You can create new users and roles, which enable you to limit what a user is authorized to view or change. Users are granted permissions based on their associated role.
If Role_A is authorized to view and change Folder_A and Calendar_A, then all associated users that are assigned Role_A have the same type of access to those entities.
There are three predefined roles in Control-M, as follows:
-
Admin: Enables full access to all functionality.
-
TeamLeader: Enables partial access with the ability to manage permissions for each member of the team.
-
Viewer: Enables view access only.
To configure authentication for all Control-M users, BMC recommends that you perform these procedures, in the following order:
You can create internal users in Control-M. However, BMC recommends that you configure a connection to an Identity Provider (IdP) . This enables you to authenticate multiple external users with one configuration, instead of creating individual internal users in Control-M. To connect Control-M to an IdP, see Configuring System Settings. After an IdP is enabled, all users are authenticated via SAML 2.0.
If the IdP is down, users that are assigned to Administrator roles can still log in using an Emergency URL, which enables Emergency users access to Control-M. An Emergency user is any internal user that is associated with the Administrator role. BMC recommends that you bookmark or record the Emergency URL. If the IdP becomes unavailable, you will need this URL to log in to Control-M. To edit the list of existing Emergency users, you must disable the IdP configuration, as described in Updating Emergency Users. After it is disabled, users that are authenticated with the IdP cannot log in to Control-M. After you have updated the list of users and the IdP becomes available, re-enable IdP.
Before you delete a role, identify the Agent tags
A logical name that is used to label specific Agents in a group that has a specific authorization level. that are associated with the role. After you delete the role, you must delete any Agent tokens An authorization entity, required during Agent installation, which enables you to connect the Agent to your Helix Control-M backend. that are associated with the Agent tags that you identified.
Adding a Role
This procedure describes how to create a role, which limits the associated users to specific authorizations and access levels.
Begin
-
From the
icon, select Configuration.The Configuration domain opens.
-
From the
drop-down list, select Roles.The Roles tab appears.
-
Click Add Role.
The Add Role dialog box appears.
- In the Role Details tab in the Add Role dialog box, do the following:
In the Role Name field, type a logical name for the role.
(Optional) In the Description field, type a description for the role.
Select the Automation API Access checkbox to grant this role access to Automation API
A set of programmatic interfaces that provides developers and DevOps engineers access to the capabilities of Helix Control-M within the modern application release process..Do one of the following:
To associate users in a specific organizational group in IdP , from the Associated with Organizational Groups drop-down list, select or search for the organizational groups in your IdP that you want to associate with this role.
If the list is empty, you must manually add the names of the IdP groups: type the name of the group and click Add. The IdP group names are case sensitive and must appear exactly as they are in the IdP .
To explicitly associate a specific IdP user, regardless of the organizational group, from the Associated with Organizational Users drop-down list, select or search for the organizational user in your IdP that you want to associate with this role.
If the list is empty, you must manually add the IdP user: type the name of the user and click Add. The IdP and LDAP user names are case sensitive and must appear exactly as they are in the IdP .
-
In the Access Control area, click on each tab to define the specific authorizations for this role, as described in Role Authorizations.
- Click Save.
Creating an Internal User
This procedure describes how to add an internal user in Control-M. User authorizations are determined by the roles that are associated with the user.
Begin
-
From the
icon, select Configuration.The Configuration domain opens.
-
From the
drop-down list, select Users.The Users tab appears.
-
Click Add User.
The Add User dialog box appears.
-
In the Email field, type the email address of the new user.
A confirmation email is sent to the new user, with a link to Helix Control-M and a temporary password for first-time use. The password expires in seven days. If the password expires, you must delete and recreate the existing user.
-
In the Assigned Roles drop-list, select one or more existing roles to assign to this user.
Roles determine what the user has access to throughout Control-M. To create a role, see Adding a Role.
-
Click Add.
The new user appears in the Users tab.
Updating Emergency Users
This procedure describes how to update Emergency users in the event that IdP becomes unavailable (breaking glass procedure). This enables you and other Emergency users to continue working in Control-M. You can update the list of Emergency users to enable or disable specific users access to Control-M.
Begin
-
From the
icon, select Configuration.The Configuration domain opens.
-
From the
drop-down list, select System Settings.The System Settings pane appears.
-
From the Identity Provider (IdP) drop-down, clear the Enable SAML 2.0 checkbox.
-
Click Save.
You are now working in Emergency mode and all users authenticated via IdP cannot log in to Control-M. Emergency users can log in with the following URL:
Emergency URL: <tenant_name>-emergency -
To add an Emergency user, assign the Admin role to the user, as described in Creating an Internal User.
- Send the Emergency URL to all Emergency users.
- After the IdP becomes available, check the Enable SAML 2.0 checkbox.
