Reference Information › Command Line Shell Reference Guide › Using Role Based Access Control › Global Users and Groups

Global Users and Groups

Global users are maintained external to the grid in a global directory service. When a global user first authenticates on the grid (for example, logs in to the CA AppLogic GUI), the global user is assigned a unique ID based on a user attribute in the global directory. For example, this may be the user SID or GUID in the case of Active Directory. Once a global user has authenticated for the first time, some information about that global user is maintained in the local directory service. This is necessary because CA AppLogic does not write any information to the global directory and because CA AppLogic only reads from the global directory at the time of global user authentication. The global user information maintained locally includes:

• User login name and ID
• User profile property settings such as email address, real name, comment and locale
• User membership in global groups

It should be noted that every user is a member of the implicit local group all. If this group is given, for example, grid_administrator access level rights on the grid ACL, then every user (local or global) obtains these rights.

Both local and global user names may include any UTF-8 character with the following exceptions:

• User names may not contain the forward slash character "/"
• User names may not contain ASCII control characters
• User names may not contain the space or period characters