Managing groups
Every user of the BMC Discovery system must be a member of one or more groups. Membership of groups defines the various BMC Discovery modules that a user is entitled to access. For example, users defined as members of the System group can create and edit user details, while members of the Public group cannot access these areas.
To log in, a user must be in a group that has security/user/passwd, appserver/login, appserver/module/home and model/datastore/partition/Default/read permissions. Only the following default groups have this permission—readonly, public, system, and admin. Every user must be a member of one of these groups, or a member of a custom group that has at least these permissions. For example, a user who is in only the discovery group cannot login. You should put a user who requires access to discovery commands into the discovery and public groups.
The BMC Discovery Administrator is responsible for setting up details of all user groups in the BMC Discovery system.
Each group is a collection of permissions. Permissions control granular access to BMC Discovery modules and are described in Group Permissions.
The default security groups
The default user groups and their security access rights are as follows:
- admin—These users have the highest level of customer access to the system.
- api-access—These users can read and write to some of the model and control some of reasoning. This group is intended for users of the external APIs.
- appmodel—These users can write and edit patterns, and create nodes to model business applications. They cannot view credentials but can run discovery (in order to test patterns).
- cmdb-export-administrator—These users have access to all of the export-related data. They can build, modify, delete and run Exporters.
- discovery—These users have access to all of the discovery-related data. They can start and stop discovery, add and remove credentials, and enable or disable audit logging.
- event-source—These users are able to create events for any event source.
- never-deactivate—These users are never deactivated, even if they are inactive (not logged into the UI or used the API) for longer than the Account Deactivation threshold.
- public—These users have read/write access to all of the system although they cannot access the discovery credentials.
- readonly—These users have read only access to the system. They cannot view the credentials for logging into target hosts.
- system—These users have full access to the system.
unlocker—These users are able to unlock and unblock user accounts which have been locked or blocked after exceeding the number of permitted authentication failures.For more information, see Managing security policies.
Listing all current groups
- From the main menu, click the Administration icon.
The Administration page opens. - In the Security section, click User Groups.
The Groups page lists all the current groups and allows you to edit details, delete groups, or create a new group.
To create a new group
- From the Groups page, click Add at the bottom of the page.
The Add Group page is displayed. The page is arranged into functional areas, and then subdivided into columns. The arrangement of the columns from left to right is as follows:- Wildcard—Contains items which when checked, select a number of permissions. When you mouse over a wildcard permission, it and the permissions it applies are highlighted.
- Read—Read permissions relating to the functional area.
- Write—Write permissions relating to the functional area.
- Misc—Miscellaneous permissions relating to the functional area, such as appliance reboot.
- In Group name, enter a name for the new group.
- Select the check boxes that indicate the BMC Discovery modules that members of this user group are allowed to access.
The * wildcard matches anything, so selecting this check box will give unrestricted access to everything in the system. - to save the changes, click OK.
After the group is set up, you can add users. For more information, see Managing system users.
To amend group details
You can change a group name and the modules that group members can access. The access defined by the group membership will apply the next time users in this group log in.
- From the Groups page, click Edit next to the user.
The page is redisplayed showing editable fields. - Amend or overwrite the Name field.
- Select one or more check boxes corresponding with the BMC Discovery modules that members of this group can access.
- To save the changes, click OK.
To delete a group
You can delete any group provided you have created it initially. You cannot delete either the public or the system groups.
From the Groups page, click Delete next to the group to be deleted.
The group is deleted, and the system does not display any confirmation.
Group permissions
The following table lists the permissions assigned by default to each group in BMC Discovery. The individual permissions are described in System Group Permissions by Category.
Group | Read | Write | Other (Misc) |
|---|---|---|---|
|
|
|
|
|
| ||
|
|
|
|
|
|
| |
|
|
| |
|
| ||
|
| ||
|
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
|
|
|
|
|
|
| |
|
| ||
|
|
|
|
System group permissions by category
The system group security permissions are shown by category in the following tables.
There are no permissions that restrict access to patterns. All logged-in users can view patterns.
Appliance administration permissions
The following table lists the group permissions relating to the appliance administration.
Permission | Definition |
|---|---|
| Enables the user to create and modify categories from the Custom Categories page. To navigate to the Custom Categories page:
|
| Enables the user to create and modify channels from the Channels page. To navigate to the Channels page:
|
| Enables the user to read or write DNS information. You can view the DNS (Name Resolution) information from the Appliance Configuration page for name resolution. To navigate to the page:
|
| Enables the user to import CSV data from the Import CSV Data page. To navigate to the CSV Data page:
|
| Enables the user to view interface information from the Appliance Configuration page for network interfaces. To navigate to the Appliance Configuration page for network interfaces:
|
| This permission is not used. |
| Enables the user to delete log files. To navigate to the Logs page:
|
| Enables the user to view log information.As each BMC Discovery component and script runs, it outputs logging information. Logs are all stored in |
| Enables the user to read log files.Logs are all stored in |
| Enables the user to read or write the appliance log level from the Logs page. To navigate to the Logs page:
|
| Enables the user to view email configuration information from the Appliance Configuration page for mail settings. To navigate to the page:
|
| Obsolete permissions. |
API permissions
The following table lists the group permissions relating to API operations.
