Permissions

SA provides three types of permissions needed to perform any action on servers:

  • Action permissions specify the actions or tasks that users can perform.
  • Resource permissions specify the servers on which users can perform these actions. All servers are grouped by facility, by customer, and by device groups. You set resource permissions by specifying access to facilities, customers, and device groups.
  • Folder permissions specify access permissions to items in the SA Library, such as OS build plans, software packages, software policies, patch policies, audit policies, and so forth.

Types of SA permissions needed to perform a task

For example, to install software using a software policy, a user would need (at least) the permissions as shown in the following figure:

Permissions Needed to Install Software

These permissions (and others) are set in the predefined user group Software Deployers. For more information, see Predefined user groups.

The following figure shows the predefined user group named Software Deployers and the SA users who are members of the group. The Views navigation panel also shows the Resource Permissions, Folder Permissions, Action Permissions, and OGFS Permissions of this user group.

User group browser showing users who are members

Restricted views in the SA Client based on permissions

The SA Client displays only those resources for which the user’s group has Read or Read & Write permissions.

For example, John Smith belongs to the Basic Users group, which has the permissions listed in the following table. When John logs in, the SA Client displays only the servers for Widget Inc., but not those of Acme Corp.

Table 7. Example of permissions and restricted views

Resource or Action

Basic Group Permission

Customer: Widget, Inc.

Read & Write

Customer: Acme Corp.

None

Wizard: Prepare OS

Yes

Wizard: Run Scripts

No

To locate or view a server, a user must belong to a user group that has Read (or Read & Write) permission to the customer and the facility and at least one device group associated with the server. Otherwise, the user cannot see the server in the SA Client.