HCL Workload Automation, Version 9.4

Configuring roles to access the Dynamic Workload Console

During the Dynamic Workload Console installation, new predefined roles are created in the Dashboard Application Services Hub. They determine which console panels are available to a user, and therefore which activities that user can perform from Dynamic Workload Console.

If you do not assign any of the predefined roles to a Dashboard Application Services Hub user, that user, after having logged in, will not see any entry for HCL Workload Automation, and dynamic workload broker in the navigation tree.

Note: The users will not be able to view the console panels if the required engines are not shared with them.

Depending on the security repository you use, the following points apply:

LocalOS: Create the user in the operating system and assign the roles to that user using the Dashboard Application Services Hub console.
WIM: Create the user using the WebSphere administrative console. The user is a WebSphere Application Server user. Then assign roles by using the Dashboard Application Services Hub console as follows: in the Dashboard Application Services Hub navigation bar, click the settings icon that opens the Console Settings menu and click Roles.

To create and assign roles, log in to Dashboard Application Services Hub and run the following steps:

From the navigation toolbar, click the search glass icon, on top of the toolbar. In the search field, enter WebSphere Administrative Console to open the administrative console.
Click Launch WebSphere administrative console.
From the administrative console navigation tree, click Users and Groups > Manage users to create a new user on the file registry (do not create it on the operative system).

For more information about creating and assigning roles, see the Dashboard Application Services Hub online help by clicking the "?" (question mark) in top-right corner of the panels.

Tip: It is not necessary to assign a role to every single user. If the user registry already contains groups of users that are properly defined for using the console, it is possible to assign roles to groups too. If groups are not available in the user registry, then the special role all authenticated portal users can be used to assign roles to all the users at once.

Within Dashboard Application Services Hub, you can create your own custom views to enable users to see all or a subset of HCL Workload Automation pages. To do it, you must have the wasadmin role and perform the following steps:

Create a new Dashboard Application Services Hub View with the pages you want to be available:
1. In the Dashboard Application Services Hub navigation bar, click the settings icon that opens the Console Settings menu and click Views.
2. Click New.
3. In the Views panel, click New and specify a name for the new view.
4. In the Views page, Expand Pages in This View and click Add to add pages to the new view.
5. Select the pages you want to be available to this view and click Add
Add the created view to the all authenticated portal users role:
1. In the Dashboard Application Services Hub navigation bar, click the settings icon that opens the Console Settings menu and click Roles.
2. Click all authenticated portal users role.
3. Expand Access to Views section, click the Add (plus sign) icon, select the newly created view that you want to add to this role and click Add.
4. Expand Access to Views and select the pages to which the users of this role must have access.

The following lists the predefined roles created in the Dashboard Application Services Hub for accessing the HCL Workload Automation environments using Dynamic Workload Console:

TWSWEBUIAdministrator

Users in this group can see the entire portfolio and use all features of the Dynamic Workload Console.

Users in this group can also access and use all features of the Self-Service Catalog and theSelf-Service Dashboards mobile applications. From the Self-Service Catalog mobile application, these users can create and edit catalogs, create and edit services, add services to catalogs, submit services associated to job streams, and share catalogs and services with other users. From the Self-Service Dashboards mobile application, these users can create and edit dashboards to filter for jobs and workstations, display a dashboard of results, perform recovery actions on a single result.

TWSWEBUIConfigurator

Users in this group can manage Dynamic Workload Console scheduler connections, user preferences, and scheduling environment design.

TWSWEBUIOperator

Users in this group can see Dynamic Workload Console:

All Monitor tasks
Jobs and job streams to be submitted on request
Set User Preferences

TWSWEBUIDeveloper

Users in this group can create, list, and edit workload definitions, workstations, and event rule definitions in the HCL Workload Automation database.

TWSWEBUIAnalyst

Users in this group can manage Dynamic Workload Console reports and user preferences.

Users in this group can also access the Self-Service Catalog and theSelf-Service Dashboards mobile applications but the actions they can perform are limited to submitting service requests (job streams) from the Self-Service Catalog and , from the Self-Service Dashboards mobile application, displaying a dashboard of results and performing recovery actions on them.

