You can create user groups by importing them from your LDAP authentication source. After you import a group, you can assign roles to the group.
An imported user group’s membership is maintained in the LDAP authentication source. Any users who are members of the user group in the LDAP source receive the roles that are assigned to the user group in Cloud Manager.
An imported user group’s members are not imported and do not display in the group’s
list. In addition, you cannot manually add users or user groups to an imported group.On the main navigation bar, click
, then click (in the list).or
On the main navigation bar, click
.If you want to import Organization user groups, click the
tab, select the target organization for the import, click to display the Edit Organization dialog box, then click (located above the list on the tab).or
If you want to import System user groups, click
(on the main navigation bar) to display the System Configuration dialog box, click the tab, click the tab, then click .Authenticate to the LDAP directory:
Click the
tab.In the
section, fill in the following fields:Host: Specify the FQDN (fully qualified domain name) or IP address of the host machine running the LDAP server. For example, ldap.mycompany.com or 123.45.67.8.
Port: Specify the TCP port (on the host machine) where the LDAP server is listening for LDAP connections. The standard port for non-SSL connections is 389. The standard port for SSL connections is 636.
Use SSL: If the Cloud Manager Application Server is configured for an SSL connection to the LDAP server, select this option to enable the secure connection.
In the
section, fill in the following fields:User DN: Specify an account that has read rights to the directory location from which you want to import users. For example, cn=Administrator,cn=Users,dc=MyCompany,dc=com
Password: Specify the password for the account.
Password Confirm: Confirm the password for the account.
Click
.If the connection is successful, the Test Status is displayed as
. If the connection is not successful, validate the connection information try again.Import user groups:
Click the
tab.Click
.When you click
, an new import entry is added to the list. You use the fields below the list to define the entry.In the DN field, use standard LDAP notation (ou=provo,dc=netiq,dc=com) to specify the distinguished name for the target container or object, then click .
If you specify a container, all user groups located within the container are imported. If you only want to import one user group, specify the DN of the user group object.
If you specified a container for import, select
.If you specified a container for import, select
if you want to import user groups located in its subcontainers.Click
.The imported user groups are added to the
list. User groups are identified by the icon.When you have finished importing user groups, click
or to close the dialog box.Assign roles to the groups:
On the main navigation bar, click
.Click the
tab, select the user group to which you want to assign roles, then click .(System user groups only) Assign system-level roles.
The system-level roles are Approver, Build Administrator, Catalog Manager, Cloud Administrator, and Zone Administrator. These roles can be assigned only to System user groups.
To assign the Approver, Build Administrator, Catalog Manager, or Cloud Administrator role, click the
tab, click , select the desired roles, then click .To assign the Zone Administrator role, click the
tab, click , select the desired zone, then click .Assign organization-level roles.
The organization-level roles are Approver, Build Administrator, Business Group Viewer, Business Service Owner, Organization Manager, and Sponsor. The Approver and Build Administrator roles can be assigned only to System user groups. The other roles can be assigned to both System and Organization user groups.
Several of the roles can be assigned at the organization, business group, or business service level. For example, you can make a user group a Sponsor for a business group, in which case the group members can approve requests for business services from that business group only. Or, you can make the user group a Sponsor for the organization, in which case the group members can approve requests for all business services in the organization.
Click the
tab to add a role at the organization level, click the tab to add a role at the business group level, or click the tab to add a role at the business service level.Click the role that you want to assign
For example, if you selected the
tab and you want to enable the user group to create business services for the business group, click .Click
, select the object (organization, business group, or business service) to which you want the role to apply, then click to add it to the list.When you have finished assigning roles to the user group, click
.For more information about user groups and roles, see Section III, User Management.