In Control-M you can create users and roles, which enable you to limit the entities that a user is authorized to view or change. Users are granted permissions based on their associated role.
If Role A has authorizations to Folder
A container of jobs and sub-folders that passes its definitions to the included jobs and sub-folders A and Calendar A, then all associated users that are assigned Role A have access to those entities.
There are three predefined roles that are included in Control-M.
-
Administrator: Enables full access to all functionality.
-
Team Leader: Enables partial access with the ability to manage permissions for each member of the team.
-
Viewer: Enables view access.
To configure authentication for all Control-M users, BMC recommends that you perform these procedures in the following order:
- Adding a Role
- Adding an Internal User
- Creating an Administrator User
- Configuring Authentication with an IdP
You can create internal users in Control-M. However, BMC recommends that you configure a connection to an Identity Provider (IdP). This enables you to authenticate multiple external users with one configuration instead of creating individual internal users in Control-M. To connect Control-M to an IdP, see Configuring Authentication with an IdP. After an IdP is enabled, all users are authenticated via SAML 2.0.
The following video describes Control-M Authorizations:
Adding a Role
This procedure describes how to create a role, which limits the associated user to specific authorizations and access levels.
Begin
-
From the Configuration domain, click
and then select Roles.The Roles tab appears.
-
Click Add Role.
The Add Role pane appears.
- In the General tab, do the following:
In the Role Name field, type a logical name for the role.
In the Description field, type a description for the role.
Do one of the following:
If you want to associate users in a specific organizational group in IdP
If the list is empty, you need to manually add the names of the IdP
If you want to explicitly associate a specific IdP
If the list is empty, you need to manually add the names of the IdP or LDAP user by typing the name of the user and then click Add. The IdP and LDAP user names are case sensitive and must appear exactly as they are in the IdP or LDAP.
From the Interface access drop-down list, select one or more of the following applications that you want to grant access to this role:
Automation API
Control-M client, Utilities, EM API
Control-M Configuration Manager
Control-M Web
-
In the Access control tab, toggle on one or more of the following that you want to apply specific authorizations to this role, as described in Role Authorizations.
- Click Add.
Adding an Internal User
This procedure describes how to add a user in Control-M. User authorizations are determined by the roles that are associated to the user.
Begin
-
From the Configuration domain, click
and then select Users.The Users tab appears.
-
In the User name field, type the user that you want to add to Control-M.
-
In the Full Name and Description fields, type the name of the user and a description (optional).
-
In the Assigned roles drop-list, select one or more of the existing roles to assign to this user.
The role determines which authorizations the user has access to for all Control-M entities. To create a role, see Adding a Role.
-
Do one of the following:
-
To authenticate the user via LDAP, toggle on Enable external authentication only and define the LDAP user and Domain field by typing the domain name that hosts the LDAP servers that authenticates the Control-M/EM users in the following format:
CN[OU]@DC
where CN=user, OU=org_unit, DC=domain
-
To authenticate the user via a password, do the following:
-
In the Password field, define a user password .
-
In the Password expiration field, select one of following options:
-
Never expires
-
Custom: Determines the number of days before the password expires.
-
-
If you want to prevent this user from logging into Control-M, toggle on Lock account.
-
-
-
Click Add.
The new user appears in the Users list.
Creating an Administrator User
This procedure describes how to create a Control-M/EM administrator user when the external authentication server is not available. If LDAP or Active Directory can not be connected and an emergency user is not defined, the new administrator can log in and have the authorizations and privileges of a default administrator user.
Begin
-
Log in to the Control-M/EM server account and run the following script:
create_admin_account
-
In the Control-M/EM DBO name field, type the Control-M/EM database name (maximum length is 30 characters).
-
In the Control-M/EM DBO passwordfield, type the Control-M/EM password.
If verification of the Control-M/EM DBO password fails, an error message appears and the script is aborted.
-
In the Control-M/EM administrator Name field, type the name of the new user.
-
In the Control-M/EM administrator Password field, type the new user password.
-
In the Control-M/EM administrator Password verification field, type the same password again.
The administrator user is created.
