Managing User Rights for ECC Dashboards

If you want to use customized home dashboards or the Dashboards perspective, then you have to define the required Automation Engine (AE) privileges and authorizations.

The information in this topic does not apply to you if all of the following are true:

Your organization uses only the Automic default home dashboards

Users are not allowed to save customized versions of the home dashboards, which is not the Automic recommended setup

The Dashboards perspective is not in use.

Otherwise, use the information here to help you plan and configure the authorities.

This topic contains the following:

Overview of required authorities

For ECC users to be able to open dashboards or work with them, they need the following:

Privileges to the perspectives for the widget types that they should see or be able to add.

Authorizations to the related DASH objects

Authorizations to the related folders

User groups for dashboard authorities

The best way to manage dashboard authorities is to define user groups with the required authorities and assign users to the groups. You can do this yourself from scratch or you can download and import pre-defined use groups that are available in your ECC installation package. These groups have the basic authorities for dashboards and you can add the other authorities for your users.

When you download and import the user group file, the following user group objects are added to your client:

USRG.ECCto be used for users of customized home dashboard and which contains the following:
- Read, write and delete authorizations for dashboard objects (DASH)
- Read, write authorizations for folder objects
USRG.ECC.DASHBOARDS to be used in addition to the USRG.ECC for users of the Dashboards perspective and which contains the following:
- The "ECC: Access to Dashboards" privilege

You do not have to use these user groups, but you must ensure that users have the same authorizations and privileges. Without them, the user will be able only to view, but not to modify, the Automic default home dashboards.

For instructions about where to find the import file, see the steps that follow.

Steps: Importing AE user groups for dashboard authorities (optional)

In the enterprise.control.center.zip file that you dowloaded from the Automic Download Center, open the samples folder.

Use the Automation Engine DB LOAD utility to import the ECC_USERG_UC_DATA.TXT into your AE clients.

Modify the user groups with the details for your users in your AE clients. Use the table that follows to help you understand the impact of your authority structures.

Table of all authority considerations for dashboards

The following table describes all the authority aspects that affect the access to dashboards, widgets, and data in widget windows, and the rights to modify a dashboard in the ECC. The table also covers what you might want to consider prohibiting access to.

Items marked in column "H" apply to home dashboards; items marked in column "D" apply to the Dashboards perspective.

Authority	Purpose/Description	H	D
AEprivileges to use the following:
Various ECC perspectives (for example, "ECC: Access to Service Catalog")	ECC users can open the ECC Home dashboard as well as the home dashboards of the perspectives they have privileges to. Be aware that, if a dashboard contains a widget for a perspective that the user does not have privileges to, the user will see an empty widget window with the message "No data available." Also, when modifying dashboards, users can add widgets only from the categories for perspectives that they have privileges to.	H	D
The Dashboards perspective (ECC: Access to Dashboards)	User who want to work with dashboards other than the home dashboards, need to use the Dashboards perspective. An administrator, who wants to create local default home dashboards for ECC users, also needs to use the Dashboards perspective for that. Then the new dashboard needs to be specified in the configuration.properties file.		D
AEauthorizations to allow the following:
To open a locally-defined default home dashboard.	Read (R) authorization to the related DASH objects and/or their folders.	H
To save their own customized versions to home dashboards.	Write (W) authorization to the related DASH objects and/or their folders.	H
To open a dashboard from the Dashboards perspective.	Read (R) authorization to the related DASH objects and/or their folders. The users must also have the privileges to access the perspectives.		D
To modify or add dashboards onthe Dashboards perspective.	Write (W) authorization to the related DASH objects and/or their folders. The users must also have the privileges to access the perspectives.		D
To view data in the widgets, and modify the widget data in any way the widget functions allow.	At least read (R) authorization to objects and folders that are related to perspective data that can appear in dashboards, such as tasks or process queues. Just like anywhere else in ECC, users can only work with objects that they have authorizations to.	H	D
To prohibit users from modifying the local default home dashboards.	Allow only read (R) authorization to these DASH objects and/or their folders. It's a good idea to prohibit users of the Dashboards perspective from changing your local default home dashboards, which might be listed among the Public Dashboards in the Dashboards perspective. When a user opens and modifies a home dashboard from the Home button in the ECC or from the home dashboard button for a perspective, then the ECC saves it under a different name for the session. If the user does not have authorization to save the DASH object, then the object cannot be saved for the next login. See configuration.properties for details.	H
To prohibit users from modifying certain public dashboards in the Dashboards perspective.	Allow only read (R) authorization to these DASH objects and/or their folders. If you want to protect some of the public dashboards from being changed by any user of the Dashboards perspective, consider using naming conventions for such dashboards. Then in the user definitions grant or prohibit authority to the related objects and folders.		D
DASH objects authorizations	Users of the Dashboards perspective also need rights to DASH objects: To open a dashboard from the Dashboards perspective. ("Read" authorization to the related DASH objects.) To modify or add dashboards on the Dashboards perspective. ("Write" authorization to the related DASH objects.)		D
Folders to which dashboards are assigned	Use folder authorizations in combination with authorization to DASH objects to control: Which dashboards a user can open (Read authorization) Which existing dashboards a user can modify (Write authorization) Where a user can add a new dashboard (Write authorization)	H	D
Rights to objects and folders that are related to perspective data that can appear in dashboards, such as SLAs or certain process queues.	Users can only work with objects that they have authorizations to. Just keep in mind that in dashboards, just like in the rest of AE, users can see and work with only the objects that they have authorization for.	H	D
AEauthorizations to prohibit actions, such as:
Prohibit changing the local default home dashboards	It's a good idea to prohibit users of the Dashboards perspective from changing your local default home dashboards, which might be listed among the Public Dashboards in the Dashboards perspective. (No "Write" authorization to the related DASH objects.) When a user opens and modifies a home dashboard from the Home button in the ECC or from the home dashboard button for a perspective, then the ECC saves it under a different name. See configuration.properties for details.	H
Prohibiting modifying certain public dashboards in the Dashboards perspective.	If you want to protect some of the public dashboards from being changed by any user of the Dashboards perspective, consider using naming conventions for such dashboards. Then in the user definitions grant or prohibit authority to the related objects and folders.		D