Role Authorizations
All users that are associated with a role inherit defined role authorizations. The following topics describe role authorizations that you can apply in the Add Role dialog box:
Planning
The following table describes Planning domain authorizations that determine whether access is granted to specific folders and jobs, Run as Users An OS account name that is used to execute jobs on the host., connection profiles A profile that contains the connection parameters to a specific plug-in, including the hostname, port, username, and password., or Named Pool variables A type of variable that you create in one job and can reference in subsequent jobs with the same Pool parameter. A Named Pool is a logical grouping of variables..
|
Authorization |
Description |
|---|---|
|
Defines access levels for specific folders , as follows: Folder Permissions
Job Permissions: Determines whether to enable authorizations on jobs in a specific folder, based on the Application and Sub-application criteria and according to the defined access level. This authorization also determines whether associated users are granted access to the Folder Management tool. |
|
|
Defines access to specific Run as Users
|
Monitoring
The following table describes Monitoring domain authorizations that determine whether access is granted to specific jobs,
|
|
|
|---|---|
|
Determines the accessibility of the following actions and views:
You can apply one or more Including Filters and Excluding Filters to grant or remove role access to jobs based on the job attributes, operators, and values that you define, as follows: If <Job Attribute> <Operator> <Value> Including Filters with an Or Condition
This including filter grants the role access to jobs when they run on the Accounts-Agent or when their Run As name contains the string Billing. |
|
|
Historical (Archived) Viewpoints |
Determines one of the following Historical (Archived) Viewpoints access levels:
|
Tools
The following table describes Tools authorizations that determine whether access is granted to Application Integrator A Control-M component that enables you to create a third-party business application integration (plug-in), and create custom job types that perform specialized tasks in your environment., Calendars A reusable job schedule that you can apply to many jobs, which enables you to perform scheduling changes from a single location., Events An conditional entity that creates a sequential relationship between jobs by enabling the successor job to execute after the predecessor job has executed., Global Events, Resource Pools A type of quantifiable resource, which represents the total amount of resources from a physical or logical device that a job can access., Lock Resources A type of prerequisite that controls the flow of the workflow, which represents a physical or logical device that folders, sub-folders, or jobs can exclusively access or share., Workload Policies, Site Standards A set of rules that are relevant to your organization, are applied on the folder level, and determine how users must define folders and jobs., and User Views A customization of the Control-M interface, which enables users to view specific functionality only..
|
Authorization |
Description |
|---|---|
|
Application Integrator |
Determines one of the following access levels for Application Integrator:
|
|
Calendars |
Defines access levels for specific calendars, as follows:
|
|
Events |
Defines access levels for specific events, with an access level for each event, as follows:
|
|
Folders |
See Folders . |
|
Global Events |
Defines access levels for specific global events, with an access level for each global event, as follows:
|
|
History Reports |
Determines one of the following access levels to History Reports:
|
|
Lock Resources |
Defines access levels for specific Lock Resources, with an access level for each Lock Resource, as follows:
|
|
Pool Variables (API only) |
Defines access levels to Named Pool variables via Control-M Automation API commands, as follows:
|
|
Reports |
Determines one of the following access levels to Reports:
|
|
Resource Pools |
Defines access levels for specific Resource Pools, with an authorization level for each Resource Pool:
|
|
Secrets |
Defines access levels to specific Automation API Config secrets in the JSON, with an access level for each secret, as follows:
After you update the role, you must regenerate an API token to use the updated authorizations, as described in Creating an API Token. |
|
Site Standards |
Defines access levels to specific Site Standards, with an access level for each Site Standard, as follows:
|
|
SLA Management Reports |
Determines one of the following access levels to SLA Management Reports:
|
|
User Views |
Defines access levels to specific user views, with an access level for each user view, as follows:
|
|
Workload Policies |
Defines access levels to specific Workload Policies, with an access level for each Workload Policy, as follows:
|
Configuration
The following table describes Configuration domain authorizations, which enable Administrators to delegate control to users and enable them to perform specific administrative tasks on Agents, plug-ins A Control-M component that extends functionality to third-party applications like Hadoop or SAP and can be integrated with other jobs in a single workflow., connection profiles A profile that contains the connection parameters to a specific plug-in, including the hostname, port, username, and password., and Run as User An OS account name that is used to execute jobs on the host. definitions. Users can create, configure, and monitor their resources, which eliminates dependencies on the Control-M Administrators. Control-M Administrators can restrict user access and control over their defined resources and hide other resources in the environment.
|
Authorization |
Description |
|---|---|
|
Admin Management |
Defines access levels to the following Administrator management categories:
|
|
Defines access levels to specific Agents, Agentless Hosts, and Host Groups, as follows:
|
|
|
Plug-ins |
Defines access levels to specific plug-ins, with an authorization level for each plug-in, as follows:
|
|
Connection Profiles |
Defines access levels to specific local and centralized connection profiles in the Configuration domain, with an access level for each connection profile, as follows:
|
|
Run as Definitions |
Defines access levels to Run as User definition management, as follows:
|
Alerts
The following Alerts authorizations determine the type of access level granted to users associated with this role:
-
None: Disables associated user access to the Alerts tool.
-
Browse: Enables associated users to view alerts.
-
Update: Enables associated users to update alerts.
-
Full: Enables associated users to update alerts.
YouTube
Twitter
Facebook
LinkedIn