Roles and permissions

You can assign users to groups and roles in the AR server to control users' access to the application based on the tasks they need to perform. If you are creating custom groups and roles and not using the default groups created when installing AR, the overall process of providing access has the following basic steps:

The process does not include the first step if you are using groups and roles that were automatically created during installation. 

Groups are permissions specific to a server while roles are used exclusively in applications. You must map a role to a group based on the level of access you wish to provide to that group.

Users

A user is any person to whom you give permission to access BMC CMDB. Users can be members of multiple groups or no group at all. Users in BMC CMDB range from an administrator who maintains the entire system to employees who only view data.

Groups

Groups are collections of BMC AR System users who are given access to perform specific tasks. Groups are specific to a server. A group has access to an object, a field, or a request, and any user added to that group inherits the same access. You can map a role to a group. You can also designate an entire group to be notified of a certain action. Installation of BMC AR System automatically creates some default groups and you can also define additional custom groups.

BMC AR System includes a public group and eight other special groups that are essential for access control within the system. You can define additional groups based on a common profile and assign access. For example, you might create a Sales group and allow members to view the status of a request but not to change it. A group can also be a general category, such as Browsers. 

Roles

Roles are permissions like groups, except that they belong to a particular application, instead of a particular server. Roles are used exclusively in deployable applications. Installation of applications such as ITSM automatically creates roles that you can later map to specific groups. You can also define roles when you need them.

You can map roles to different groups on different servers, depending on how the groups are defined on each server. This enables you to develop and test the application on one server and deploy it to many other servers without having to redefine permissions on each server. You can also map roles to different groups for each development state, such as testing or production.