You can create new users and roles, which enable you to limit what a user is authorized to view or change. Users are granted permissions based on their associated role.
If Role_A is authorized to view and change Folder_A and Calendar_A, then all associated users that are assigned Role_A have the same type of access to those entities.
There are three predefined roles in Control-M, as follows:
-
Administrator: Enables full access to all functionality.
-
Team Leader: Enables partial access with the ability to manage permissions for each member of the team.
-
Viewer: Enables view access only.
To configure authentication for all Control-M users, BMC recommends that you perform these procedures, in the following order:
You can create internal users in Control-M. However, BMC recommends that you configure a connection to an Identity Provider (IdP). This enables you to authenticate multiple external users with one configuration, instead of creating individual internal users in Control-M. To connect Control-M to an IdP, see Configuring Authentication with an IdP. After an IdP is enabled, all users are authenticated via SAML 2.0.
If the IdP is down, users that are assigned to Administrator roles can still log in using an Emergency URL, which enables Emergency users access to Control-M. An Emergency user is any internal user that is associated with the Administrator role. BMC recommends that you bookmark or record the Emergency URL. If the IdP becomes unavailable, you will need this URL to log in to Control-M. To edit the list of existing Emergency users, you must disable the IdP configuration, as described in Updating Emergency Users. After it is disabled, users that are authenticated with the IdP cannot log in to Control-M. After you have updated the list of users and the IdP becomes available, re-enable IdP.
Before you delete a role, identify the Agent tags
A logical name that is used to label specific Agents in a group that has a specific authorization level. that are associated with the role. After you delete the role, you must delete any Agent tokensAn authorization entity, required during Agent installation, which enables you to connect the Agent to your Helix Control-M backend. that are associated with the Agent tags that you identified.
Adding a Role
This procedure describes how to create a role, which limits the associated users to specific authorizations and access levels.
Begin
-
From the
icon, select Configuration.The Configuration domain appears.
-
From the
drop-down list, select Roles.The Roles pane appears.
-
Click Add Role.
The Add Role pane appears.
- In the General tab, do the following:
In the Role Name field, type a logical name for the role.
In the Description field, type a description for the role.
If you want this role to have access to Automation API
A set of programmatic interfaces that provides developers and DevOps engineers access to the capabilities of Helix Control-M within the modern application release process., select the Automation API Access checkbox.Do one of the following:
To associate users in a specific organizational group in IdP , from the Associated with Organizational Groups drop-down list, select or search for the organizational groups in your IdP that you want to associate with this role.
If the list is empty, you must manually add the names of the IdP groups: type the name of the group and click Add. The IdP group names are case sensitive and must appear exactly as they are in the IdP .
To explicitly associate a specific IdP user, regardless of the organizational group, from the Associated with Organizational Users drop-down list, select or search for the organizational user in your IdP that you want to associate with this role.
If the list is empty, you must manually add the IdP user: type the name of the user and click Add. The IdP and LDAP user names are case sensitive and must appear exactly as they are in the IdP .
-
In the Access Control tab, select one or more of the checkboxes to give specific authorizations for this role, as described in Role Authorizations.
- Click Add.
Creating an Internal User
This procedure describes how to add an internal user in Control-M. User authorizations are determined by the roles that are associated with the user.
Begin
-
From the
icon, select Configuration.The Configuration domain appears.
-
From the
drop-down list, select Users.The Users pane appears.
-
Click Add User.
The Add User pane appears.
-
In the Email field, type the email address of the new user.
A confirmation email is sent to the new user, with a link to Helix Control-M and a temporary password for first-time use. The password expires in seven days. If the password expires, you must delete and recreate the existing user.
-
In the Assigned Roles drop-list, select one or more existing roles to assign to this user.
Roles determine what the user has access to throughout Control-M. To create a role, see Adding a Role.
-
Click Add.
The new user appears in the Users pane.
Updating Emergency Users
This procedure describes how to update Emergency users in the event that IdP becomes unavailable (breaking glass procedure). This enables you and other Emergency users to continue working in Control-M. You can update the list of Emergency users to enable or disable specific users access to Control-M.
Begin
-
From the
icon, select Configuration.The Configuration domain appears.
