The user and rights management is based on the user and rights management of the underlying database management systems (MS SQL Server).
For Matrix42, database roles to execute specific actions are created. These roles have the necessary rights for the database objects.
A user must be assigned at least one role in order to be able to perform tasks in the Matrix42 Management Console, e.g. a filter on a log entry is displayed again after clicking OK when this log is opened again. If the user only has the sysadmin role, the entire content is displayed and not the previously defined filter.
The following tables show the defined roles with the corresponding actions.
The strings used in the roles have the following meanings:
_C_ role applies for Matrix42 Software Management (Configurator - that was the name of Software Management in previous versions).
_M_ role applies for Matrix42 Administration (Manager).
_I_ role applies for Matrix42 OS Installer (Installer).
| Role | Description |
|---|---|
| EMP_ADMIN | Is allowed to execute all actions in connection with Matrix42. |
| EMP_C_ADMIN | Is allowed to execute all actions in connection with Matrix42 Software Management. |
| EMP_C_AGENT | Is allowed to set up configurations in Software Management > Agent Distribution tab. |
| EMP_C_AGENT_CONFIG | Is allowed to set up configurations in Software Management > Matrix42 Agent tab. |
| EMP_C_DEPOT | Is allowed to set up configurations in Software Management > Depot tab. |
| EMP_C_DISTRIBUTION | Is allowed to set up configurations in Software Management > Distribution tab. |
| EMP_C_VIEWS | Controls the visibility of the View Designer. In Configuration the user gets the View Designer Icon displayed. |
| EMP_I_ADMIN | Is allowed to set up configurations on the Matrix42 OS Installer. |
| EMP_I_DISK_BUILD | Is allowed to create diskettes and PXE images on the Disk Configuration tab. |
| EMP_I_DISK_CONFIG | Is allowed to set up new diskette configurations on the Disk Configuration tab. Is also allowed to create and edit Boot Images under Configuration > Boot Configurations. |
| EMP_I_DISK_TEMPL_CONFIG | Is allowed to edit boot templates on the Disk Configuration tab. |
| EMP_I_DRV_CONFIG | Is allowed to edit drivers and execute the driver wizard under Hardware > Driver Administration. Is allowed to import and assign drivers in Configuration > Driver Wizard. |
| EMP_I_DRV_DOWNLOAD | Is allowed to download and synchronize drivers under Hardware > Driver Administration (also for hardware profiles). |
| EMP_I_HW_CONFIG | Is allowed to edit hardware profiles under Hardware > Edit Hardware Profile. |
| EMP_I_OS_CONFIG | Is allowed to edit operating system configurations on the Operating System Configurations tab. |
| EMP_I_PXE_IMAGE | Is allowed to edit PXE images on the PXE Administration tab. |
| EMP_I_SOFTWARE | Is allowed to add or delete operating system files on the Import tab. |
| EMP_M_ADMIN | Is allowed to execute all actions related to Matrix42 Management. Agent templates and inventory configurations can also be created, edited and deleted. |
| EMP_M_AGENT_TEMPLATES | Controls the visibility of Agent templates. In Administration > right window the user gets the Agent templates displayed. |
| EMP_M_AUDIT | Is allowed to view the data of the Audit. |
| EMP_M_AUDIT_ADMIN | Is allowed to view and configure the Audit data. |
| EMP_M_COMP_ROLE | In the Matrix42 Management Console in the middle tree under Administration a user can be explicitly authorized via the group rights. Prerequisite for this is that this user is a member of the role EMP_M_COMP_ROLE. Note: By default, all users of this role have administrative rights to all groups in the middle tree of the Matrix42 Management Console. The only exception is changing the assignment of variable configurations. For this the role EMP_M_VARVALUE_WO_INHERITANCE is additionally necessary. |
| EMP_M_COMPUTER | Is allowed to execute all actions in the left tree in Administration for Computers. |
| EMP_M_COMPUTER_LIMITED | Is allowed to execute all actions in the left tree in Administration for Computers, except: • delete computer, which are assigned • delete computer, which are not PXE qualified/PXE qualified • delete logs of computers, which are assigned In addition, the reports are hidden in the EWC. |
