Contents

Configuring Access Rights - tutorial

Summary

A quick tutorial on configuring access rights for Tachyon. Using a scenario where access to Tachyon will be managed through Active Directory groups, the tutorial illustrates the general setup required and the particular steps needed to add the necessary Tachyon users.

In this tutorial

In this tutorial we demonstrate a process for creating Active Directory (AD) managed permissions to the Tachyon portal. We use specifically created AD groups for each of the Tachyon system roles and create Tachyon users for each one, we then define a custom role for a specific Instruction Set and create a Tachyon user with an existing AD group that provides access to running actions in the Instruction Set.

Example AD groups for the Tachyon system roles

As mentioned in Requirements: Active Directory requirements, we recommend that the AD security groups used for defining access to the Tachyon portal features are defined as Universal groups. The picture opposite shows an example TCNConsumerAdmins AD security group intended for the Consumer Administrators role.

In this tutorial we will create a Tachyon AD group user for each of the possible roles given in the following table:

Tachyon system rolePermissionsIntroduced
1E Client Deployment Administrators
  • Create, view and cancel 1E Client deployment jobs.
  • View all devices.

Renamed in 4.1

(previously Agent)

1E Client Installer Administrators
  • Upload, delete and view Agent installers.
  • View all devices.


Renamed in 4.1

(previously Agent)

Applications Administrators
  • Upload and delete Applications.
Tachyon 4.0
Component Viewers
  • View components.
SLA Platform 4.0
Connector Administrators
  • View, create, update, delete and test connectors.
SLA Platform 4.0
Consumer Administrators
  • Manage the Consumers that use the Tachyon platform and view all devices.
Tachyon 3.0
Custom Properties Administrators
  • Add, edit or delete custom properties and view all devices.
Tachyon 3.0
Global Actioners
  • Ask questions, view responses and send actions for all Instruction Sets.
  • View all devices.
Tachyon 3.0
Global Administrators
  • Combined rights of all the other system roles.
Tachyon 3.0
Global Approvers
  • Approve actions for all Instruction Sets for anyone other than themselves.
  • View all devices.

If email is enabled, this role will receive an approval request email for each requested action.

Tachyon 3.0
Global Questioners
  • Ask questions and view responses for all Instruction Sets
  • View all devices.
Tachyon 3.0
Global Viewers
  • View instructions and responses for all Instruction Sets
  • View all devices.
Tachyon 3.0
Guaranteed State Administrators
  • Full control over the Guaranteed State configuration.
Tachyon 4.0
Guaranteed State Viewers
  • View the Guaranteed State configuration and reports.
Tachyon 4.0
Infrastructure Administrators
  • View system status information and view all devices.
Tachyon 3.0
Instruction Set Administrators
  • Load Instructions from Product Packs and Instruction Definition files.
  • Add/delete Instruction Sets and move Instructions between them.
  • View all devices.

Tachyon 3.0

Inventory Administrators
  • Create, update, delete and view inventory repositories.
  • Populate and archive inventory repositories.
SLA Platform 4.0
Inventory Viewers
  • View inventory repositories.
SLA Platform 4.0
Log Viewers
  • View process, synchronization and infrastructure logs.
Tachyon 4.1
Management Group Administrators
  • Create, delete and update management groups.
SLA Platform 4.0
Management Group Sync Initiators
  • View management groups and initiate synchronization of management groups.
SLA Platform 4.0
Patch Success Viewers
  • View the Patch Success dashboards.
Tachyon 4.0
Permissions Administrators
  • Add or remove users.
  • View all roles.
  • Add, modify and delete custom roles.
  • Assign roles to any Instruction sets and define their permissions.
  • View the admin log.
  • View all devices.
Tachyon 3.0
Permissions Readers
  • View all roles.
Tachyon 3.0
Provider Configuration Administrators
  • Update, delete and view provider configurations.
SLA Platform 4.1
Schedule Administrators
  • Create, update, delete and view schedules; and can view schedule history.
SLA Platform 4.1

Questions, responses, actions are examples of securables. Other Consumers may create their own system roles and securables.

Creating the required Tachyon users/groups

The general steps for creating a new user or group are as follows:

Adding Tachyon users

  1. Log on to the Tachyon portal using a Tachyon user account with the Permissions Administrators role.
  2. Navigate to the Settings→Permissions→Users page.
  3. Click on the Add button, doing this displays the Add user popup.
  4. In the Select user field type the name, or part of the name, for the Active Directory user or security group that you want to add. A list of matching names will be retrieved from Active Directory and displayed as you type, these are filtered so that users or groups that have already been added do not appear.
  5. Select the Active Directory user or security group from the list of matching names displayed in the drop-down list and click Add.

The animation at the top of the page shows the process outlined above and described as follows:

  • On the Settings→Permissions→Users page, after clicking the Add button, the Add user popup is displayed.
  • In the Select user edit field we type TCNP, the first few characters of some of the AD groups we created earlier.
  • We then select the TCNPermsAdmins group from the list.
  • Once the necessary user or group has been selected click Add to create the new group user.
  • We then click the new ACME\TCNPermsAdmins name link to display the details for that user.
  • Clicking on Edit displays the Edit roles assigned to user popup.

  • We scroll down, select the Permissions Administrators role and then click Save to set the new role for the user.

  • After the new user or group has just been added Tachyon will display notifications for a short while showing the actions that have just been successfully performed.


In the tutorial we then repeat the process of finding AD groups, adding Tachyon roles and saving for each of the Tachyon system roles. The purpose of this is that subsequently, specific AD user access to Tachyon can be managed through AD via membership of the selected AD groups and avoiding the necessity of managing the users through Tachyon.

The result of adding the groups can be seen in the picture opposite.