-
From the
drop-down list, select System Settings.The System Settings pane appears.
-
From the Identity Provider (IdP) drop-down, clear the Enable SAML 2.0 checkbox.
-
Click Save.
You are now working in Emergency mode and all users authenticated via IdP cannot log in to Control-M. Emergency users can log in with the following URL:
Emergency URL: <tenant_name>-emergency -
To add an Emergency user, assign the Admin role to the user, as described in Creating an Internal User.
- Send the Emergency URL to all Emergency users.
- After the IdP becomes available, check the Enable SAML 2.0 checkbox.
Role Authorizations
The following table describes authorizations that you can apply to a role. All associated users to this role inherit the selected authorizations.
|
Authorization |
Description |
|---|---|
|
Planning |
Determines whether to allow access to specific folders, Run as Users |
|
Folders |
Grants access to specific folders with an access level for each folder, as follows:
This authorization also determines whether associated users are granted access to the Folder Management tool. |
|
Enables associated users to use the listed run as users or pattern in job definitions
|
|
|
Monitoring |
Determines whether to allow access to specific jobs and services |
|
Determines which of the following actions associated users can perform on all jobs or on specific jobs with a filter:
To add a filter, which includes or excludes jobs, click Add a Filter from the Including Filters or Excluding Filters section, and then apply the required If statement. If you want to add another group of fields which, when met, can include more fields, even if the other group of fields do not meet the conditions, click Add Condition and then select Add And Condition or Add Or Condition. |
|
|
Service Permissions |
Grants associated users or groups of users access to view services, perform job actions, run, hold, and release services, as follows:
|
|
Archived Viewpoints |
Grants associated users access to Archived Viewpoints, as follows:
|
|
Tools |
Determines whether to allow access to Application Integrator |
|
Application Integrator |
Grants associated users access to Application Integrator, as follows:
|
|
Calendars |
Grants access to specific calendars with an access level for each calendar, as follows:
|
|
Events |
Grants access to specific events with an access level for each event, as follows:
|
|
History Reports |
Grants access to History Reports, as follows:
|
|
Lock Resources |
Grants access to specific Lock Resources with an access level for each Lock Resource, as follows:
|
|
(API Only) Pool Variables |
Grants access to Named Pool variables using API commands, as follows:
|
|
Reports |
Grants access to Reports, as follows:
|
|
Resource Pools |
Grants access to specific Resource Pools with an authorization level for each Resource Pool, as follows:
|
|
Secrets |
Grants access to specific Automation API Config secrets in the JSON with an access level for each secret, as follows:
After you update the role, you must regenerate an API token to use the updated authorizations, as described in Creating an API Token. |
|
Site Standards |
Grants access to specific Site Standards with an access level for each Site Standard, as follows:
|
|
SLA Management Reports |
Grants access to SLA Management Reports, as follows:
|
|
User Views |
Grants access to specific user views with an access level for each user view, as follows:
|
|
Configuration |
Enables Administrators to delegate control to users to carry out specific administrative tasks on Agents, plug-ins |
|
Agents, |
Grants access to specific Agents,
|
|
Plug-ins |
Grants access to specific plug-ins with an authorization level for each plug-in, as follows:
|
|
Connection Profiles |
Grants access to specific connection profiles with an access level for each connection profile, as follows:
|
|
Users and Roles |
Grants associated users access to users and roles, as follows:
To generate new API tokens |
|
Run as Definition |
Grants associated users access to manage Run as User definitions, as follows:
|
|
Admin Management |
Grants associated users access to the following categories, as follows:
If the access levels defined in Configuration and Security are higher than those defined in Agents, |
|
Advanced Admin Authorizations |
Grants associated users full permissions to access Agents, connection profiles, plug-ins, Host Groups, System Settings, and API Token Management. To enable access to API Token Management, you must verify that the Automation API Access checkbox is selected in the General tab. If the Automation API Access checkbox is selected and this option is disabled, associated users can only view their own API Tokens. If both options are enabled, associated users can view their own API tokens, and view and delete API tokens that were created by other users. They can also generate new tokens with different role authorizations. |
|
Alerts |
Determines whether to allow access to alerts
|
YouTube
Twitter
Facebook
LinkedIn