Set permissions

Overview

Application Deployment provides very finely grained control over two things:

• Who can create, view, edit, or deploy applications
• Who can use various library items in application components
• Where they can deploy them

Permissions are the mechanism used to establish this control. Permissions can help you promote an application through the software development life cycle in an orderly manner. The most convenient way to administer permissions is to create user groups that have a specific set of permissions.

Because Application Deployment offers very finely grained permissions, users can be granted permission to deploy a specific application to a specific environment—and nothing more. Their capabilities may appear escalated in comparison to their SA capabilities in general, but they are actually quite constrained.

Consider the following simple Patch life cycle:

For the purpose of developing and releasing a simple application or patch, for example, you might create the following user groups:

• Application owners
• QA environment owners
• QA engineers
• Production environment owners
• Production engineers

Each group would have specific capabilities based on the combination of permissions granted.

Application owners

Members of an Application Owners group would perform the following types of tasks:

• Create applications
• Attach Application Configurations to applications
• Attach Software Policies to applications
• Attach Packages to applications
• Deploy applications to the Development environment

To perform these tasks, Application Owners would need the following permissions:

Type of permission	Permission required
Action Permissions	System Administration: Managed Servers and Groups Application Deployment: Access Application Deployment Application Deployment: Create Applications Application Configuration: Manage Application Configurations (Read) Package Management: Manage Package (Read) Policy Management: Manage Software Policy (Read)
Resource Permissions	Read access to the device group that contains the Development environment servers
Folder Permissions	List and Read permission for Application Configurations, Packages, and Software Policies
Application Permissions	The application owner can grant View, Edit, and Deploy permissions for that application to other users and groups
Environment Permissions	Deploy permission for the Development environment

QA environment owners

Members of a QA Environment Owners group would perform the following types of tasks:

• Create targets
• Add servers to targets in the QA environment

To perform these tasks, QA Environment Owners would need the following permissions:

Type of permission	Permission required
Action Permissions	System Administration: Managed Servers and Groups Application Deployment: Access Application Deployment
Resource Permissions	Read access to the device group that contains the QA environment servers
Folder Permissions	None
Application Permissions	None
Environment Permissions	Edit permission for the QA environment

QA engineers

Members of a QA Engineers group would perform the following types of tasks:

• Deploy applications to the QA environment
• Troubleshoot deployment jobs

To perform these tasks, QA Engineers would need the following permissions:

Type of permission	Permission required
Action Permissions	System Administration: Managed Servers and Groups Application Deployment: Access Application Deployment
Resource Permissions	Read access to the device group that contains the QA environment servers
Folder Permissions	None
Application Permissions	Deploy permissions for the pertinent applications
Environment Permissions	Deploy permission for the QA environment

Production environment owners

Members of a Production Environment Owners group would perform the following types of tasks:

• Create targets
• Add servers to targets in the Production environment

To perform these tasks, Production Environment Owners would need the following permissions:

Type of permission	Permission required
Action Permissions	System Administration: Managed Servers and Groups Application Deployment: Access Application Deployment
Resource Permissions	Read access to the device group that contains the Production environment servers
Folder Permissions	None
Application Permissions	None
Environment Permissions	Edit permission for the Production environment

Production engineers

Members of a Production Engineers group would perform the following types of tasks:

• Deploy applications to the Production environment
• Troubleshoot deployment jobs

To perform these tasks, Production Engineers would need the following permissions:

Type of permission	Permission required
Action Permissions	System Administration: Managed Servers and Groups Application Deployment: Access Application Deployment
Resource Permissions	Read access to the device group that contains the Production environment servers
Folder Permissions	None
Application Permissions	Deploy permissions for the pertinent applications
Environment Permissions	Deploy permission for the Production environment