Creating an Administrator security role

As an administrator, you can manage security policy and its implementation in the AR System Administration Console, Developer Studio, and the Mid Tier Configuration Tool by using BMC Helix Innovation Suite. With these clients, you can manage the server objects, system confirguration settings, and control access to BMC Helix Innovation Suite by human users, BMC applications, and external clients. 

Related topics

Creating-and-mapping-roles

All user access definition and management is performed through forms that are accessible to administrators. Policy management and implementation are controlled through the use of access control groups and security role definitions and privileges. Access control groups are the basis by which all user access is granted. Access control in AR System is added progressively, as required. Each user starts out with no access to AR System controlled objects, and administrators or subadministrators add permissions as needed. Administrators can set default permissions and specific permissions on objects in AR System, and subadministrators can set specific permissions to objects where assigned.

Roles, including security roles, are specified in the AR System by membership in groups. The AR System reserves eight group IDs for special group definitions with associated access privileges, including the groups administrator and subadministrator. Members of the administrator group have the Administrator security role. Members of the subadministrator group have the Subadministrator security role .

Configuration of application servers, including application server passwords, is controlled by administrators by using the forms such as AR System Administration: Server Information form. You can access these forms through a browser. Many settings managed in the AR System Administration: Server Information form are stored in the server configuration file (ar.cfg on Windows or ar.conf on UNIX). The administrator must protect this and other configuration files from tampering by setting the appropriate directory permissions and file settings. In addition to the file protections assumed to be provided by the operational environment, application service passwords stored in configuration files are obfuscated using a proprietary implementation of DES.

In your application development and production environments, you can provide different levels of access for other administrators. The Overlay Group option on the Group Information Form provides the following access options:

  • Overlay Group field set to 1
    When a group assigned to the user has the Overlay Group field set to 1, the user is restricted to working on overlay and custom mode objects. In Developer Studio, the user can work only in Best Practice Customization mode.
  • Overlay Group field set to 0
    When a group assigned to the user has the Overlay Group field set to 0, the user is restricted to working on base mode objects. In Developer Studio, the user can work only in Base Developer mode.

  • Overlay Group field set to 999999999

    When a group assigned to the user has the Overlay Group field set to 999999999, the user is restricted from creating, modifying, deleting, and importing objects. The user can only read and export objects from all layers.

  • Overlay Group set to (clear)
    When the Overlay Group is set to (clear) the Group provides no restrictions on access to base, overlay, or custom objects. For more information about Overlay Groups, see Creating-and-managing-access-control-groups. 

    Important

    When you assign a user to a group with Overlay Groups set to 1, you must also assign the user to the Struct Admin or Struct Subadmin group. For more information, see User-and-group-access and Operations-on-objects-restricted-by-development-mode.

To create a new group with the Overlay Group option set to 1

  1. From the AR System Administration Console, select Application > Users/Groups/Roles > Groups.
  2. Create the Group as desired, and select 1 from the Overlay Group list. 
    221_overlay group.png

To create Struct Admin Permissions

  1. From the AR System Administration Console, select Application > Users/Groups/Roles > Groups.
  2. Create a group named Struct Admin Permissions, to provide access to the objects.
  3. Set the Group Category field to Regular.
  4. Set the Group Type field to Change.
  5. Specify a Group ID that no other groups use and that is outside of the range of BMC reserved Group IDs.

To assign group assignments to a user

  1. From the AR System Administration Console, select Application > Users/Groups/Roles > Users.
  2. Assign the following groups:

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*