Each user must be logged on through an account, and each account is identified by the following configuration parameters:
The following account policies represent the system default configuration. Users with the Security role can change the default policies.
A user name uniquely identifies a single account, according to the account type:
The role associated with a user account defines the level of access that the user has to the features on this device. For example, Administrators can create accounts, but Observers cannot.
A user with the Security or the Administrator role can assign one of the following roles to a user:
BMC Application Diagnostics user roles
User role | Description |
---|---|
Security | Provides access to sensitive configurations, such as private key management, enabling and disabling the transaction capture, and configuring data confidentiality policies. The Security role is given to a system administrator, who could perform the following tasks:
|
Administrator | Provides access to all functions of the system that are not related to security. This role exists primarily for account management purposes. |
Operator | Provides access to all features that the Administrator role has except for account management. This role exists for device and data management purposes. The Operator or Observer role is given to application support personnel or application developers, who could perform the following tasks:
|
Observer | In BMC Application Diagnostics, the Observer role is the same as the Operator role. When integrated with BMC Real End User Experience Monitoring, the Observer role provides access to the web interface, but users with this role cannot make any configuration changes other than to save query settings. The permissions of this role are sufficient to perform day-to-day tasks. |
The levels of access provided by the roles are cumulative; that is, starting from the most restricted role, access at each successive access level has the preceding level of access, as shown in the following matrix. Throughout this documentation, whenever a product feature or capability is attributed to a role, the feature or capability is also available in the higher access levels.
Roles and access matrix
Role | Permission | ||||
---|---|---|---|---|---|
Security | Accounts | Overall | Web | Data | |
Security | • | • | • | • | • |
Administrator |
| • | • | • | • |
Operator |
|
|
| • | • |
Observer |
|
|
| • | • |
Passwords are set by an Administrator initially and can be updated by the account owner. For security protection, users with the Security role can configure the device to force users to change their passwords the first time they log on. Users with the Security role can also configure the device to expire passwords after a specified period of account inactivity.
Note
Password expiration does not affect the Security account or access to the CLI.
By default, the system applies simple password validation rules. The system checks such passwords only for length (minimum 6 characters).
If your organization requires stronger passwords, the Security role can enable the strict password rule. When the strict password rule is enabled, the system prompts users who try to log on with simple passwords to change their password.
A strict password must have:
A password can also contain a "space" character. All passwords are case sensitive.
For information about tenant roles in a SaaS environment, see Managing tenant access.
For information about configuring LDAP-managed accounts, see LDAP authentication and authorization .
2 Comments
Cathi Biagi
Sara Kamen