Service Accounts & Permissions

01 Overview & Design Philosophy

MinusNow uses a consolidated service account model with 4 accounts, matching the industry-standard approach used by platforms like ServiceNow, Jira Service Management, and BMC Helix. Module-level access control is enforced at the application RBAC layer, not at the database layer.

02 Industry Standards Comparison

How MinusNow's approach compares to major ITSM platforms.

03 Service Account Inventory

MinusNow requires exactly 4 service accounts across all deployment types (on-premises, cloud, and hybrid).

# /etc/sudoers.d/mnow-agent
mnow-agent ALL=(ALL) NOPASSWD: \
  /usr/bin/systemctl restart *, \
  /usr/bin/systemctl status *, \
  /usr/sbin/service * restart, \
  /usr/bin/apt-get update, \
  /usr/bin/apt-get install -y --only-upgrade *, \
  /usr/bin/yum update -y *, \
  /usr/bin/dmidecode, \
  /usr/sbin/lshw -json

04 OS-Level User Configuration

Create and configure service accounts at the operating system level. These commands match the deployment guides exactly.

Linux (Ubuntu / RHEL / Debian)

#!/bin/bash
# === MinusNow Application User ===
# Matches: Linux On-Prem Guide, Cloud Guide, OS & Prerequisites Guide
sudo useradd -r -m -d /opt/minusnow -s /bin/bash minusnow

# Create application directories
sudo mkdir -p /opt/minusnow-itsm
sudo mkdir -p /var/log/minusnow
sudo mkdir -p /var/lib/minusnow/{data,backups}
sudo chown -R minusnow:minusnow /opt/minusnow-itsm
sudo chown -R minusnow:minusnow /var/log/minusnow
sudo chown -R minusnow:minusnow /var/lib/minusnow

# === Monitoring Agent User (on managed hosts only) ===
# Matches: OS & Prerequisites Guide, Agent Installation Guide
sudo useradd -r -s /usr/sbin/nologin mnow-agent

# Grant agent limited sudo for auto-healing and discovery
echo "mnow-agent ALL=(ALL) NOPASSWD: \
  /usr/bin/systemctl restart *, \
  /usr/bin/systemctl status *, \
  /usr/sbin/service * restart, \
  /usr/bin/apt-get update, \
  /usr/bin/apt-get install -y --only-upgrade *, \
  /usr/bin/yum update -y *, \
  /usr/bin/dmidecode, \
  /usr/sbin/lshw -json" \
  | sudo tee /etc/sudoers.d/mnow-agent
sudo chmod 0440 /etc/sudoers.d/mnow-agent

Windows Server

# === MinusNow Application User ===
# Matches: Windows On-Prem Guide, Cloud Guide
$pw = [System.Web.Security.Membership]::GeneratePassword(32, 8)
New-LocalUser -Name "minusnow" `
    -Password (ConvertTo-SecureString $pw -AsPlainText -Force) `
    -Description "MinusNow ITSM service account" `
    -PasswordNeverExpires $false

# Create and secure application directory
New-Item -ItemType Directory -Path "C:\MinusNow\ITSM" -Force
New-Item -ItemType Directory -Path "C:\MinusNow\ITSM\data" -Force
New-Item -ItemType Directory -Path "C:\MinusNow\ITSM\logs" -Force
New-Item -ItemType Directory -Path "C:\MinusNow\ITSM\backups" -Force

$acl = Get-Acl "C:\MinusNow"
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
    "minusnow", "Modify", "ContainerInherit, ObjectInherit", "None", "Allow")
$acl.AddAccessRule($rule)
Set-Acl "C:\MinusNow" $acl

# === Monitoring Agent User (on managed hosts only) ===
# Matches: Agent Installation Guide
$agentPw = [System.Web.Security.Membership]::GeneratePassword(32, 8)
New-LocalUser -Name "mnow-agent" `
    -Password (ConvertTo-SecureString $agentPw -AsPlainText -Force) `
    -Description "MinusNow monitoring agent" `
    -PasswordNeverExpires $false `
    -UserMayNotChangePassword $true

Add-LocalGroupMember -Group "Performance Monitor Users" -Member "mnow-agent"

05 Database Accounts & Grants

PostgreSQL user creation and permission grants. These match the database setup in the deployment guides.

Create All Database Users

-- =============================================================
-- MinusNow Database Setup
-- Matches: OS & Prerequisites, Linux/Windows/Cloud Deploy Guides
-- =============================================================

-- 1. Primary application user (data owner)
CREATE USER minusnow WITH PASSWORD 'REPLACE_WITH_SECURE_PASSWORD'
  NOSUPERUSER NOCREATEDB NOCREATEROLE;
CREATE DATABASE minusnow_itsm OWNER minusnow;
GRANT ALL PRIVILEGES ON DATABASE minusnow_itsm TO minusnow;

-- Connect to application database for remaining setup
\c minusnow_itsm

-- Grant schema ownership (Drizzle ORM manages migrations)
GRANT ALL ON SCHEMA public TO minusnow;
ALTER DEFAULT PRIVILEGES IN SCHEMA public
  GRANT ALL ON TABLES TO minusnow;
ALTER DEFAULT PRIVILEGES IN SCHEMA public
  GRANT ALL ON SEQUENCES TO minusnow;

-- Enable required extensions
CREATE EXTENSION IF NOT EXISTS "uuid-ossp";    -- UUID generation
CREATE EXTENSION IF NOT EXISTS "pg_trgm";      -- Fuzzy text search

