.. Reminder for header structure:
  Parts (H1)          : #################### with overline
  Chapters (H2)       : ******************** with overline
  Sections (H3)       : ====================
  Subsections (H4)    : --------------------
  Subsubsections (H5) : ^^^^^^^^^^^^^^^^^^^^
  Paragraphs (H6)     : """""""""""""""""""""

.. meta::
 :description: WAPT documentation version 2.7 Quickstart - Self-Service
 :keywords: Quickstart, WAPT, Selfservice, Self, Service

.. role:: red
   :class: red-text

.. _quickstart_selfservice:

###############################
Quickstart - Self-Service Setup
###############################

.. hint::

  This page is a quickstart tutorial to get started with the WAPT Self-Service module. For complete and detailed documentation, refer to the :ref:`wapt-self-service` page.

********
Overview
********

Self-Service is an application that is automatically installed with WAPT. It lets you make a set of software available to your users, which you or your team have pre-selected and validated beforehand.

Self-Service brings two main benefits: on one hand, it gives users more flexibility and autonomy; on the other, it lets you keep better control over the software installed across your fleet, while also reducing the need to grant local administrator accounts to users just so they can install software.

.. note::

  Self-Service behaves differently depending on your WAPT edition:

  * In **Discovery**, any user in the ``waptselfservice`` Active Directory security group (as well as all Local Administrators) gets access to **all** packages in the repository — there is no filtering.
  * In **Enterprise**, you can filter which packages are shown to which users, based on Active Directory groups and dedicated *self-service rules* packages.

  This page focuses on the **Enterprise** workflow, which is the recommended way to filter what your users can install. If you are running Discovery, simply create a ``waptselfservice`` security group in your Active Directory and add your users to it — see :ref:`wapt-self-service` for details.

************
How it works
************

1. Check requirements with your team and import any missing packages onto your WAPT Server. See :ref:`here <quickstart_manage_package>` for a reminder on how to import a package. 

2. Configure a "Self-Service rules" package, in which you list the packages you want to make available to users. This package also defines which user group(s) are allowed to use them.

3. Install the resulting package on one or more Organizational Units, or directly on individual user hosts.

4. Users can now open Self-Service and install or uninstall the available software on their own.

*****
Setup
*****

Prerequisites
=============

You need to have users and user groups defined in an Active Directory.

.. hint::

  Self-Service can also be used without Active Directory, for example by relying on local user accounts instead. See the **Discovery** note above.

Creating the Self-Service rules package
=======================================

1. In the WAPT Console, go to :guilabel:`Packages inventory` tab :red:`(1)` → :guilabel:`Make package template from setup file` :red:`(2)` → :guilabel:`Self-service rules` :red:`(3)`.

.. figure:: wapt-resources/wapt-make_self_service_rules.png
  :scale: 75%
  :align: center
  :alt: Make package menu selection

  Make package menu selection

2. Name your Self-Service package, add a description, and choose a maturity level and target OS (if needed).

3. Click :guilabel:`Add` :red:`(1)`, right-click the new group entry :red:`(2)`, select :guilabel:`Search in domain` :red:`(3)`.

.. figure:: wapt-resources/wapt-search_in_domain.png
  :scale: 75%
  :align: center
  :alt: Search in domain for self-service rules

  Search in domain for self-service rules

4. fill in the required fields :red:`(1)`, click :guilabel:`Connect to domain` :red:`(2)`, then search for the desired group :red:`(3)`, and click on :kbd:`OK` :red:`(4)`.

.. figure:: wapt-resources/wapt-select_group_in_domain.png
  :scale: 75%
  :align: center
  :alt: Select domain group for self-service rules

  Select domain group for self-service rules

.. warning::

  The name of the Self-Service package **must be identical** to the name of the Active Directory user security group the rules apply to.

5. In the left panel, select the desired packages :red:`(1)` and click :guilabel:`Enable` (or drag and drop them into the central panel) :red:`(2)`. The Packages are displayed in the central panel :red:`(3)`.

.. figure:: wapt-resources/wapt-add_package_selfservice.png
  :scale: 75%
  :align: center
  :alt: Add package for the self-service package

  Add package for the self-service package

6. Repeat steps 3 to 5 to add as many packages as needed to this Self-Service package.

7. Save the Self-Service package.

.. note::

  If the same Active Directory group appears in several Self-Service packages, their rules are merged.

Deploying the package to your fleet
===================================

7. Go to the Inventory tab :red:`(1)`, select the desired Organizational Unit :red:`(2)`, right-click it, then choose :guilabel:`Create or Edit Organizational Unit package`. :red:`(3)`
8. From the left panel, select the desired packages :red:`(1)` and drag and drop them into the right panel to add them as dependencies :red:`(2)`. Then click on :guilabel:`Build Upload` `:red:`(3)`.

.. figure:: wapt-resources/wapt-add_dependency_self_service.png
  :scale: 75%
  :align: center
  :alt: Add package for the self-service package

  Add package for the self-service package

9. Trigger an update and apply upgrades, or wait for the next WaptExit run, so the Self-Service package gets installed on the hosts.

******************
Using Self-Service
******************

Once the package is installed on a host, users can open Self-Service:

* from the Windows Start menu, under the name :guilabel:`Self-Service software WAPT`;
* or directly from :file:`C:\\Program Files (x86)\\wapt\\waptself.exe`.

.. figure:: wapt-resources/wapt-open_selfservice.png
  :scale: 50%
  :align: center
  :alt: User1 open Self-service

  User1 open Self-service

Once logged in, the user only sees the packages allowed by the Self-Service group(s) they belong to, and can install or uninstall them without needing local administrator rights.

Example: Open the self-service of user1

.. figure:: wapt-resources/wapt-users1_self_service.png
  :scale: 75%
  :align: center
  :alt: User1's Self Service

  User1's Self Service

*************
Going further
*************

This page only covers getting started with Self-Service. The :ref:`complete documentation of self-service <wapt-self-service>` covers, among other things:

* Configuring the :ref:`authentication method used by the WAPT Agent for Self-Service <authentification_settings_selfservice>`.
* Restricting or opening up what :ref:`Local Administrators can see in Self-Service or using a dedicated waptselfservice admin group instead <admin_filter_selfservice>`.
* Organizing :ref:`packages into categories to drive the filters shown in the Self-Service interface <manage_package_categories>`.
