Administer Advanced CA EEM Security › How to Transition Roles Used in Active Directory to CA EEM

How to Transition Roles Used in Active Directory to CA EEM

If you previously used Microsoft Active Directory (AD) or LDAP for authentication and authorization, you can transition to CA EEM with any of the following approaches:

• Create user accounts. Assign one of the default groups to each account.

  Note: See Review Permissions for Default Groups.

• Point to AD as an external user store.

  Note: See Manage Access for Referenced User Accounts. See Integrate Active Directory with CA EEM.

• Create custom groups that reflect your AD roles. Add these groups to CA EEM policies and grant the required permissions. Create user accounts. Assign one of your custom groups to each account. This section addresses this approach.

Assume that you defined Security settings of the Domain in Active Directory with these groups: ITPAMAdmins, ITPAMUsers, ConfigAdmin, ContentAdmin, and EnvironmentUser.

To migrate role-based access from Active Directory to CA EEM manually, use the following process.

Follow these steps:

1. Migrate role-based access for users in the Domain Administrator role.

   See Create User Accounts for Administrators.

2. Migrate role-based access for users in the CA Process Automation User role.

   See Create User Accounts with Basic Access.

3. Migrate role-based access for users in the Environment Configuration Administrator role as follows:
   1. Create the custom ConfigAdmin group.
   2. Grant permissions to the custom ConfigAdmin group.
   3. Create user accounts for Environment Configuration Administrators.
4. Migrate role-based access for users in the Environment Content Administrator role as follows:
   1. Create the custom ContentAdmin group.
   2. Grant permissions to the custom ContentAdmin group.
   3. Create user accounts for Environment Content Administrators.
5. Migrate role-based access for users in the Environment User role.

   See Create User Accounts for Production Users.