Managing Users, Roles and Permissions
The permission model in brief
FMWeb works on a role-based model:
- Permissions are fine-grained keys following the pattern
area.action– e.g.vehicles.view(view vehicles),vehicles.edit(edit),belege.import(cost import). - Rollen (Roles) bundle permissions (grouped into categories such as System, Fleet, Finance, Contracts, Bookings, Reports).
- Benutzer (Users) are granted one or more roles.
Rules of thumb for troubleshooting: If a menu item is missing, the corresponding .view permission is missing. If a button is greyed out (create/edit/delete), the .edit/.delete/.admin permission is missing. Entire modules can additionally be hidden by the licence (e.g. Strafmandate/penalty notices = Enterprise, Disposition = WebDispo, Dokumente/Documents = Document Management) - this is not a permission issue.
Creating and editing users
- Systemadministration → Benutzer (System Administration → Users) (
/applications/users/overview) → "Neu" (New) or open a user. - Maintain the username, e-mail (checked for validity and duplicates) and phone number.
- Passwort (Password): set only at creation; later via the "Passwort festlegen" (Set Password) dialog. With "Passwort bei nächster Anmeldung ändern" (Change password at next login) you force a change.
- Assign Rollen (Roles) via checkboxes. Speichern (Save).
- Sperren (Locking): The "Gesperrt?" (Locked?) flag disables access without deleting the user.
Bundled roles
| Role | Purpose |
|---|---|
| SysAdmin | System role with automatically all permissions (not editable) |
| Flottenmanager (Fuhrparkleiter) (Fleet Manager) | All functional permissions – default role for new users without a role assignment |
| Nur Anzeige (View Only) | View everything, change nothing |
| Disposition (Dispatch) | Focus on vehicle dispatch |
| Buchungsmanager (Booking Manager) | Focus on WebRes booking management |
| Praktikant/Auszubildende (Intern/Trainee) | Restricted editing (Belege/receipts, Dokumente/documents, tyres) |
You create your own roles under Systemadministration → Rollen (System Administration → Roles) and assemble the permissions via checkboxes. System roles can be neither renamed nor deleted.
Important: The grant ceiling
Since version 10.4 the following applies: A user can only grant roles and permissions that they hold themselves.
- Roles that contain permissions above your own appear in the user editor as greyed-out checkboxes - this is intentional, not a bug.
- The same applies to individual permissions in the role editor.
- Existing higher assignments (e.g. an existing SysAdmin) are retained on save - they can be neither removed nor newly granted by a restricted editor.
- Only SysAdmin/WebAdmin grant without restriction.
This way a delegated "user administrator" (holding only system.users) cannot give themselves or others administrator rights.
Driver logins are a different matter
Drivers log in via the separate driver login of the driver portal. Their access is managed in the driver record (reset password, "Rechte" (Rights) tab), not via the role system. The role system applies only to back-office users.
Note for existing customers: The web role system is independent of the group rights of the classic Windows Flottenmanager (Fleet Manager) - rights are not synchronized.
Related articles
