This documentation supports the 18.08 version of BMC Digital Workplace Advanced.

To view the latest version, select the version from the Product Version menu.

User accounts, groups, and permissions for BMC Digital Workplace Catalog

BMC Digital Workplace Catalog server maintains an independent user database, separate from the databases used by other applications, such as BMC Digital Workplace and Remedy IT Service Management (ITSM). The users are stored in the tenant database and are not shared directly with other applications.

The BMC Digital Workplace Catalog database contains the accounts for users who can request service catalog items. The user database is also where a system administrator or service catalog administrator can specify the permissions for users who can log in to the catalog administration console to manage the service catalog.

The following image shows the User Roles page where catalog administrators can provide access and grant permissions to users available in the user database:

User accounts

To enable an end user to view and request service catalog items, you must create a user account in BMC Digital Workplace Catalog that has the same login and password as the end user account. 

You create user accounts manually or by running a script to copy the user database from Remedy ITSM. After you create the user account, you can entitle the user to view and request catalog items, or promote the user to an administrative role.

User groups

The user groups are automatically created when you run the script to copy the user database from Remedy ITSM. BMC Digital Workplace Catalog groups are unique, and do not share any relationship with permission groups that other applications use. The group names include the company, organization, and department attributes of the user records.

You can grant permissions to multiple users that belong to a custom user group to view and request service catalog items.

Permission levels and groups

When you create a user account, you can specify the capabilities of the account by assigning a permission group. The following table lists the permission levels that you can assign to users accounts.

Permission levelUser rolePermission groupLicense levelDescription
Service catalog administratorAdministratorsbe-catalog-adminsFixedEnables a user account to manage all aspects of the service catalog.
Asset managerAsset Managersbe-asset-managersFixedEnables a user to manage user entitlements by creating virtual marketplaces.
Internal service supplierInternal Suppliersbe-internal-suppliersFixedEnables a user to create, modify, and send services and bundles for approval.
Internal service supplier administratorInternal Supplier Administratorsbe-internal-supplier-adminsFixedEnables a user to create, modify, approve, and publish services and bundles.
Service agentAgentsbe-agentsFixed

Enables a user to access the BMC Digital Workplace Catalog console to view service requests.

Allow Remedy Mid Tier access to an administrator
Any administrative roleAdministratorFixedEnables a user to any administrative user account to enable the user to log in to Remedy Mid Tier.

BMC Digital Workplace client user

No specified rolesbe-myit-usersRead

Enables a user to request BMC Digital Workplace Catalog services from BMC Digital Workplace.

For more details about the BMC Digital Workplace Catalog permission groups, see Assigning BMC Digital Workplace Catalog roles to user accounts

Warning

Do not combine the following permission group assignments, or BMC Digital Workplace Catalog features do not work properly:

  • Any administrative or agent permission group (sbe-catalog-admins, sbe-internal-suppliers, sbe-internal-supplier-admins, sbe-asset-managers, sbe-agents) and the BMC Digital Workplace client user permission group.
  • The BMC Digital Workplace client user permission group and the Administrator permission group.

User account fields

When you create user accounts, you must provide the information in the following table. If you are creating user accounts by using Remedy Mid Tier, specify the Field name. If you are passing a JSON text file into a shell script, specify the Key name. 

Field nameKey nameExamplesDescription
Full NamefullName

Hannah

Hannah Administrator

Specify the full name of the user.

Login NameloginName

When viewed in Remedy Mid Tier, the login name is shown without the tenant domain.

Example: hannah_admin

When user accounts with the shell scripts method are created, the login name field shows the tenant domain as an environment variable.

Example: hannah_admin@${rx_tenant_domain}

Specify the name the user enters to log in to Remedy IT Service Management applications. The Login Name field is case sensitive.

For example, following are login names a user would enter when the user's login name is Bob, and the company is calbroservices.com:

  • To log in to most BMC applications, the user enters Bob.
  • To log in to BMC Digital Workplace Catalog, the user enters Bob@calbroservices.com.
  • To log in when BMC Remedy Single Sign-On is configured for all applications, the user enters Bob.
Email AddressemailAddresshannah_admin@calbroservices.comSpecify the email address used by the account. This address does not need to match the user's login name.
License TypelicenseType

Fixed

Read

Specify the license type for this user.

