Users Guide

● User dm1 is a member of two AD groups (adg1 and adg2). Both AD groups have been assigned the DM role, with scope
assignments for the AD groups as follows: adg1 is given access to g1 and adg2 is given access to g2. If g1 is the superset of
g2, then the scope of dm1 is the larger scope (g1, all its child groups, and all leaf devices).
When a user is a member of multiple AD groups that have different roles, the higher-functionality role takes precedence (in the
order Administrator, DM, Viewer).
A DM with unrestricted scope has operational access as specified by RBAC privileges to all device and group entities.
NOTE: Post upgrade of OpenManage Enterprise to version 3.6, the AD/LDAP and OIDC (PingFederate or KeyCloak)
device managers would need to recreate all the previous-version entities as these entities are only available to the
administrators post upgrade. For more information, see the Release Notes at https://www.dell.com/support/home/en-yu/
product-support/product/dell-openmanage-enterprise/docs.
SBAC for OIDC users:
Scope assignment for OIDC users does not happen within the OME console. You can assign scopes for OIDC users at an OIDC
provider during user configuration. When the user logs in with OIDC provider credentials, the role and scope assignment will
be available to OME. For more information about configuring user roles and scopes, see Configure an OpenID Connect provider
policy in PingFederate for role-based access to OpenManage Enterprise on page 153.
NOTE: If PingFederate is being used as the OIDC provider, then only administrator roles can be used. For more
information, see Configure an OpenID Connect provider policy in PingFederate for role-based access to OpenManage
Enterprise on page 153 and the Release Notes at https://www.dell.com/support/home/en-yu/product-support/product/
dell-openmanage-enterprise/docs.
Transfer ownership : The administrator can transfer owned resources from a device manager (source) to another device
manager. For example, an administrator can transfer all the resources assigned from a source dm1 to dm2. A device manager
with owned entities such as firmware and/or configuration baselines, configuration templates, alert policies, and profiles is
considered an eligible source user. Transfer of ownership transfers only the entities and not the device groups (scope) owned
by a device manager to another. For more information see, Transfer of ownership of Device Manager entities on page 148.
Related references
OpenManage Enterprise user role types on page 14
Related tasks
Install OpenManage Enterprise on page 19
18
Security features in OpenManage Enterprise