-- 2. Backup user (read-only for pg_dump)
CREATE USER mnow_backup WITH PASSWORD 'REPLACE_WITH_SECURE_PASSWORD'
  NOSUPERUSER NOCREATEDB NOCREATEROLE CONNECTION LIMIT 2;
GRANT pg_read_all_data TO mnow_backup;

-- 3. Monitoring user (stats only, no application data)
CREATE USER mnow_monitor WITH PASSWORD 'REPLACE_WITH_SECURE_PASSWORD'
  NOSUPERUSER NOCREATEDB NOCREATEROLE CONNECTION LIMIT 3;
GRANT pg_monitor TO mnow_monitor;
GRANT CONNECT ON DATABASE minusnow_itsm TO mnow_monitor;

-- Revoke public access
REVOKE ALL ON ALL TABLES IN SCHEMA public FROM PUBLIC;

Connection Limits

pg_hba.conf Access Control

# MinusNow application (local connections only)
local   minusnow_itsm   minusnow                                md5
host    minusnow_itsm   minusnow        127.0.0.1/32            md5
host    minusnow_itsm   minusnow        ::1/128                 md5

# Backup user (restrict to backup server IP)
host    minusnow_itsm   mnow_backup     10.0.1.100/32           md5

# Monitoring user (restrict to monitoring server IP)
host    minusnow_itsm   mnow_monitor    10.0.1.101/32           md5

# Deny everything else
host    all             all             0.0.0.0/0               reject

06 Application-Level RBAC

Module-level access control is enforced by the MinusNow application, not at the database layer. This is the primary security boundary for user permissions.

Application Roles

07 Full Module Permission Matrix

Complete RBAC mapping for all 21 platform modules, including Automation & Self-Healing, RCA & Forensics, Capacity Management, and Vulnerability & Patch Management.

08 Credential Rotation & Lifecycle

Rotation schedules and lifecycle management for the 4 service accounts.

Rotation Schedule

Rotation Script (Primary Application Account)

#!/bin/bash
# Automated password rotation for minusnow DB user
# Cron: 0 2 1 */3 * /opt/minusnow/scripts/rotate-db-password.sh

NEW_PASSWORD=$(openssl rand -hex 32)

# 1. Update PostgreSQL password
PGPASSWORD=$ADMIN_PW psql -U postgres -d minusnow_itsm -c \
  "ALTER USER minusnow WITH PASSWORD '${NEW_PASSWORD}';"

# 2. Update secrets manager
vault kv put secret/minusnow/db password="${NEW_PASSWORD}"

# 3. Log the rotation (no secrets in log)
echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) - Rotated DB password for minusnow" \
  >> /var/log/minusnow/rotation.log

# 4. Gracefully restart application to pick up new credentials
sudo systemctl restart MinusNow

Account Lifecycle

09 Compliance & Audit Trail

Framework mapping and audit log format for regulatory compliance.

Compliance Framework Mapping

Audit Log Format

{
  "timestamp": "2026-02-25T14:30:00Z",
  "user": "john.doe@company.com",
  "role": "operator",
  "action": "incidents:update",
  "resource_type": "incident",
  "resource_id": "INC-2026-001234",
  "details": {
    "field": "status",
    "old_value": "In Progress",
    "new_value": "Resolved"
  },
  "source_ip": "10.0.1.50",
  "user_agent": "Mozilla/5.0 ...",
  "session_id": "sess_abc123",
  "correlation_id": "req_xyz789",
  "db_user": "minusnow"
}

10 Application User Management

Provisioning, administering, and offboarding human application users.

Initial Admin Bootstrapping

On first deployment, MinusNow creates a default administrator account. At least one admin user is required at all times.

Minimum Admin Requirements

User Provisioning Methods

User Deactivation & Offboarding

When a user leaves the organization or no longer requires access:

11 Directory Integration & SSO

Synchronize users from Active Directory, LDAP, or SAML/OIDC identity providers.

Supported Providers

LDAP/AD Sync Configuration

Configure in-app via Directory Integration page:

Role Mapping

Map Active Directory groups to MinusNow application roles:

12 API Token Management

Create, scope, rotate, and revoke API tokens for programmatic access.

Token Types

Token Permission Scopes

Token Lifecycle

13 Password Policy & Session Management

Configure password complexity, multi-factor authentication, and session controls.

Password Policy

Multi-Factor Authentication

Configure MFA enforcement in Settings → Security → Multi-Factor Authentication. When enforced, all users must enroll on their next login.

Session Management

14 Quick Reference

Complete summary and cross-documentation links.

Account Summary

Environment Variables

# =====================================================
# MinusNow Service Account Configuration
# Production: Use Vault, AWS Secrets Manager, or Azure Key Vault
# =====================================================

# Primary application account
DATABASE_URL=postgresql://minusnow:<from-secrets-manager>@localhost:5432/minusnow_itsm
SESSION_SECRET=<from-secrets-manager>
APP_BASE_URL=https://minusnow.yourdomain.com

# Agent communication
AGENT_API_KEY=<from-secrets-manager>
AGENT_REGISTRATION_TOKEN=<from-secrets-manager>

# Backup account (used by backup script only)
BACKUP_DB_USER=mnow_backup
BACKUP_DB_PASS=<from-secrets-manager>

# Monitoring account (used by Prometheus postgres_exporter)
MONITOR_DB_USER=mnow_monitor
MONITOR_DB_PASS=<from-secrets-manager>

Cross-Documentation Reference