A Fixed license type is an extended license for administrators and service agents who can manage services in BMC Digital Workplace Catalog.

A Read license type goes for end users who can only request services from the catalog in BMC Digital Workplace. In Remedy Mid Tier, the Read license type is shown as Restricted Read.

Group Listgroups

Administrator sbe-catalog-admins

["Administrator", "sbe-catalog-admins"]

["sbe-myit-users"]

Specify the permission group memberships to assign to a BMC Digital Workplace Catalog user account.

When you assign permissions by using Remedy Mid Tier, add the permission group name as additional entries in the Group List field.

When you assign permissions by using a script, enclose the permission group names in an array.

PasswordpasswordPassw0rd!

Specify a password with a minimum of 8 characters and a maximum of 30 characters. The password must include all of the following characters:

  • Uppercase letters
  • Lowercase letters
  • Numeric characters
  • Special characters, such as these characters: ~!@#$%^&*_-

To enable a user to view and request services through self-service, the user's credentials must match the Remedy ITSM user account.

When adding users from Remedy ITSM by running the automated user transfer script, you must enable the cross-reference blank password setting in the Remedy Mid Tier configuration. Then, for these users to be able to log in, you must enable BMC Remedy Single Sign-On.

For more information, see the following topics:

At this time, only BMC Digital Workplace Catalog administrators who can access the User form on Remedy Mid Tier can change user passwords.

Status(Not used)Current

When you create users by using Remedy Mid Tier, set this field to one of the following values:

  • Current—Defines an active user.
  • Disabled—Defines an inactive user.
(Not used)forcePasswordChangeOnLoginfalseWhen you create users by using scripts, leave the value set to false.

Example permissions and fields for a system notification user

BMC Digital Workplace requires a service level user that runs background tasks such as pushing notifications to end users when BMC Digital Workplace Catalog requests are being processed. You must create the user account that will perform these actions, and provide the credentials for this user when you enable the enhanced catalog. These notifications are sent to the BMC Digital Workplace client applications. To send notifications by email, you must also complete the configuration described in Configuring email notifications.

The following table shows an example of the fields used to create the system notification user. You should specify unique login credentials when creating the system notification user in your environment.

Field nameKey nameExamples
Full NamefullNameSystem Notification Account
Login NameloginNamesys_notification@calbroservices.com
Email AddressemailAddresssys_notification@calbroservices.com
License TypelicenseTypeRead
Group Listgroups

sbe-myit-users

Warning: Do not add the Administrator group to any users of the sbe-myit-users group.

Passwordpassword5Y5_n0tification!
Status(Not used in scripts)Current
(Not on user form)forcePasswordChangeOnLoginfalse

Example permissions and fields for an enhanced catalog administrator

The administrator who maintains the sections in the enhanced catalog must also be a service catalog administrator in BMC Digital Workplace Catalog. When you follow the installation process steps to create a tenant, the process creates the first service catalog administrator user account for you.

The following table shows an example of the fields used to create the first service catalog administrator user account. You should disable this account and specify unique login credentials when creating additional users in your environment.

Field nameKey nameExamples
Full NamefullNameHannah Administrator
Login NameloginNamehannah_admin@calbroservices.com
Email AddressemailAddresshannah_admin@calbroservices.com
License TypelicenseTypeFixed
Group Listgroups

["sbe-catalog-admins", "Administrator"]

Warning: Do not combine administrative permissions with the sbe-myit-users group.

PasswordpasswordPassw0rd!
Status(Not used)Current
(Not used)forcePasswordChangeOnLoginfalse

Example permissions and fields for a service agent

A service agent who reviews user requests must be a service agent in BMC Digital Workplace Catalog.

The following table shows an example of the fields used to create a service agent.

Field nameKey nameExample
Full NamefullNameJim Serven
Login NameloginNamejim_serven@calbroservices.com
Email AddressemailAddressjim_serven@calbroservices.com
License TypelicenseTypeFixed
Group Listgroups

["sbe-agents", "Administrator"]

Warning: Do not combine administrative permissions with the sbe-myit-users group.

PasswordpasswordPassw0rd!
Status(Not used)Current
(Not used)forcePasswordChangeOnLoginfalse

Was this page helpful? Yes No Submitting... Thank you

Comments