You can create new users and roles, which enable you to limit what a user is authorized to view or change. Users are granted permissions based on their associated role.
If Role_A is authorized to view and change Folder_A and Calendar_A, then all associated users that are assigned Role_A have the same type of access to those entities.
There are three predefined roles in Control-M, as follows:
-
Administrator: Enables full access to all functionality.
-
Team Leader: Enables partial access with the ability to manage permissions for each member of the team.
-
Viewer: Enables view access only.
To configure authentication for all Control-M users, BMC recommends that you perform these procedures, in the following order:
You can create internal users in Control-M. However, BMC recommends that you configure a connection to an Identity Provider (IdP). This enables you to authenticate multiple external users with one configuration, instead of creating individual internal users in Control-M. To connect Control-M to an IdP, see Defining System Settings. After an IdP is enabled, all users are authenticated via SAML 2.0.
The following video describes User and Role Authorizations:
Adding a Role
This procedure describes how to create a role, which limits the associated users to specific authorizations and access levels.
Begin
-
From the
icon, select Configuration.The Configuration domain appears.
-
From the
drop-down list, select Roles.The Roles pane appears.
-
Click Add Role.
The Add Role pane appears.
- In the General tab, do the following:
In the Role Name field, type a logical name for the role.
In the Description field, type a description for the role.
Do one of the following:
To associate users in a specific organizational group in IdP
If the list is empty, you must manually add the names of the IdP
To explicitly associate a specific IdP
If the list is empty, you must manually add the IdP
From the Interface Access drop-down list, select one or more of the following applications to grant this role access to:
Automation API.
Control-M client (Desktop), Utilities, and EM API.
Control-M Configuration Manager.
Control-M Web.
-
In the Access Control tab, select one or more of the checkboxes to give specific authorizations for this role, as described in Role Authorizations.
- Click Add.
Creating an Internal User
This procedure describes how to add an internal user in Control-M. User authorizations are determined by the roles that are associated with the user.
Begin
-
From the
icon, select Configuration. -
The Configuration domain appears.
-
From the
drop-down list, select Users.The Users pane appears.
-
Click Add User.
The Add User pane appears.
-
In the User Name field, type the username that you want to add to Control-M.
-
(Optional) In the Full Name and Description fields, type the full name of the user and a description.
-
In the Assigned Roles drop-list, select one or more existing roles to assign to this user.
Roles determine what the user has access to throughout Control-M. To create a role, see Adding a Role.
-
Do one of the following:
-
To authenticate the user via LDAP, select the Enable External Authentication Only checkbox and define the LDAP User and Domain field by typing the domain name that hosts the LDAP servers that authenticates the Control-M/EM users in the following format:
CN[OU]@DCwhere CN=user, OU=org_unit, and DC=domain.
-
To authenticate the user via a password, do the following:
-
In the Password field, define a user password .
-
In the Password Expiration field, select one of following options:
-
Never Expires
-
Custom: Determines the number of days before the password expires.
-
-
To prevent this user from logging into Control-M, select the Lock Account checkbox.
-
To force the user to change the password, do the following:
-
To enable this option, you must first set the PasswordExpirationOnOff system parameter to 1 and the WarningPasswordExpirationDays system parameter to 10 in the CCM, as described in Control-M/EM General System Parameters. Afterward, you must recycle the GUI Server.
-
At the next login, select User Must Change Password at Next Login.
-
-
-
-
Click Add.
The new user appears in the Users pane.
Creating an Administrator User
This procedure describes how to create a Control-M/EM Administrator user when the external authentication server is not available. If LDAP or Active Directory can not be connected and an emergency user is not defined, the new Administrator can log in with the authorizations and privileges of a default Administrator user.
Begin
-
Log in to the Control-M/EM server account and run the following script:
create_admin_account -
In the Control-M/EM DBO Name field, type the Control-M/EM database name (1–30 characters).
-
In the Control-M/EM DBO Passwordfield, type the Control-M/EM password.
If verification of the Control-M/EM DBO password fails, an error message appears and the script is aborted.
-
At the new admin username prompt, type the name of the new user.
