Security permissions required for operations

The following list shows which capability and access types are needed for which basic operation. The capabilities and access rights listed are the minimum requirements to execute these operations, but, of course the administrator can have more extensive permissions than those. For example, when specified Write Access Deny, this means that no write access is necessary to execute this operation, but of course the administrator can be assigned write access to these objects anyway.

Groups are divided in two different types: those with and those without the capability populate. User and device groups have the additional capability populate. The capabilities for administrator groups are the same as for administrators, thus they do not have the capability populate. Administrator groups are treated not as groups but as folders, to learn about their basic operating principles see the explanations concerning folders in the following paragraphs.

Also, be aware, that to be able to assign or modify access rights for other administrators you also must be assigned the capability Manage Security.

To create or delete an object in a folder

When you want to create an object within a folder or delete one from a folder you need the following capabilities and access rights:

• View and manage capabilities of the object type,

• Write access on the object under which the new one is created.
  By default the administrator creating the new object has read/write/assign access on this new object.

Example

To create a new operational rule under a folder called Your Operational Rules or to delete it you need:

To create or delete an object in/from a group

To create an object within a group or to delete it from there you need the following capabilities and access rights:

• View and populate capabilities on the group.
• Write access on the object itself and its parent.

Example

To delete a device called Your Device from the group called AllYourDevices you need:

To modify an object

To modify the attributes of an object you need the following capabilities and access rights:

• View and manage capabilities of the object type,
• Read and write access on the object.

To export an object

To export an object from the console you need the following capabilities and access rights:

• View capability of the object type,
• Read access on the object to be exported.

To import an object

When you want to import an object you need the following capabilities and access rights:

• View and manage capabilities of the object type,

• Write access on the object under which the new one is imported (created).
  By default the administrator importing the object has read/write/assign access on this new object.

To manage access rights (security) of an object

To be able to modify the security profile of an object you need the following capabilities and access rights:

• View and manage Security Profile capabilities,
• View capability on administrators,
• View capability on the object type,
• Write access on the object for which the access rights are to be modified.

Example

To modify the access rights administrator France has on a specific device, the Master Server you need the following permissions:

To add or remove an object to/from a folder

To add an object to or remove an object from a folder you need the following capabilities and access rights:

• View and manage capabilities on the object type,
• Read and write access on the parent object to/from which the child object is to be added/removed and Read access on the child

Example

To add a query All Devices to an existing folder, General Queries you need:

To add or remove an object to/from a group

To add an object to or remove it from a group you need the following capabilities and access rights:

• View and populate capabilities on the group (parent object type), and view capability on the member (child object type),
• Read and write access on the group (parent object) to/from which the member (child object) is to be added, and read access on the child.

Example

To add a device Your Device to an existing device group, Your Device Group you need:

To move (cutting and pasting) an object

The cut and paste operation on an object is divided into two different actions: the cut action and the paste action, as cut objects, depending on their type, can be pasted under more than one parent object.

• View and manage or populate (for device and user groups) capabilities on the object type
• Read and write access on the old and new parent object, read access on the object to be cut and pasted.

Example

In this example we will cut the Your Operational Rule object from its current parent, the Your Operational Rules folder and paste it under a new folder called Test Rules :

To duplicate (copy and paste) an object

Similar to the cut and paste operation the copy and paste also is split in two operations. Only administrators, devices, users and device and user groups can be copied from one location to another (be duplicated), as they can be members of more than one group. You can also duplicate members of folders, but in this case the pasted member must be given a new name.

• View and manage or populate (for device and user groups) capabilities of the object type,
• Read and write access on both, the old and new, and read access on the object to be copied,

A duplicating operation on an object requires the exact same permissions regarding capabilities and access rights as the copy and paste operation.

Example

For the following example we want to copy a device, which belongs to a group called HQ Devices to another group called Servers :

To synchronize with a directory server

All groups, including the administrator groups can be synchronized with a directory server in Client Management. For this administrator needs the following capabilities and access rights:

• View, manage and populate capabilities on device/user groups (parent), or view and manage capabilities on administrators (parent),
• View capability on devices/users,
• View and manage capability on directory servers (child)
• Read and Write access on the device/user group (parent), or Read and Assign access on the administrator group (parent)
• Read access on the administrators/device/users and
• Read and Write access on the directory server (child), if it populates a device or user group or Read and Assign access, if it populates an administrator group.

Example 1

For the following example we synchronize our new device group called MyNewGroup with an existing directory server, for example called AllLabClients :

The Manage capability and Write access to the group are necessary, because the group name changes to the name of the directory server group as soon as it is synchronized with the server. The Manage capability for the devices is not required, because it is the system which will create the new objects that are added to the group. Therefore you will also not be able to see these new group members, if you do not have at least Read access to the children of the synchronized group.

Example 2

For the following example we synchronize an administrator group called MyNewAdmins with an existing directory server, for example called AllLabAdmins :

The Manage capability and Write access to the group are necessary, because the group name changes to the name of the directory server group as soon as it is synchronized with the server.

To manage assignments

The following table recapitulates the required capabilities and access rights to manage assignments between the different non-modifying database objects with the understanding that the view capability as well as read access is always required on both the parent and child object:

• The assignment of a compliance rule to a device group in this case is used by the compliance rule to check the group members for their compliance.

To populate database objects

The following table recapitulates the required capabilities and access rights to manage assignments between the different database objects concerning their population. Same as with the preceding table, the view capability as well as read access is always required on both the parent and child object:

• The assignment of a compliance rule to a device group here actually populates the device group with the result of its compliance check, that is, the group will contain all compliant devices, all non-compliant devices or those which could not be evaluated.

To schedule scans and rollouts

The following table recapitulates the required capabilities and access rights to schedule the execution of the different database objects. Same as with the preceding table, the view capability as well as read access is always required on the object:

To configure BMC Helix Client Management

The following table recapitulates the required capabilities and access rights to define the basic configuration of CM functionalities:

To assign or unassign an object to or from a group

To assign/unassign an object to a group that modifies its content (queries, directory servers and compliance rules) you need the following capabilities and access rights. Be aware that administrator groups are handled as usual like folders (see below), not like groups. It causes the contents of the group to change.

• View and populate capabilities for group (parent)
  • if the directory server is to be synchronized as well, not only to be assigned you also need the manage capability
• View capability on the object to be assigned (child),
• Read and write access on the parent and read access on the child.

Example

To assign a query All Servers to device group All Servers France you need the following permissions:

To assign or unassign an object to or from another object

To assign/unassign an object to/from another object, such as operational rules, packages, transfer windows, and so on, you need the following capabilities and access rights:

• View and assign capabilities on the target object (parent),
• View and assign capabilities on the object to be assigned (child),
• Read access on the parent and read and assign access on the child.

Example

To assign a transfer window High Speed Downstream to device Server France you need the following permissions:

To publish a package to master

You need following capabilities and access rights to publish a specific package:

To publish a package, an administrator should have:

• Read and Manage Package Capability
• Read Device Capability
• Write Access on the package

To publish on the master:

• Read Access on the master for on-premises environment. On SaaS, this access is not required.

To publish on a Relay:

• Read Access on the relay