Role Authorizations
The following table describes authorizations that you can apply to a role. All associated users to this role inherit the selected authorizations.
| Authorization | Description |
|---|---|
| Planning | Determines whether to allow access to specific foldersAn OS account name that is used to execute the job on the host, |
| Folders |
Grants access to specific folders
This authorization also determines whether associated users are granted access to the Folder Management tool. |
| Run as |
Enables associated users to use the listed run as users or pattern in job definitions
|
|
Service Definitions |
Grants associated users access to the Service Definition manager, as follows:
|
|
Promote Action |
Grants associated users to set the following authorization levels for a promotion action:
|
| Monitoring | Determines whether to allow access to specific jobs and servicesA set of workflows that serves a business purpose, and can be monitored as a single unit |
| Job permissions |
Determines which of the following entities associated users can view on all jobs or on specific jobs with a filter:
Determines which of the following actions associated users can perform on all jobs or on specific jobs with a filter:
To add a filter, which includes or excludes jobs, click Add a filter and then apply the required If statement. If you want to add another group of fields which, when met, can include more fields, even if the other group of fields do not meet the conditions, click Add Condition and then select Add And Condition or Add Or Condition. |
| Service permissions |
Grants associated users or groups of users access to view services, perform job actions, run, hold, and release services, as follows:
|
|
Periodical Statistics |
Grants associated users access to Periodical Statistics, as follows:
|
|
Forecast/SLA Management |
Grants associated users access to Forecast/SLA Management reports, as follows:
|
|
Archived Viewpoints |
Grants associated users access to Archived Viewpoints, as follows:
|
|
Viewpoint Management |
Grants associated users access to Collections, Filters, Hierarchies, and Viewpoint with an access for each, as follows:
|
| Tools | Determines whether to allow access to Application IntegratorA Control-M component that enables you to create an integration with a third-party business application, and then create custom job types that perform specialized tasks on your application, CalendarsA reusable job schedule that you can apply to many jobs, which enables you to perform schedule changes from a single location, An entity that creates a sequence relationship between jobs by enabling the successor job to execute after the predecessor job has executed, A type of quantifiable resource, which represents the total amount of resources from a physical or logical device that a job can access, Lock ResourcesA type of resource that controls the flow of the workflow, which represents a physical or logical device that a folder, sub-folder, or job can access exclusively or share, A set of rules that are relevant to your organization and applied on the folder level, and that determines how users must define folders and jobs, and User ViewsA customization of the Control-M interface, which enables users to view specific functionality only. |
| Application Integrator |
Grants associated users access to Application Integrator, as follows:
|
| Calendars |
Grants access to specific calendars with an authorization level for each calendar, as follows:
|
|
CLI Utility |
Grants access to the CLIutility for folders, jobs, and calendar management, as follows:
|
| Events |
Grants access to specific events with an authorization level for each event, as follows:
|
|
Global Events |
Grants access to specific global events with an authorization level for each global event, as follows:
|
| Lock Resources |
Grants access to specific Lock Resources with an authorization level for each Lock Resource, as follows:
|
| Pool Variables (API only) |
Grants associated users access to named pool variables using API commands, as follows:
|
|
Reports |
Grants access to Reports, as follows:
|
| Resource Pools |
Grants access to specific Resource Pools with an authorization level for each Resource Pool, as follows:
|
|
Secrets |
Grants access to specific Automation API Config secrets in the JSON with an authorization level for each secret, as follows:
After you update the role, you must regenerate an API token to use the updated authorizations, as described in Creating an API Token. |
| Site Standards |
Grants access to specific Site Standards with an authorization level for each Site Standard, as follows:
|
| User Views |
Grants access to specific user views with an authorization level for each user view, as follows:
|
|
Workload Policies |
Grants access to specific Workload Policies with an authorization level for each Workload Policy, as follows:
|
| Configuration |
Enables the Administrator to delegate control to users to carry out specific administrative tasks on Agents, plug-ins |
| Agents |
Grants access to specific Agents as follows:
|
| Plug-ins |
Grants access to specific plug-ins with an authorization level for each plug-in, as follows:
|
| Connection Profiles |
Grants access to specific connection profiles with an authorization level for each connection profile, as follows:
|
| Run as Definition |
Grants associated users access to manage Run as User definitions, as follows:
|
|
Admin Management |
Grants associated users access to the following categories, as follows:
If the access levels defined in Configuration and Security are higher than those defined in Agents and Host Groups, Plug-ins, and, Connection Profiles, the definitions in Admin Management take precedence and vice versa. |
| Alerts |
Determines whether to allow access to alerts
|
|
Workflow Insights |
Determines whether to allow access to the Workflow Insights domain |
YouTube
Twitter
Facebook
LinkedIn