-
At the new admin password prompt, type the new user password.
-
At the new admin password verification prompt, retype the new user password.
The new Administrator user is created.
Role Authorizations
The following table describes authorizations that you can apply to a role. All associated users to this role inherit the selected authorizations.
|
Authorization |
Description |
|---|---|
|
Planning |
Determines whether to allow access to specific folders |
|
Folders |
Grants access to specific folders
This authorization also determines whether associated users are granted access to the Folder Management tool. |
|
Enables associated users to use the listed run as users or pattern in job definitions
|
|
|
Service Definitions |
Grants associated users access to the Service Definitions Manager, as follows:
|
|
Promote Action |
Grants associated users to set the following authorization levels for a promotion action:
|
|
Monitoring |
Determines whether to allow access to specific jobs and services |
|
Determines which of the following actions and views are available to associated users, as follows:
You can apply one or more Including Filters and Excluding Filters to grant or remove role access to jobs based on the job attributes, operators, and values that you define, as follows: If <Job Attribute> <Operator> <Value> Including Filters with an Or Condition
This including filter grants the role access to jobs when they run on the Accounts-Agentor when their Run As name contains the string Billing. |
|
|
Service Permissions |
Grants associated users or groups of users access to view services, perform job actions, run, hold, and release services, as follows:
|
|
Periodical Statistics |
Grants associated users access to Periodical Statistics, as follows:
|
|
Forecast/SLA Management (BIM) |
Grants associated users access to Forecast/SLA Management reports, as follows:
|
|
Archived Viewpoints |
Grants associated users access to Archived Viewpoints, as follows:
|
|
Viewpoint Management |
Grants associated users access to Collections, Filters, Hierarchies, and Viewpoint with an access level for each, as follows:
|
|
Tools |
Determines whether to allow access to Application Integrator |
|
Application Integrator |
Grants associated users access to Application Integrator, as follows:
|
|
Calendars |
Grants access to specific calendars with an access level for each calendar, as follows:
|
|
CLI Utility (Folder, Job, and Calendar Management) |
Grants access to the CLI utility for folder, job, and calendar management, as follows:
|
|
Events |
Grants access to specific events with an access level for each event, as follows:
|
|
Global Events |
Grants access to specific global events with an access level for each global event, as follows:
|
|
History Reports |
Grants access to History Reports, as follows:
|
|
Lock Resources |
Grants access to specific Lock Resources with an access level for each Lock Resource, as follows:
|
|
(API only) Pool Variables |
Grants access to Named Pool variables using API commands, as follows:
|
|
Reports |
Grants access to Reports, as follows:
|
|
Resource Pools |
Grants access to specific Resource Pools with an authorization level for each Resource Pool, as follows:
|
|
Secrets |
Grants access to specific Automation API Config secrets in the JSON with an access level for each secret, as follows:
After you update the role, you must regenerate an API token to use the updated authorizations, as described in Creating an API Token. |
|
Site Standards |
Grants access to specific Site Standards with an access level for each Site Standard, as follows:
|
|
SLA Management Reports |
Grants access to SLA Management Reports, as follows:
|
|
User Views |
Grants access to specific user views with an access level for each user view, as follows:
|
|
Workload Policies |
Grants access to specific Workload Policies with an access level for each Workload Policy, as follows:
|
|
Configuration |
Enables Administrators to delegate control to users to carry out specific administrative tasks on Agents, plug-ins |
|
Agents, |
Grants access to specific Agents,
|
|
Plug-ins |
Grants access to specific plug-ins with an authorization level for each plug-in, as follows:
|
|
Connection Profiles |
Grants access to specific connection profiles with an access level for each connection profile, as follows:
|
|
Run as Definition |
Enables associated users to manage Run-as-User definitions, as follows:
|
|
Admin Management |
Grants associated users access to the following categories, as follows:
If the access levels defined in Configuration and Security are higher than those defined in Agents, |
|
Alerts |
Determines whether to enables users to access alerts
|
|
Workflow Insights |
Determines whether to enables users to access to the Workflow Insights domain. |
YouTube
Twitter
Facebook
LinkedIn