Setting up BMC Helix SSO administrator accounts

As a SaaS administrator, you can create the following user accounts who will have access to the BMC Helix Single Sign-On Admin Console:

• SaaS administrators—Users who have full administrative rights in the SaaS tenant and all customer tenants on the BMC Helix SSO server. 
• Tenant administrators—Users who have access to the BMC Helix SSO Admin Console of specific tenants and have restricted administrative rights for those tenants.

For more details about permissions of these users, see Roles and permissions.

To create a SaaS administrator account

1. As a SaaS administrator, log in to the BMC Helix SSO Admin Console.

2. Click the Admin User tab.
   The list of administrator users is displayed.

3. Click Add Admin User.

4. On the Add Admin User page, enter the following details:

   • Login—Name of the BMC Helix SSO administrator that must correspond to the requirements.

• • Password—SaaS administrator's account password that must correspond to the requirements. 

  • Confirm Password 

      5. Click Save.

The SaaS administrator account is now added, and it is available in List of Admin Users.

To create a tenant administrator account

1. As a SaaS administrator, log in to the BMC Helix SSO Admin Console.

2. On the navigation panel, click Tenant.
3. From the list of tenants, select a tenant for which you would like to create a tenant administrator user account.
4. Click the pin icon to switch to the BMC Helix SSO Admin Console of the selected tenant.

5. On the navigation panel, click the Admin User tab.
   The list of administrator users is displayed.

6. Click Add Admin User.

7. On the Add Admin User page, enter the following details:

   • Login—Name of the BMC Helix SSO administrator that must correspond to the requirements.
   • Password—Tenant administrator's account password that must correspond to the requirements. 

   • Confirm Password 

8. Click Save.

The tenant administrator account is now added, and it is available in List of Admin Users.

Login name requirements for an administrator account

The example of the valid login name - user123

• The login name is case insensitive.
• The login name length must be between 1 and 255 characters.
• The login name cannot contain any of these characters !"#$%&()*+,/:;<=>?[\]^`{|}~
• The login name cannot contain the designated list of Unicode special characters.

• The login name cannot contain the designated list of Unicode space characters and zero-width spaces.

Password requirements for an administrator account 

The example of a valid password - Ab1%Cd2#

• The password length must be between 8 and 128 characters.
• You can use only ANSCII printable characters, and the password must contain characters from each of the following four categories:
  - uppercase letters
  - lowercase letters
  - numeric characters
  - special characters, except for a space character

User management tasks

Under the Action column on the Admin User tab, you can manage the administrator user accounts by performing the following tasks:

To configure BMC Helix SSO to lock an administrator account automatically

You can configure BMC Helix SSO to automatically lock an administrator account in a case of a brute force attack. By default, this feature is enabled.

1. Log in to the BMC Helix SSO Admin Console.

2. Click the General tab.

3. Select Basic > Session Settings.

4. In the Admin Lockout Threshold field, select a value to set the maximum number of unsuccessful login attempts allowed by BMC Helix SSO within one minute. 

   If the number of login attempts exceeds the number of attempts that you have set, the administrator account will be locked automatically.

   Important

   • The default value is 0. The lockout feature is disabled when this value is set to 0.
   • The lockout feature applies to internal administrators only.

5. Click Save.