Setting up access control



As an administrator, set up users and user groups in BMC Helix Portal and set up authorization profiles in BMC Helix Operations Management to manage access control.

Important: Required permissions for the custom restricted-user role

  • For the out-of-the-box Operator role, all the required permissions are already granted. However, if you have created a custom restricted-user role, make sure that you assign the monitor.user_preferences.manage permission to the role. Without this permission, you cannot accessBMC Helix Operations Management.
  • For a custom restricted-user role, assign the monitor.eexternal_entity_types.view permission so that the user can view external entities while adding or editing alarm policies.

Related topic

Setting up role-based access control in BMC Helix Portal


Authorization profiles

Use BMC Helix Operations Management to manage authorization profiles so that the administrators and non-administrator users can successfully perform all the activities within the defined organizational boundaries while using the console. BMC Helix Operations Management uses BMC Helix SSO to authenticate users. With authorization profiles, you can implement role-based and data-level access control.

Authorization profiles are a grouping of the following types of information that is required to provide a user-level permissions and data-level permissions:

Authorization profiles associate users who belong to one or more user groups with specific objects. By default, a user who is a member of the Administrators user group can create, edit, and delete authorization profiles. 


Authorization profiles comprise user groups and objects, which you specify or select when creating or editing the profile.  You cannot create or modify the required components when creating or modifying an authorization profile. The following diagram and table describe the required components and show their relationship to an authorization profile. 

authorizationProfile_20_08.PNG 


You can create or configure the authorization profile components in any order, but you cannot create an authorization profile without them.

The following persona-based authorization profiles are available by default:

  • Administrator
  • Operator

Important

For custom user roles, you can assign view and manage permissions for event and blackout policies.

For instructions on creating authorization profiles, see Configuring-authorization-profiles.


Users and user groups

From BMC Helix Operations Management, you cannot view, modify, or delete users and user groups. You must log into BMC Helix Portal as a tenant administrator and perform the changes.

To access BMC Helix Portal, click the link in your welcome email from BMC. 

In BMC Helix Portal, you need to assign user groups to appropriate roles to delegate access permissions to users.

Important

To access BMC Helix Operations Management, the user must belong to at least one user group.
The user group must be associated with at least one authorization profile.