Users Guide

● User dm1 is a member of two AD groups (adg1 and adg2). Both AD groups have been assigned the DM role, with scope
assignments for the AD groups as follows: adg1 is given access to g1 and adg2 is given access to g2. If g1 is the superset of
g2, then the scope of dm1 is the larger scope (g1, all its child groups, and all leaf devices).
When a user is a member of multiple AD groups that have different roles, the higher-functionality role takes precedence (in the
order Administrator, DM, Viewer).
A DM with unrestricted scope has operational access as specified by RBAC privileges to all device and group entities.
NOTE: Post upgrade of OpenManage Enterprise to version 3.6, the AD/LDAP and OIDC (PingFederate or KeyCloak)
device managers would need to recreate all the previous-version entities as these entities are only available to the
administrators post upgrade. For more information, see the Release Notes at https://www.dell.com/support/home/en-yu/
product-support/product/dell-openmanage-enterprise/docs.
SBAC for OIDC users:
Scope assignment for OIDC users does not happen within the OME console. You can assign scopes for OIDC users at an OIDC
provider during user configuration. When the user logs in with OIDC provider credentials, the role and scope assignment will
be available to OME. For more information about configuring user roles and scopes, see Configure an OpenID Connect provider
policy in PingFederate for role-based access to OpenManage Enterprise on page 153.
NOTE: If PingFederate is being used as the OIDC provider, then only administrator roles can be used. For more information,
see Configure an OpenID Connect provider policy in PingFederate for role-based access to OpenManage Enterprise on page
153 and the Release Notes at https://www.dell.com/support/home/en-yu/product-support/product/dell-openmanage-
enterprise/docs.
Transfer ownership : The administrator can transfer owned resources from a device manager (source) to another device
manager. For example, an administrator can transfer all the resources assigned from a source dm1 to dm2. A device manager
with owned entities such as firmware and/or configuration baselines, configuration templates, alert policies, and profiles is
considered an eligible source user. Transfer of ownership transfers only the entities and not the device groups (scope) owned
by a device manager to another. For more information see, Transfer of ownership of Device Manager entities on page 148.
Related references
OpenManage Enterprise user role types on page 14
Related tasks
Install OpenManage Enterprise on page 19
Add and edit OpenManage Enterprise local users
This procedure is specific to only adding and editing the local users. While editing local users, you can edit all the user
properties. However, for Directory Users, only the role and device groups (in the case of a Device Manager) can be edited. To
integrate Directory Services in OpenManage Enterprise and to import the Directory users, see Directory services integration in
OpenManage Enterprise on page 148 and Import AD and LDAP groups on page 147.
NOTE:
● To perform any tasks on OpenManage Enterprise, you must have necessary user privileges. See Role and scope based
access control in OpenManage Enterprise on page 15.
● You cannot enable, disable, or delete the admin/system/root users. You can only change the password by clicking Edit
in the right pane.
1. Select Application Settings > Users > Users > Add.
2. In the Add New User dialog box:
a. Under User Details, select Administrator, Device Manager, or Viewer from the User Role drop-down menu.
For more information, see Role and scope based access control in OpenManage Enterprise on page 15.
By default, the Enabled check box is selected to indicate that the user privileges currently being set up are enabled for a
user.
b. For the Device Manager roles, the scope is defaulted to All Devices (unrestricted scope), however, the administrator
can restrict the scope by choosing the Select Groups option followed by selecting the device group(s).
c. Under User Credentials, enter Username, Password, and reenter the password in the Confirm Password fields.
Managing OpenManage Enterprise appliance settings
145