Authority

Purpose/Description

AEprivileges to use the following:

Various ECC perspectives (for example, "ECC: Access to Service Catalog")

ECC users can open the ECC Home dashboard as well as the home dashboards of the perspectives they have privileges to.

Be aware that, if a dashboard contains a widget for a perspective that the user does not have privileges to, the user will see an empty widget window with the message "No data available." Also, when modifying dashboards, users can add widgets only from the categories for perspectives that they have privileges to.

The Dashboards perspective (ECC: Access to Dashboards)

User who want to work with dashboards other than the home dashboards, need to use the Dashboards perspective.

An administrator, who wants to create local default home dashboards for ECC users, also needs to use the Dashboards perspective for that.

Then the new dashboard needs to be specified in the configuration.properties file.

AEauthorizations to allow the following:

To open a locally-defined default home dashboard.

Read (R) authorization to the related DASH objects and/or their folders.

To save their own customized versions to home dashboards.

Write (W) authorization to the related DASH objects and/or their folders.

To open a dashboard from the Dashboards perspective.

Read (R) authorization to the related DASH objects and/or their folders.

The users must also have the privileges to access the perspectives.

To modify or add dashboards onthe Dashboards perspective.

Write (W) authorization to the related DASH objects and/or their folders.

The users must also have the privileges to access the perspectives.

To view data in the widgets, and modify the widget data in any way the widget functions allow.

At least read (R) authorization to objects and folders that are related to perspective data that can appear in dashboards, such as tasks or process queues.

Just like anywhere else in ECC, users can only work with objects that they have authorizations to.

To prohibit users from modifying the local default home dashboards.

Allow only read (R) authorization to these DASH objects and/or their folders.

It's a good idea to prohibit users of the Dashboards perspective from changing your local default home dashboards, which might be listed among the Public Dashboards in the Dashboards perspective.

When a user opens and modifies a home dashboard from the Home button in the ECC or from the home dashboard button for a perspective, then the ECC saves it under a different name for the session. If the user does not have authorization to save the DASH object, then the object cannot be saved for the next login. See configuration.properties for details.

To prohibit users from modifying certain public dashboards in the Dashboards perspective.

Allow only read (R) authorization to these DASH objects and/or their folders.

If you want to protect some of the public dashboards from being changed by any user of the Dashboards perspective, consider using naming conventions for such dashboards. Then in the user definitions grant or prohibit authority to the related objects and folders.

DASH objects authorizations

Users of the Dashboards perspective also need rights to DASH objects:

To open a dashboard from the Dashboards perspective. ("Read" authorization to the related DASH objects.)
To modify or add dashboards on the Dashboards perspective. ("Write" authorization to the related DASH objects.)

Folders to which dashboards are assigned

Use folder authorizations in combination with authorization to DASH objects to control:

Which dashboards a user can open (Read authorization)
Which existing dashboards a user can modify (Write authorization)
Where a user can add a new dashboard (Write authorization)

Rights to objects and folders that are related to perspective data that can appear in dashboards, such as SLAs or certain process queues.

Users can only work with objects that they have authorizations to.

Just keep in mind that in dashboards, just like in the rest of AE, users can see and work with only the objects that they have authorization for.

AEauthorizations to prohibit actions, such as:

Prohibit changing the local default home dashboards

It's a good idea to prohibit users of the Dashboards perspective from changing your local default home dashboards, which might be listed among the Public Dashboards in the Dashboards perspective. (No "Write" authorization to the related DASH objects.)

When a user opens and modifies a home dashboard from the Home button in the ECC or from the home dashboard button for a perspective, then the ECC saves it under a different name. See configuration.properties for details.

Prohibiting modifying certain public dashboards in the Dashboards perspective.