Each user must be logged on through an account, and each account is identified by the configuration parameters described in this topic:
The account policies represent the system default configuration. Users with the Security role can change the default policies.
A user name uniquely identifies a single account, according to the account type:
The role associated with a user account defines the level of access that the user has to the features on this device. For example, Administrators can create accounts, but Observers cannot.
User roles and access permissions User role Description Provides access to sensitive configurations, such as private key management, enabling and disabling the transaction capture, and configuring data confidentiality policies. The Security role is given to a system administrator, who could perform the following tasks: Provides access to all features that the Administrator role has except for account management. This role exists for device and data management purposes. The Operator or Observer role is given to application support personnel or application developers, who could perform the following tasks: In BMC Application Diagnostics, the Observer role is the same as the Operator role. When integrated with BMC Real End User Experience Monitoring, the Observer role provides access to the web interface, but users with this role cannot make any configuration changes other than to save query settings. The permissions of this role are sufficient to perform day-to-day tasks.Security Administrator Provides access to all functions of the system that are not related to security. This role exists primarily for account management purposes. Operator Observer Export Provides no access to the web interface and is limited to downloading data via data export APIs.
Roles and access matrix
Permission →
| Security | Accounts | Overall | Web | Data |
---|---|---|---|---|---|
Security | • | • | • | • | • |
Administrator |
| • | • | • | • |
Operator |
|
| • | • | • |
Observer |
|
|
| • | • |
Export |
|
|
|
| • |
Passwords are initially set by an Administrator and can be updated by the account owner. For security protection, users with the Security role can configure the device to force users to change their passwords the first time they log on. Users with the Security role can also configure the device to expire passwords after a specified period of account inactivity. For more information about configuring stronger access policies, see Configuring access management policies and settings on the Analyzer or Collector.
Note
Password expiration does not affect the Security account or access to the CLI.
By default, the system applies simple password validation rules. The system checks such passwords only for length (minimum 6 characters).
If your organization requires stronger passwords, the Security role can enable the strict password rule. When the strict password rule is enabled, the system prompts users who try to log on with simple passwords to change their password.
A strict password must have:
A password can also contain a "space" character. All passwords are case sensitive.
Adding or deleting a local account on the Analyzer and Collector
Configuring access management policies and settings on the Analyzer or Collector
Using LDAP authentication and authorization for the Analyzer or Collector