All users of the Tideway Foundation system must be a member of one or more groups. Membership of groups defines the various Foundation modules that a user is entitled to access. For example, users defined as members of the System group are able to create and edit user details, while members of the Public group cannot access these areas.

To login, a user must be in a group that has permissions security/user/passwd, appserver/login and appserver/module/home. Only four default groups have this permission: readonly, public, system and admin. Every user must be a member of one of these four groups, or a member of a custom group that has at least these permissions.

For example, a user who is only in the discovery group cannot login. You should put a user that requires access to discovery commands into the discovery and public groups.
The Foundation Administrator is responsible for setting up details of all the user groups in the Foundation system.

Each group is a collection of permissions. Permissions control granular access to Tideway Foundation modules and are described in Group Permissions.

Security Groups

The default user groups and their security access rights are as follows:

• admin - These users have the highest level of customer access to the system.
• appmodel - These users can write and edit patterns, and create nodes to model business applications. They cannot view credentials but can run discovery (in order to test patterns).
• appscan - These users have access to all of the discovery-related data. They can start and stop discovery, add and remove credentials, and enable or disable audit logging.
• cmdb-export-administrator - These users have access to all of the export-related data.  They can build, modify, delete and run Exporters.
• lifecyclemanagement-administrator - These users have access to the Lifecycle Management tools. They are also able to modify and create lifecycle views.
• lifecyclemanagement-user - These users have access to the Lifecycle Management tools.
• public - These users have read/write access to all of the system although they cannot access the discovery credentials.
• readonly - These users have read only access to the system, though cannot view the credentials for into target hosts.
• system - These users have full access to the system.
• unlocker - These users are able to unlock and unblock user accounts which have been locked or blocked after exceeding the number of permitted authentication failures. See Managing Security Policies for more information.

To List All Current Groups

1. From the Security section of the Administration tab, select Groups. The Groups page is displayed. This page lists all the current groups and allows you to edit details, delete groups or create a new group.
   
   

Creating a New Group

1. From the Groups page, click the Add... button at the bottom of the page. The Add Group page is displayed. The page is arranged into functional areas, and then subdivided into columns. The arrangement of the columns from left to right is as follows:
   • Wildcard – contain items which when checked, select a number of permissions. When you mouseover a wildcard permission, it and the permissions it applies are highlighted.
   • Read – read permissions relating to the functional area.
   • Write – write permissions relating to the functional area.
   • Misc – miscellaneous permissions relating to the functional area, such as appliance reboot.
     
     
2. Enter a Name for the new group.
3. Select the checkboxes that indicate the Foundation modules that members of this user group are allowed to access. The * wildcard matches anything, so selecting this checkbox will give unrestricted access to everything in the system.
4. Click OK to save the changes.
   Once the group is set up you can add users. See Managing System Users.

Amending a Group's Details

You can change a group name and the modules that group members can access. The access defined by the group membership will apply the next time users in this group log in.

1. From the Groups page, click the Edit button next to the user. The page is redisplayed showing editable fields.
2. Amend or overwrite the Name field.
3. Select one or more checkboxes corresponding with the Foundation modules that members of this group can access.
4. Click OK to save the changes.

Deleting a Group

You can delete any group providing you have created it initially. You cannot delete either the public or the system groups.

1. From the Groups page, click the Delete button next to the group to be deleted. There is no confirmation.

Group Permissions

The following table shows the permissions assigned by default to each group in Tideway Foundation. The individual permissions are described in System Group Permissions by Category.

System Group Permissions by Category

The system group security permissions are shown by category in the following tables.

Note: There are no permissions that restrict access to patterns. All logged in users can view patterns.

Security Permissions

The following table shows the current group permissions relating to the security operations.

Credential Vault Permissions

Tideway Foundation stores all passwords used to access customer devices in a credential vault which can be secured. Secure credential vaults are generated by Tideway Professional Services when the appliance is commissioned. The contents of the vault can be encrypted and secured using a passphrase.
The following table shows the current group permissions relating to the vault operations.

Discovery Permissions

The following table shows the current group permissions relating to the discovery operations.

Consolidation Permissions

The following table shows the current group permissions relating to configuring consolidation and scanning appliances.

Data Store Permissions

These permissions are a subsystem of the model. The following table shows the current group permissions relating to the data store operations.

Audit Permissions

These permissions are a subsystem of the model. The following table shows the current group permissions relating to the audit operations.

Reasoning Permissions

These permissions are a subsystem of the model. The following table shows the current group permissions relating to the reasoning operations.

Notification Permissions

All public users have access to these permissions, which are a subsystem of the model. The following table shows the current group permissions relating to the notification operations.

Search Permissions

These permissions relate to listing and cancelling searches using the Search Management Page. See Using the Search Service for more information on viewing and cancelling searches.

Lifecycle Management Permissions

These permissions relate to the Lifecycle Management tools. The following table shows the current group permissions relating to the Lifecycle Management operations.

Taxonomy Permissions

These permissions are a subsystem of the model. The following table shows the current group permissions relating to the taxonomy operations.

Application Server Permissions

The following table shows the current group permissions relating to the application server operations.

Specific UI Permissions

The following table shows the current group permissions relating to specific user interface operations.

Appliance Administration Permissions

The following table shows the current group permissions relating to the appliance administration operations.

The 'all' permission (*) allows the user to perform any tasks in Foundation. Each user has a token which is assigned by the security system and whenever a privilege is requested by a user, the security service checks the database to see if that particular user has permission to carry out that particular task.

However, the first check that Foundation carries out is to see if the user has the * permission. If the answer is yes, no further privilege checks will be carried out.