click ADD RULE.
7. In the resulting screen, enter the following information:
   • Rule Name (a friendly name for the firewall exception)
   • IPv4 CIDR block (IP addresses to expose with Subnet Prefix). E.g.: 127.0.0.1/32)
   • Protocol - the protocol supported by the rule (TCP or UDP).
   • Port Single port, Port range or All ports (choose one).
   • Port (enter the port number or port range required for the application).
8. Click CREATE.

See the Add custom firewall rule section in the Firewall Rules User Guide for more details.

 • Add secrets/passwords

The Room's connected organization must handle this task.

To avoid sharing network resource credentials insecurely, Tehama provides access to an encrypted Secret Password store used to securely store, encrypt, and grant authorized members access to credentials and other sensitive information.

1. Log in to the Tehama Web UI.
2. Click on the ROOMS tab.
3. Click the name of the Room for which you want to configure secrets.
4. In the resulting screen (the Room interface), click CONFIGURE.
5. Click on the SECRETS sidebar item.
   You will see a list of secret types, (Cassandra, Generic, MongoDB, etc)
6. Click the type of secret you wish to add.
   The secret view is organized by:
   • asset (secret, e.g. Database credentials)
   • folder (for logical storage of assets)
7. Create a Folder to organize the secrets.
   • (a) Click the ADD secret type FOLDER button.
   • (b) In the resulting screen, enter the desired Folder name and fill in the required fields. e.g: a firewall exception may need to be specified. (See the Secrets Vault User Guide for more guidance.)
   • (c) Click CREATE.
8. Create an Asset.
   • (a) Double-click the folder name where the Asset is to be filed.
     If no folder is specified, the root folder will be used.
   • (b) Click the ADD ASSET button.
     In the resulting screen, enter the following:
     • Asset Name (friendly name for your asset/secret) and fill in any required fields. (See the Secrets Vault User Guide for more guidance.)
   • (c) Click CREATE.

Authorized members can click the asset name to access the asset under the SECRETS sidebar item within the Room's WORK tab. They may also access the asset from the 'Workspace Agent' application's SECRETS tab with one of the Room's Desktops.

See the Secrets Vault User Guide for more details.

4. Desktop Admin/Mgmt

Now that the configuration of your Room is completed, you need to you need to create your Desktop templates, from which your virtual Desktop instances are built.

• a. Create a Virtual Desktop

Now that you have (at least one) Desktop template in your Room (and associated Desktop instances), you are ready (almost) to use your new Desktop. First your members need to learn how to connect to their Desktops.

• b. Connect to a Virtual Windows Desktop
• c. Connect to a Virtual Linux Desktop

 • Create Desktops

The Room's owner organization must handle this task.

The Room's other organizations can request Desktop templates instead. See the Request a Desktop Template section in the Desktops User Guide for more details.

Members require a Desktop instance to perform their functions. Create a Desktop template and assign members to it. Desktop instances will be built for the assigned members from the template.

1. Log in to the Tehama Web UI.
2. Click on the ROOMS tab.
3. Click the name of the Room for which you want to create a Desktop template.
4. In the resulting screen (the Room interface), click on the CONFIGURE tab.
   From the 'configure' screen you can see your Room's configuration details, add/remove secrets and, of interest to us here, add/edit/remove Desktop templates.
5. Click on the WINDOWS DESKTOPS or LINUX DESKTOPS sidebar item, depending on what type of Desktop template you wish to add. (If you do not see the LINUX DESKTOPS sidebar item, then the Linux Desktop feature is not enabled for your Room. Support for enabling this feature is currently suspended.)
   • A list of previously configured Desktop templates will appear. On initial configuration, there will be no Desktop templates displayed.
6. Initiate the creation of a Desktop template as follows:
   • For Windows Desktops:
     Click the ADD WINDOWS DESKTOP TEMPLATE button in the top right corner of the page.
   • For Linux Desktops:
     Click ADD LINUX DESKTOP TEMPLATE in the top right corner of the page.
   The Desktop template creation dialog relevant to the type of Desktop will appear.
7. Proceed as follows:
   • For Windows Desktops:
     1. First enter the requested information:
        • Name of Desktop (friendly name used to identify the Desktop template function or owner)
        • Mode (Choose if individual or multiple (Shared) login functionality is enabled)
        • Number of Desktops only visible if 'Shared' chosen for Mode (Choose how many Desktops are to be instantiated)
        • Specification (Hardware specifications)
        • Always On (Choose if the Desktop instance needs to remain powered on when idle)
     2. Click on the NEXT: ASSIGN TO MEMBERS button. The ASSIGN WINDOWS DESKTOP TEMPLATE dialog will appear. (Click on the arrow to the left of the dialog title to return to the previous dialog.)
     3. Click on the Users field to open the list of Room members that you can assign to this Desktop template. (These are the users who will have access to the Virtual Desktop instance built from this template.)
     4. Select the name(s) of the Room members that you wish to assign to this Desktop. (There must be at least one name specified. At this time, a template cannot be created without at least one Room member assigned to it.)
     5. Click SAVE TEMPLATE AND ASSIGN TO MEMBERS. The SUCCESS dialog will appear.
     6. Click CLOSE to dismiss the SUCCESS dialog.
   • For Linux Desktops:
     1. You may see two choices at the top of the dialog.
        
