Change Auditor 7.5 - User Guide

Add task definition

Add task definition

A task is a collection of operations and sometimes lower-level tasks that can be performed.

1	Open the Administration Tasks tab and click Configuration.

2	Select Application User Interface in the Configuration task list to open the Application User Interface Authorization page.

3	Expand Add and click Add Task Definition.

4	On the Task page of the Authorizations: Task dialog, enter the following information:

▪	Name: Enter a name for the task

▪	Description: Enter a brief description of the task

5	Open the Definition tab and add the operations and lower-level tasks that can be performed:

▪	To add a lower-level task, click Add Task and select a task from the Authorizations: Task Definitions dialog.

▪	To add an operation, click Add Operation and select one or more operations from the Authorizations: Operations dialog.

6	Click OK to save your new task definition and close the Authorizations: Task dialog.

This task will now be included in the task list on the Authorizations: Task Definitions dialog and can be included in a role definition.

Task definitions are also listed on the Application User Interface Authorization page.

Add role definition

Add role definition

A role definition defines who is authorized to perform specific tasks and/or individual operations in the client. A role usually corresponds to a job function or responsibility and consists of a collection of tasks that a user must be authorized to perform to do their job function.

1	Open the Application User Interface Authorization page.

2	Select Add | Add Role Definition.

3	On the Authorizations: Role dialog, enter the following on the Role tab:

▪	Name: Enter a name for the role

▪	Description: Enter a brief description of the role

4	Open the Definition tab to add a role, task or operation to this role:

▪	To add a role, click Add Role and select a role from the Authorizations: Role Definitions dialog.

▪	To add a task, click Add Task and select a task from the Authorizations: Task Definitions dialog.

▪	To add an operation, click Add Operation and select one or more operations from the Authorizations: Operations dialog.

5	Open the Members tab to add a user, group or application group to this role.

▪	To add an application group, click Add Application Groupn and select an application group from the Authorizations: Application Groups dialog.

▪	To add a user or group, click Add User or Group, which will display the Select one or more Directory Objects dialog. Use the Browse page or Search page to locate and select the user and/or group accounts to add.

NOTE: If a user or group account is added to multiple access roles, the account will have the authority to perform the operations defined in the more authoritative role.

6	Click OK to save your new role definition and close the Authorizations: Role dialog.

Role definitions are displayed on the Application User Interface Authorization page.

Add application group

Add application group

Application groups allow you an alternate way of assigning users to roles. An application group is a feature of Windows Authorization Manager (AzMan) where you can define a group of users without having to go through your domain administrator to add a new group to Active Directory.

1	Open the Application User Interface Authorization page.

2	Expand Add and click Add Application Group.

3	On the Group tab of the Authorizations: Application Group dialog, enter the following information:

▪	Name: Enter a name for the application group

▪	Description: Enter a brief description for the application group

Select one of the following methods which is to be used to define a group of users:

▪	Basic (default)

▪	LDAP Query

NOTE: Basic groups are a lot like Active Directory groups; however you can define both included and excluded members. LDAP query groups allow you to define an LDAP query to dynamically create a group of users who are similar. Refer to the Windows Authorization Manager documentation for more information on basic and LDAP query groups.

4	Open the Members tab and add the users and groups that are to be members of this application group.

▪	To add an application group, click Add Application Group and select an application group from the Authorizations: Application Groups dialog.

▪	To add a user or group, click Add User or Group, which will display the Select Active Directory Objects dialog. Use the Browse page or Search page to locate and select the user(s) and/or group(s) to be added.

5	Optionally, open the Non-Members tab and add the users and groups that are to be excluded from this application group.

▪	To add an application group, click Add Application Group and select an application group from the Authorizations: Application Groups dialog.

▪	To add a user or group, click Add User or Group, which will display the Select Active Directory Objects dialog. Use the Browse page or Search page to locate and select the user(s) and/or groups to add.

6	Click OK to save your new role definition and close the Authorizations: Role dialog.

7	When the selected members now try to define Active Directory protection they will be restricted to defining protection for the selected domain or organizational unit.

Remove a task definition

Remove a task definition

Authorization for operations can be removed when no longer required.

1	Open the Administration Tasks tab and click Configuration.

2	Select Application User Interface in the Configuration task list to open the Application User Interface Authorization page.

3	Right-click the required task in the list.

4	Select Edit.

5	Select the Definition tab.

6	Highlight the required operation and click Remove.