Security administrators

The person responsible for the security of SA creates and maintains users and user groups, sets permissions on user groups and assigns users to user groups. This person must be able to log in to the SA Client as a user who is a super administrator. For more information, see Super administrators and Super users.

The following steps provide an overview of security administration for SA:

1. Identify the people in your organization who will manage SA security.
2. For each user identified in the preceding step, create a super administrator.

   For instructions, see Creating a super administrator.

3. Note the facility to which the managed servers belong.

   A facility represents a data center or physical location. Depending on your organization, you may want to name the facility after the city, building, or room where the servers reside. The person who installs SA specifies the name of the facility for the core.

4. Associate managed servers with customers.

   In SA, a customer represents a set of servers associated with a business organization, such as a division or a company. Typically, a server is associated with a customer, because it runs applications for that customer.

   For more information on grouping servers by customer, see the SA 10.50 User Guide.

5. (Optional) Create device groups and assign servers to the groups. Device groups are another way to organize your managed servers.

   For more information on device groups, see the SA 10.50 User Guide.

6. Plan your user groups.

   Decide which SA tasks specific groups of users will perform and on which servers. Usually a user group represents a role or a job category. Examples of user groups are: UNIX System Admins, Windows Admins, DBAs, Policy Setters, Patch Admins, and so forth. See Predefined user groups.

7. If the predefined user groups do not meet your needs, create your own user groups.

   For instructions, see Creating a new user group.

8. Set the resource permissions on the user groups.

   These permissions specify read and write access to servers associated with facilities, customers, and device groups. Resource permissions control which servers the members of a user group can access. For more information, see Setting password, account, and session security policies.

9. Set the action permissions on the user groups.

   To determine which action permissions are required to perform a specific task, see the tables in Permissions reference. For example, if you have a user group named Software Managers, see Software management permissions required for user actions. For more information, see Setting Action permissions.

10. Set the OGFS permissions on the user groups.

    OGFS permissions are required for certain actions; for example, for actions that require access to a managed server’s file system. The OGFS permissions are included in the tables in Permissions reference.

    For instructions, see Setting OGFS permissions.

11. Create the folder hierarchy in the SA Library using the SA Client.

    For more information on the SA Library, see the SA 10.50 User Guide.

12. Set the folder permissions.

    In general, you need read permission on a folder to use its contents in an operation, write permission to create or modify folder contents, and execute permission to run scripts that reside in a folder. For more information, see Setting Folder permissions.

13. (Optional) Delegate the management of folder permissions to certain user groups.

    For instructions, see Setting Folder permissions.

14. Create new users in SA or import existing users from an external Lightweight Directory Access Protocol (LDAP) directory.

    For instructions, see Creating a new user and Authenticating with an external LDAP directory service.

15. Assign users to the appropriate groups.

    For instructions, see Adding a user to a user group.