        ◯ Linux (Legacy)     ◯ Linux Desktop
        
        The "Linux (Legacy)" selection is for the desktop provided by Tehama's legacy Linux Desktops feature.
        
        The "Linux Desktop" selection is for the desktop provided by Tehama's Linux Desktops feature (recommended).
        
        Select the type of Linux Desktop you desire.
        
        If there are no choices, then your Room only supports one type of Linux Desktop, most likely from the recommended Linux Desktops feature.
        
        A quick way to differentiate between the two types of Linux desktops is on the next dialog where you assign members to the desktop. Legacy desktops allow you to specify multiple users while the other does not.
        
        
     2. Enter the requested information:
        
        
        • Name of Desktop (friendly name used to identify the Desktop function or owner)
        • Operating System
        • Specification (Hardware specifications)
     3. Click on the NEXT: ASSIGN MEMBERS button. The ASSIGN MEMBERS dialog will appear.
        
        (Click on the arrow to the left of the dialog title to return to the previous dialog.)
        
        For legacy Linux Desktop templates only:
        • If you want this to be a multi-user Desktop, select the Multi User Desktop checkbox. WARNING: Once the Desktop is created it is not possible to convert a single user Desktop to multi-user.
          If selected, the User field changes to Users and a new field, Sudo Users appears.
        • If single user:
          • In the User field, enter the name of the Room member who will be assigned to this Desktop template. (The field cannot be left empty.)
          • Note that the single user assigned to this Desktop template will be given full sudo user capabilities on the Desktop instance built from the template.
        • If multi user:
          • In the Users field, enter the names of those who will be assigned to this Desktop template. (There must be at least one name specified.)
          • In the Sudo Users field, enter the name(s) of those users who will be given the ability to perform certain operations with elevated privileges, such as using the package manager, on the Desktop instance built from the template.
        
        For Linux Desktop templates only:
        • In the User field, enter the name of the Room member who will be assigned to this Desktop template. (The field cannot be left empty.)
        • Note that the single user assigned to this Desktop template will be given full sudo user capabilities on the Desktop instance built from the template.
     4. Click NEXT: REVIEW. The REVIEW dialog will appear.
        
        
     5. Read the disclaimer (if any) and review the specification details.
        
        
     6. Click CREATE.

See the Add a Desktop Template section in the Desktops User Guide for more details.

 • Connect to a Win Desktop

Connect to your Windows Desktop:

1. Locate the interface for the Desktop to which you want to connect. (Choose A or B.)
   
   A: find the Desktop in the list of all your Desktops in the organization
   1. Log in to the Tehama Web UI.
   2. Click on the DESKTOPS tab.
   3. Click the My Desktops radio button at the top of the page. (NOTE: If you are a Staff member in the organization, you will not see this radio button. The list will be restricted to only your assigned Desktops by default.)
   4. Locate the entry for the Desktop to which you want to connect.
   B: find the Desktop in the list of your Desktops in the Room it belongs to
   1. Log in to the Tehama Web UI.
   2. Click on the ROOMS tab.
   3. Click on the name of the Room you want to access. You will see the Room's interface.
   4. Click the WORK tab.
   5. Click on the MY DESKTOPS sidebar item.
   6. Locate the entry for the Desktop to which you want to connect.
2. Click on either the name of the desktop or on the CONNECT button in the entry.
   