Permission | Definition |
|---|---|
| Enables the user to access the external APIs. For more information, see Setting up standard data categories. |
api/event_source | Enables the user to create events for any event source. For more information, see Polling vCenter servers. |
Appliance permissions
The following table lists the group permissions relating to appliance operations.
Permission | Definition |
|---|---|
| Enables the user to perform an appliance backup or restore.For more information, see Backing up and restoring the appliance. |
| Enables the user to view appliance information (identity, support information, read-only information about the appliance software and hardware configuration, and so on) from the Appliance Configuration page. To navigate to the Appliance Configuration page:
|
| Enables the user to put the appliance into maintenance mode from the Appliance Control page. To navigate to the Appliance Control page:
|
| Enables the user to reboot the appliance from the Appliance Control page. To navigate to the Appliance Control page:
|
| Enables the user to reset the report usage statistics. |
| Enables the user to restart the appliance from the Appliance Control page. To navigate to the Appliance Control page:
|
| Enables the user to shut down the appliance from the Appliance Control page. To navigate to the Appliance Control page:
|
appliance/support | Enables the user to access the Appliance Support page. To navigate to the Appliance Support page:
|
appliance/updatedevices | Enables the user to update device definition files. |
Appserver permissions
The following table lists the group permissions relating to the appserver.
Permission | Definition |
|---|---|
| Enables the user to debug the appserver. |
| Enables the user to log in to the appserver. |
| Enables the user to access any module. |
| Enables the user to access the given module. The name is one of the following: • Application |
| The user is allowed to see other user's sessions. |
Baseline permissions
The following table lists the group permissions relating to baselining.
Permission | Definition |
|---|---|
| Enables the user to change the baseline configuration (such as the recipients of automatic emails, and the messages to be included) from the Appliance Baseline page.To navigate to the Appliance Baseline page:
|
| Enables the user to view the baseline configuration from the Appliance Baseline page. |
| Enables the user to update the baseline configuration after changes have been seen from the Appliance Baseline page. |
Cluster permissions
The following table lists the group permissions relating to clustering.
Permission | Definition |
|---|---|
| An internal permission. Do not use this. |
| Enables the user to perform cluster management operations from the Cluster Management page. To navigate to the Cluster Management page:
|
| An internal permission. Do not use this. |
CMDB synchronization permissions
The following table lists the group permissions relating to CMDB synchronization.
Permission | Definition |
|---|---|
cmdb_sync | Enables the user to configure and manage CMDB synchronization. For more information, see see CMDB synchronization. |
Consolidation permissions
The following table lists the group permissions relating to consolidation.
Permission | Definition |
|---|---|
| Enables the user to change the configuration on the consolidation appliance. Enables the user to change the configuration on the consolidation appliance (set as consolidation appliance and approve scanning appliances). You can manage consolidation from the Discovery Consolidation page on the UI. To navigate to the page:
|
| Enables the user to add new consolidation targets to a scanning appliance from the Discovery Consolidation page on the UI. |
| Enables the user to view the consolidation setup page from the Discovery Consolidation page on the UI. |
Discovery permissions
The following table lists the group permissions relating to discovery.
Permission | Definition |
|---|---|
| Enables the user to test discovery credentials. For example, from the UI, you can test • Discovery credentials from the Credential Tests tab. For more information about Discovery and Mainframe Credentials, see Testing credentials. |
| Enables the user to view and modify sensitive data filters from the Sensitive Data Filters page of the UI. To navigate to the page:
|
| Enables the user to query a host on the network. For more information, see Query Builder. |
| Enables the user to view and modify the Windows proxies. You can manage Windows proxies from the Windows proxy management page of the UI. To navigate to the page:
|
discovery/management | An internal permission. Do not use this. |
| Enables the user to read the discovery options. These are separate from the main system settings. |
| Enables the user to view and amend the platform discovery commands from the Discovery Platforms page. To navigate to the page:
|
| Enables the user to configure the port settings that Discovery uses. To navigate to the page:
|
Model permissions
The following table lists the group permissions relating to the model.
