Each user must be logged on through an account, and each account is identified by the following configuration parameters:
The following account policies represent the system default configuration. Users with the Security role can change the default policies.
A user name uniquely identifies a single account, according to the account type:
The role associated with a user account defines the level of access that the user has to the features on this device. For example, Administrators can create accounts, but Observers cannot.
User roles and access permissions
Provides access to sensitive configurations, such as private key management, enabling and disabling the transaction capture, and configuring data confidentiality policies.
The Security role is given to a system administrator, who could perform the following tasks:
|Administrator||Provides access to all functions of the system that are not related to security. This role exists primarily for account management purposes.|
Provides access to all features that the Administrator role has except for account management. This role exists for device and data management purposes.
The Operator or Observer role is given to application support personnel or application developers, who could perform the following tasks:
In BMC Application Diagnostics, the Observer role is the same as the Operator role.
When integrated with BMC Real End User Experience Monitoring, the Observer role provides access to the web interface, but users with this role cannot make any configuration changes other than to save query settings. The permissions of this role are sufficient to perform day-to-day tasks.
|Export||Provides no access to the web interface and is limited to downloading data via data export APIs.|
|Consumer||Provides access to only the Web Performance Dashlet.|
The levels of access provided by the roles are cumulative; that is, starting from the most restricted role, access at each successive access level has the preceding level of access, as shown in the following matrix. Throughout this documentation, whenever a product feature or capability is attributed to a role, the feature or capability is also available in the higher access levels.
Roles and access matrix
Security Accounts Overall Web Data Security • • • • • Administrator • • • • Operator • • • Observer • • Export •
Only the Administrator role is defined for the BMC Real End User Experience Monitoring Aggregation Server for Extended Reporting component. There is only one account defined for the Aggregation Server, which has access to Security settings. Account access is not applicable to the Aggregation Server.
Passwords are initially set by an Administrator and can be updated by the account owner. For security protection, users with the Security role can configure the device to force users to change their passwords the first time they log on. Users with the Security role can also configure the device to expire passwords after a specified period of account inactivity. For more information about configuring stronger access policies, see Configuring access policies for the Console.
Password expiration does not affect the Security account or access to the CLI.
By default, the system applies simple password validation rules. The system checks such passwords only for length (minimum 6 characters).
If your organization requires stronger passwords, the Security role can enable the strict password rule. When the strict password rule is enabled, the system prompts users who try to log on with simple passwords to change their password.
A strict password must have:
A password can also contain a "space" character. All passwords are case sensitive.