   Note: If you see the word UNAVAILABLE next to the template's name instead of the CONNECT button, it means there are too many Desktop instances currently in use within the Room the template belongs to and you will not be able to connect. A maximum of 75 Desktop instances can be in use within a Room concurrently.
   
   This will launch your Windows Desktop instance as a standalone application.
   
   The Launching your Desktop dialog will appear while your desktop is launching. Dismiss this dialog once your desktop launches successfully.
   
   
   IMPORTANT Your Desktop will fail to launch unless you have downloaded the Tehama Desktop Client ('Tehama App') and the Teradici PCoIP Desktop Client to your device. This is a one time action per device.
   
   Configure your device for connection:
   
   

   1. Click on the words download and install on the Launching your Desktop dialog. You will see the Download Tehama Client dialog appear. You can download the desktop clients from this dialog.
      
      
   2. Click the icon for your device's operating system (Linux, Windows or MacOS) to download the desktop clients onto your device.
      
      
   3. Follow any installation/configuration instructions that are provided in the downloaded artifact(s).
      
      
   4. Return to the Launching your Desktop dialog from the Download Tehama Client dialog by clicking on the back arrow in the top left corner.

   Once your device is configured, click on Retry in the Launching your Desktop dialog to launch your Windows Desktop instance as a standalone application. (This is identical to returning to the table entry for your desktop and clicking on the CONNECT button there.)

Be aware of the following Windows Desktop Sessions behaviour:

• Your Desktop may be restarting or rebooting. If so, wait a few minutes and try again.
• For Windows users, if prompted to allow firewall access, click Allow Access.
  The connection can take a minute to be fully established.
• Upon launch, your Desktop will begin initializing/starting. The Workspace Agent application (also known as the Desktop Agent) will start up in the background, but will not be shown. You can show the Workspace Agent by clicking on its icon in the tray or on the desktop. If the Workspace Agent detects an update, the update will be downloaded automatically and the Workspace Agent will restart. If it detects an update while the Desktop is restarting/rebooting, it will delay performing the update for two minutes.

See the Connect to a "Windows Desktop" Desktop section in the Desktops User Guide for more details.

 • Connect to a Linux Desktop

Connect to your Linux Desktop as follows:

1. Log in to the Tehama Web UI.
2. Click on the ROOMS tab.
3. Click the name of the Room containing the Linux Desktop instance that you want to access.
4. In the resulting screen (the Room interface), click WORK.
   From the 'work' screen you can access the secrets that have been configured for the Room, view/upload/download/remove files from the file vault for the Room and, of interest here, see the Desktops assigned to you in the Room and access them. (Note that this is also where users without privileges in the Room can request Desktops and view pending Desktop requests.)
5. Click on the MY DESKTOPS sidebar item.
   • A list of previously configured Desktops that are assigned to you, both Windows and Linux, will appear.
6. Click the CONNECT button adjacent to the desired Linux Desktop instance.
   
   For legacy Linux Desktop instances:
   This will launch your legacy Linux Desktop instance in a new tab in your browser.
   
   For Linux Desktop instances:
   
   This will launch your Linux Desktop instance as a standalone application.
   
   The Launching your Desktop dialog will appear while your desktop is launching. Dismiss this dialog once your desktop launches successfully.
   
   

   IMPORTANT Your Linux Desktop will fail to launch unless you have downloaded the Tehama Desktop Client ('Tehama App') and the Teradici PCoIP Desktop Client to your device. This is a one time action per device.
   
   Configure your device for connection:
   
   

   1. Click on the words download and install on the Launching your Desktop dialog. You will see the Download Tehama Client dialog appear. You can download the desktop clients from this dialog.
      
      
   2. Click the icon for your device's operating system (Linux, Windows or MacOS) to download the desktop clients onto your device.
      