| EMP_M_DEPENDENCYCHECK | Controls who is allowed to execute software dependencies and who isn't. If someone does not have these permissions, the menu item is greyed-out. |
| EMP_M_DEPOT_SERVER | Reserved, no action stored. |
| EMP_M_DEVICE | Is allowed to execute all actions in the tree on the left of the Administration for Unmanaged Devices tab. |
| EMP_M_DISK_ENDOFLIFE | Is allowed to execute EndOfLife in the context menu of a computer. |
| EMP_M_DISKIMAGE_CLASSES | Controls the visibility of disk image classes. In Administration > right window the user gets the disk image classes displayed. |
| EMP_M_DYNFILTER | Is allowed to create, edit and delete Actionfilter in the tree on the left in the navigation pane Management > Administration. Actions do not account any rights in the middle tree, these will be overwritten. |
| EMP_M_EMM_ACTIONS | Is allowed to perform EMM actions on EMM devices. |
| EMP_M_EWC_HIDE_LEFT_TREE | Is not allowed to see the left web administration interface (EWC). |
| EMP_M_EWC_HIDE_RIGHT_TREE | Is not allowed to see the right web administration interface (EWC). |
| EMP_M_LDAP | Is allowed to execute all actions in connection with LDAP from the Matrix42 Management. |
| EMP_M_OS_TEMPLATES | Controls the visibility of OS templates. In Administration > right window the user gets the OS templates displayed. |
| EMP_M_PMV3_GROUPS | Controls the visibility of Patch-Management. In Administration > right window the user gets the Patch-Management displayed. |
| EMP_M_PROPERTIES | Is allowed to execute all actions in connection with the settings of the Matrix42 Management. |
| EMP_M_PXE_BOOTIMAGES | Controls the visibility of PXE images. In Administration > right window the user gets the PXE images displayed. |
| EMP_M_PXE_QUALIFY | Is allowed to qualify the entries existing under PXE > Not Qualified. |
| EMP_M_REDUNDANCY | Is allowed to execute all actions related to the Redundancy function. Without this right, it is not possible to select the menu point. |
| EMP_M_SUPERADMIN | Entitle to working on assignment groups which shall be managed by the Matrix42 service management and be not changed normally within Empirum. |
| EMP_M_SW_CLASSES | Controls the visibility of Software Classes. In Administration> right window the user gets the software classes displayed. |
| EMP_M_SW_PACKAGES | Controls the visibility of Software. In Administration > right window the user gets the software displayed. |
| EMP_M_SYNC_TEMPLATES | Controls the visibility of Sync templates. In Administration > right window the user gets the Sync templates displayed. |
| EMP_M_USER | Is allowed to execute all actions in the left tree under Administration > User. |
| EMP_M_VARDEF | Controls who is allowed to create variable definitions and who isn't. If someone does not have these permissions, the menu item is grayed out. |
| EMP_M_VARVALUE | Controls who is allowed to modify the content of variables and who isn't. If someone does not have these permissions, the Save button is grayed out. Also controls who is allowed to change variable configurations. If someone does not have these permissions, the Save button in the variable configurations is grayed out. Also authorizes to assign and remove variable configurations in Administration > middle window. |
| EMP_M_VARVALUE_WO_INHERITANCE | Controls that an user can change variable values, but could not force inheritance. The Reset all and Apply all button is also grayed out. Also controls who is allowed to change variable configurations. If someone does not have these permissions, the Save button in the variable configurations is grayed out. Also authorizes to assign and remove variable configurations in Administration > middle window. |
| EMP_M_VIEWS | Controls the visibility of Views. In Administration> right window the user gets the Views displayed. |
| EMP_PM_ADMIN | This role allows you to make changes to the configuration of PM. Without this role the PM configuration can only be viewed, but changes can not be made. |
| EMP_PM3_ADMIN | This role allows you to make changes to the configuration of PM3. Without this role the PM3 configuration can only be viewed, but changes can not be made. |
| EMP_SERVICES | For the Matrix42 services. |