Permission | Definition |
|---|---|
| Enables the user to administer the audit service. To navigate to the Audit Logs page:
|
| Enables the user to purge the audit log. To navigate to the Audit Purge page:
|
| Enables the user to read or write to the audit log.Audit logs are stored in the datastore. You can view the audit logs in the log viewer from the UI. Logs can be downloaded from the appliance through the Support Services administration page. |
| Enables the user to administer the datastore. |
| An internal permission. Do not use this. |
| Enables the user to read or write to the datastore through the UI. |
| Enables the user to read or write to any partition which supports user interaction. |
| Enables the user to read or write to the given partition. The name is one of:
For more information, see the Partitions and history page. |
| Enables the user to cancel or list (view) searches submitted by all users. To navigate to the Search Management page:
For more information about viewing and cancelling searches, see Using the Search service. |
| Enables the user to read node information. |
| Enables the user to write node information. |
| Enables the user to read relationship information. |
| Enables the user to write relationship information. |
| Enables the user to read role information. |
| Enables the user to write role information. |
Reasoning permissions
These permissions relate to reasoning.
Permission | Definition |
|---|---|
| An internal permission. Do not use this. |
| An internal permission. Do not use this. |
| Enables the user to add IP addresses to an open scan. |
| Enables the user to configure patterns. For more information, see Pattern Configuration. |
| Enables the user to execute patterns. For more information, see Manual pattern execution. |
| Enables the user to write patterns using pattern templates from the appliance. The pattern templates can be downloaded from the Pattern Management page:
|
reasoning/provider | An internal permission. Do not use this. |
| Enables the user to view the Discovery Status page. The status of the discovery process displays on the Home tab in the Discovery Status summary. This page also displays the current status of the reasoning process. For more information, see Viewing the discovery status page. |
| Enables the user to cancel scans. You can cancel scans from the Discovery Status page. To navigate to the Discovery Status page:
For more information, see Viewing the discovery status. |
|
|
|
|
|
|
|
|
Reports permissions
The following table lists the group permissions relating to Reports.
Permission | Definition |
|---|---|
| Enables the user to read reports. Enables the user to write reports. |
Security permissions
The following table lists the group permissions relating to security.
| Enables the user to view and configure group membership to a user. To navigate to the page:
|
| Enables the user to configure the HTTPS settings, which include:
You can manage the HTTPS configuration from the HTTPS Configuration page of the UI. To navigate to the page:
|
| Enables the user to view and configure the security options which include accounts and passwords, login page, and UI security page. To navigate to the page:Click Administration.
|
| Enables viewing the discovery session log file. |
| Enables the user to unlock and reactivate accounts for other users from the Users page of the UI. To navigate to the page:
For more information, see Accounts and passwords. |
| These users are never deactivated, even if they are inactive (not logged into the UI or used the API) for longer than the Account Deactivation threshold. |
| Enables the user to change their own BMC Discovery password from the UI.For more information, see changing your password. |
| Enables the user to view and configure the user security information related to system users, groups, security policies, HTTPS settings, LDAP, Web authentication settings, active sessions, appliance audit, and so on. • |
System permissions
The following table lists the group permissions relating to system settings and configuration.
Permission | Definition |
|---|---|
| Enables the user to read system configuration from the command line utilities and the UI. |
|
|
|
|
|
|
UI permissions
The following table lists the group permissions relating to specific user interface operations.
Permission | Definition |
|---|---|
| Enables the user to administer the dashboard.You can use the |
| Enables the user to administer the datastore. |
| Enables the user to administer the taxonomy. |
| Enables the user to access the Generic Search Query page and enter search queries. To navigate to the Generic Search Query page:
|
Vault permissions
The following table lists the group permissions relating to the credential vault.
Permission | Definition |
|---|---|
| Enables the user to open, close, and set the passphrase for the credential vault from the Vault Management page of the UI. To navigate to the page:
|
| Enables the user to manage the following types of credentials which are based on the system to access:
You can view and manage the credentials types from the Credentials page of the UI. To navigate to the page, from the main menu, select Manage > Credentials. For more information, see the Credentials page. |
| Enables the user to export the credential vault. When you export the vault, sensitive values, such as passwords, are encrypted in the export file using a key. The key is protected by a guard passphrase, which must be at least 8 characters in length. You can view and manage credentials from the Credentials page of the UI: From the main menu, click Manage > Credentials. For more information, see the Credentials page. |
| Enables the user to view and manage credentials (For example, Windows proxies, vSphere credentials, and so on). From the main menu, click Manage > Credentials. For more information, see the Credentials page. |
Note
The 'all' permission (*) allows the user to perform any tasks in BMC Discovery. Each user has a token which is assigned by the security system and whenever a privilege is requested by a user, the security service checks the database to see if that particular user has permission to carry out that particular task.
However, the first check that BMC Discovery carries out is to see if the user has the * permission. If the answer is yes, no further privilege checks will be carried out.
Comments
Log in or register to comment.