Configuring security using a directory server

You must configure security for Control Desk before users can log in to the interface and use its applications.

1. Each process manager defines a set of roles. If you choose automatic configuration, these roles are added to your directory server as security groups. If you choose not to use automatic configuration, you must create the security groups in your directory server before proceeding. If you create the security groups yourself, you can:
   • Use security groups that are already defined in your directory server.
   • Create the same security groups that Control Desk provides.
   • Create new security groups that differ from the groups provided by Control Desk.
   • Use some mixture of new and existing security groups.
2. Assign each user to one or more of these security groups. The security groups to which a user belongs determine which applications and menu items that user can use. These groups also determine which start center the user sees when logging in to Control Desk. If you use access collections, the user's memberships in security groups also determines which configuration items that user can work with. If you are using WebSphere application security for authentication and authorization, use the directory server user interface to assign users to groups. If you are using WebSphere application security for authentication only, use the Users application to assign users to groups.
3. Configure the VMM cron task to copy user information from your directory server in to the Maximo® database. If you are managing groups in your directory server, you must also copy group information.
4. If you created new security groups, click Go To > Security > Security Groups to open the Security Groups application. Use this application to specify the application access permissions for each security group.
5. Each user must have a site defined. After your users are copied from the directory server into the Maximo database, click Go To > Security > Users to open the Users application. You can assign a site to a group of users by using the Set Security Profile action. View the help for the Users application for more details.
6. To enable the single-sign-on capability, so that you can launch to the TADDM UI without logging in again, follow the steps in Configuring for single sign-on.
7. If you want to use access collections to control which users can work with some configuration items, define the access collections. Follow the procedure described in Configuring access collections.
8. If you defined access collections, configure the synchronization of access collections between the TADDM and Maximo databases. Follow the procedure described in Synchronizing access collections.