Administrator roles

Introduction to administrator roles

The Intelligent Application Manager provides different levels of authority to ensure the security of your applications.

For example, only administrators are allowed to create new applications, while an application manager is responsible for creating user groups and users for a subset of applications.

Assign roles to users

To assign administrator rights in IAM:

menu Authorization > Users > tab Administrators

Available administrator roles

The following administrator roles are available:

note

ISV's = information specifically for Independent Software Vendors hosting multi-tenant SaaS environments.

Role	Rights
Main administrator	- Full control over the IAM. - Set-up new tenants and manually link users and user groups to them. - Runs in developer mode within the own tenant. This offers extra options in the Developer ribbon. ISV's : - Never assign the Main administrator role to a customer. This role is not limited by the tenancy filters and has access to all the users and all the tenants it is inked to.
Application administrator	- Create new applications and tenants, and link roles to user groups. User groups can be created by a Group administrator. - Assign Application owners. ISV's : - Never assign the Application administrator role to a customer, since this role has access to all applications and users of all tenants, to be able to assign application owners.
Application owner	- See user groups assigned to the own tenant. - Assign roles of the assigned application(s) to user groups. ISV's : - The Application owner role is subject to tenancy and can be assigned to customers.
Group administrator	- See users and user groups within the own tenant. - Create new user groups. The user group will automatically be assigned to the own tenant. - Link users to user groups within the own tenant. Users can be created by a User administrator. - Define Group owners. ISV's : - The Group administrator role is subject to tenancy and can be assigned to customers.
Group owner	- Link users to the groups for which they are the owner, within the own tenant. ISV's : - The Group owner role is subject to tenancy and can be assigned to customers.
User administrator	- See users, user preferences and user logging within the own tenant. - Create new users. The user will automatically be assigned to the same tenant ISV's : - The User administrator role is subject to tenancy and can be assigned to customers. - NOTE: Duplicate user IDs or email addresses might reveal information about users already registered to another customer.
Simulator	- Simulate other users for troubleshooting purposes within the own tenant. See user simulation. ISV's : - The Simulator role is subject to tenancy and can be assigned to customers. - NOTE: if a user is both a Root administrator and a Simulator, any user of any tenant can be simulated.
Developer mode	- Run in developer mode within the own tenant. ISV's : - Never assign the Developer mode role to a customer. This role allows a user to download the system logs which contain information of all tenants.

Examples

An application administrator responsible for creating users and user groups and linking roles to user groups requires the following roles:

• Application administrator or Application owner.
• Group administrator and Group owner.
• User administrator.

A single tenant requires the following roles for creating users and user groups and linking users to user groups:

• Group administrator and Group owner.
• User administrator.