Core Access Management

This page describes the organizations, roles, and permissions that provide access to various data and functions in this module.

For more information, see Authentication and Authorization in BPC.

Case is not relevant for organizations, roles, and permissions. For example, the BPC does not distinguish between Rolle1 and ROLLE1.

Roles

bpcNoFrontend: Users assigned this role cannot log in to the BPC.
This makes it possible, for example, to manage dedicated users in the Karaf Identity Provider who have access to the Karaf console but not to the BPC itself.

Rights

loadModule_MODULE_ID

This right controls whether a user is allowed to use a module. MODULE_ID corresponds to the technical ID of the module, e.g., loadModule_monitor for the Monitor module.
The appropriate permission must be assigned for each module to be used. If a module lacks the appropriate permission, the user cannot access the module’s configuration (see also Configuration API). Furthermore, the web client will not load the associated JavaScript code.

The module ID is displayed as a tooltip on the corresponding tabs in the admin area.

useModuleInstance_MODULE_INSTANCE_ID

This permission is evaluated if access to instances has been restricted in the module (see Module_RestrictInstanceAccess in Configuration). If access is restricted, the user must have permission for the specific instance in addition to the permission loadModule_MODULE_ID in order for the instance to be created.
MODULE_INSTANCE_ID serves as a placeholder here for the specific ID of the instance.

createModuleInstances_MODULE_ID

This permission controls whether You can create instances of a module.
MODULE_ID corresponds to the technical ID of the module, e.g., createModuleInstances_monitor for the Monitor module.

deleteModuleInstances_MODULE_ID

This permission controls whether You can delete instances of a module.
MODULE_ID corresponds to the module’s technical ID, e.g., deleteModuleInstances_monitor for the Monitor module.

showBpcConfiguration

Allows the administration area to be displayed.

loginDuringMaintenanceMode

Authorizes the user to log in while the system is in maintenance mode.

getSessionStatus

This permission allows active sessions to be read via the Status API.
This is also required to use the session overview widget.