User identities

You can control access to BMC Helix Portal integrated products and common services by managing user identities and user access. 

User identity types

Based on the type of access, users in BMC Helix Portal can be local or external.

The following image describes the types of user access:

The following table provides information about the different types of user access:

Local user access

You can create and manage users locally on  BMC Helix Portal. Helix Single Sign-On is used for authenticating users into BMC Helix Portal.

Users can be of two types:

• Users that require console access
• Users that require programmatic access

 For more information, see User-access-and-keys. 

External IdP user access

Helix Single Sign-On is used as an authentication mechanism for BMC Helix Portal. If you already manage user identities by using an external identity provider (IdP), you can import such users and groups into BMC Helix Portal. Helix Single Sign-On supports IdPs that are compatible with various authentication mechanisms. For more information, see Configuring authentication. 

External IdP users can authenticate into BMC Helix Portal by using their existing credentials. Thus, you can manage users and groups outside of BMC Helix Portal and give these users and groups permissions to use the BMC Helix Portal integrated products and common services. 

To enable IdP users to access BMC Helix Portal, you need to establish a trust relationship between Helix Single Sign-On and your IdP. For this, you need to request the BMC SaaS Operations team to configure your IdP. For more information, contact BMC Support. 

Based on the volume of users and groups to sync, you can use one of the following approaches for the import and sync:

• Large volume: (Recommended) Sync users and groups by running the LDAP sync agent. 
• Small volume: Import and sync users and groups at logon time. 

The imported or synced users and groups are created with the type External. After the import, these users need to be provided appropriate permissions by assigning them to the appropriate roles. However, we recommend that you assign the users to groups and then assign the groups to roles. Then, the users will inherit the permissions from the roles. 

Therefore, before importing, as a tenant administrator, do one of the following actions based on whether you possess the login credentials of an IdP admin user:

• Create an external user with the same login ID as the IdP admin user. Then, associate the external user(s) to a role with all permissions or at a minimum all permissions to the Identity Management Service application or service.
  After the import, the IdP admin user can log on to BMC Helix Portal and associate the imported users with the relevant roles containing appropriate permissions.

• Create a default role and assign appropriate permissions to the role. At a minimum, assign all permissions to the Identity Management Service application or service.

  What is the impact of creating a default role?

  The users (authenticated in Helix Single Sign-On)  that are dynamically logged in to the system are automatically assigned to the default role in BMC Helix Portal. These users inherit access permissions from the default role and are listed on the User access > Users and keys page. Later, you can assign the users to other roles containing more appropriate permissions and delete the default role.

Cross-product user access

BMC Helix Portal can share access with BMC Helix ITSM users so that the BMC Helix ITSM users can use their existing credentials to authenticate into BMC Helix Portal. To share access, the BMC SaaS Operations team needs to perform some configurations and sync the BMC Helix ITSM users into BMC Helix Portal.

All the licensed users (fixed, floating, and bundled users) and the relevant logical user groups are synced. For more information, contact BMC Support. 

After the configuration:

• The synced users are displayed on the User access > Users and keys page.
• The synced user groups associated with these users are displayed on the User access > User groups page. 
• The user groups are automatically mapped with the correct roles containing appropriate permissions in BMC Helix Portal.
• If a read-only user (with the license type, Read and Restricted Read) logs on to BMC Helix Portal:
  • The read-only user is dynamically synced and displayed on the User access > Users and keys page. 
  • The user profile information, logical groups, and permissions associated with the user are inherited and imported into BMC Helix Portal and the groups and permissions are mapped to the read-only user.