TWSWEBUIBusinessDeveloper

Users in this group can access and use the Self-Service Catalog and the Self-Service Dashboards mobile applications. From the Self-Service Catalog mobile application, these users can create and edit catalogs, create and edit services, add services to catalogs, delete services and catalogs, and submit services associated to job streams. From the Self-Service Dashboards mobile application, these users can create and edit dashboards to filter for jobs and workstations, display and view a dashboard of results, delete dashboards, and perform recovery actions on a single result. To share catalogs, services, and dashboards with other users, the TWSWEBUIBusinessDeveloper can assign them to the custom roles that the TWSWEBUIBusinessDeveloper possesses but not to predefined roles. Users with these same custom roles can work with the catalogs, services, and dashboards. Users with all of the custom roles can submit services; view, edit, and delete services, catalogs, and dashboards; but users with only one or some of the custom roles can only submit services, and view services, catalogs, and dashboards.

If a user with the Administrator role, creates catalogs, services, and dashboards and does not assign any roles to them, then users with the TWSWEBUIBusinessDeveloper role cannot see or work with them.

Warning: If a custom role is removed from a catalog, service, or dashboards, in addition to the TWSWEBUIBusinessDeveloper user, users with this same custom role can no longer see and work with them, even if they possess other custom roles that are currently assigned to the catalog or service. The Administrator must reassign the custom role to the catalog, service, or dashboard to make it accessible again to the TWSWEBUIBusinessDeveloper user and other users with the same custom role.

The following table lists some entries of the navigation toolbar, and some activities that you can perform on the Dynamic Workload Console. Beside each item, the table shows the groups whose users are authorized to access them.

Table 1. Menu and Group Permissions
Menu Item	Groups with Permission
Quick Start	TWSWEBUIAdministrator
All Configured Tasks	TWSWEBUIAdministrator TWSWEBUIOperator
Manage Workload Reports	TWSWEBUIAdministrator TWSWEBUIAnalyst
Administration -> Workload Design	TWSWEBUIAdministrator TWSWEBUIDeveloper
Administration -> Workload Forecast	TWSWEBUIAdministrator TWSWEBUIOperator
Administration -> Workload Submission	TWSWEBUIAdministrator TWSWEBUIOperator
Administration -> Monitor	TWSWEBUIAdministrator TWSWEBUIOperator
Administration -> Workload Design	TWSWEBUIAdministrator TWSWEBUIConfigurator
Administration -> Monitor	TWSWEBUIAdministrator TWSWEBUIOperator
Reporting	TWSWEBUIAdministrator TWSWEBUIAnalyst
System Configuration ->Manage Engines	TWSWEBUIAdministrator TWSWEBUIConfigurator
System Configuration -> Set User Preferences	TWSWEBUIAdministrator TWSWEBUIOperator TWSWEBUIConfigurator TWSWEBUIDeveloper TWSWEBUIAnalyst
System Configuration -> Manage Settings	TWSWEBUIAdministrator

Assigning a predefined role to an Dashboard Application Services Hub user allows that user to access the Dynamic Workload Console panels. The HCL Workload Automation user specified in the engine connection, instead, determines which operations can be run locally on the connected HCL Workload Automation engine. For example, if the user specified in a HCL Workload Automation engine connection is not authorized to run reporting in the HCL Workload Automation Security file, then, even though the Dashboard Application Services Hub user logged in to Dynamic Workload Console can access the reporting panels, he or she cannot perform reporting operations on that specific HCL Workload Automation engine. For more information about how to configure the security file, see Configuring the security file

The following lists the predefined roles created in the Dashboard Application Services Hub for accessing the dynamic workload broker environments using Dynamic Workload Console, and the panels they can access:

TDWBAdministrator

All panels

TDWBOperator

Scheduling Environment
Configuration
Definitions, except Define a New Job
Monitoring
Preferences

TDWBDeveloper

Configuration
Definitions
Preferences

TDWBConfigurator

Scheduling Environment
Configuration
Monitoring, except Job Instances
Preferences