      
   3. Follow any installation/configuration instructions that are provided in the downloaded artifact(s).
      
      
   4. Return to the Launching your Desktop dialog from the Download Tehama Client dialog by clicking on the back arrow in the top left corner.

   Once your device is configured, click on the Retry link in the Launching your Desktop dialog to launch your Linux Desktop instance as a standalone application. (This is identical to returning to the table entry for your desktop and clicking on the CONNECT button there.)

See the Connect to a "Linux Desktop" Desktop section in the Desktops User Guide for more details.

⁍ (Addendum) Additional Admin

This section details additional administrative functions that are performed only as needed, and are not necessary to begin using Tehama.

They are included here in this getting started guide since they are commonly performed tasks.

 • Resend org invite

In the event the original email invitation link has expired, a new invite may be generated and sent. Follow these steps to resend an invite:

1. Log in to the Tehama Web UI.
2. Click on the MEMBERS tab.
3. Click name of the invited, but still pending, member you wish to resend an invite to.
4. In the resulting screen, Click the blue RESEND INVITE button.
   • If there is a need to send the link manually, you can use the invitation link presented.

See the 'Resend member invite' section in the Organization User Guide for more details.

 • Delete org members

Note: If the organization has enabled Single Sign On (SSO) and SCIM user provisioning as its authentication method, delete or un-assign members from Tehama in the identity provider used. (See Single Sign On (SSO) and SSO User Provisioning in the Authentication User Guide for more information.)

Should you need to delete existing members, follow these steps:

1. Log in to the Tehama Web UI.
2. Click on the MEMBERS tab.
   
   
   • Option 1 (allows for bulk deletions):
     1. (a) Select the member you wish to delete by clicking in the checkbox to the left of the member's name. Select multiple members for bulk deletions.
        
     2. (b) At the bottom of the page, click the Trash Can icon. You will see the DELETE MEMBER(S)) dialog.
     3. (c) Confirm that you want to continue with the deletion and click DELETE.
        
        
   • Option 2:
     1. (a) In the row for the member you wish to delete, click on the three vertical dots menu under the Actions column.
        
     2. (b) Select the Delete Member item. You will see the DELETE MEMBER(S)) dialog.
     3. (c) Confirm that you want to continue with the deletion and click DELETE.

See the Delete a member section in the Organization User Guide for more details.

 • Edit a Desktop

The Room's owner organization must handle this task.

If you need to modify the Virtual Desktop (Desktop Name or Member permissions only) follow these steps:

1. Log in to the Tehama Web UI.
2. Click on the ROOMS tab.
3. Click the name of the Room that contains the Desktop you wish to edit.
4. In the resulting screen (the Room interface), click CONFIGURE.
5. Click on the WINDOWS DESKTOPS or LINUX DESKTOPS sidebar item, depending on what type of Desktop template you wish to edit.
   • A list of previously configured Desktops will appear.
6. Locate the Desktop template you wish to edit.
7. Click on the three vertical dots under the Actions column in the entry you wish to edit, then select 'Edit'. In the resulting dialog:
   • (a) Modify the name of the Desktop.
   • (b) Modify the authorized users (and sudo users for Linux Desktops) by clicking in the drop-down list for the field.
   • (c) Add or remove members as necessary.
   • (d) Click SAVE.

See the Edit a Desktop section in the Desktops User Guide for more details.

 • Delete a Desktop

If you need to delete a Desktop template completely, follow these steps:

1. Log in to the Tehama Web UI.
2. Click on the ROOMS tab.
3. Click the name of the Room that contains the Desktop template you wish to delete.
4. In the resulting screen (the Room interface), click CONFIGURE.
5. Click on the WINDOWS DESKTOPS or LINUX DESKTOPS sidebar item, depending on what type of Desktop template you wish to delete.
   • A list of previously configured Desktops templates will appear.
6. Locate the Desktop template you wish to delete.
7. Click on the three vertical dots under the Actions column in the entry you wish to delete, then select 'Delete'. The DELETE DESKTOPS dialog will appear¹.
8. Type the name of the Virtual Desktop to confirm deletion (case sensitive).
9. Click DELETE.

See the Delete a Desktop section in the Desktops User Guide for more details.