Assigning roles and privileges

An IBM® BPM on Cloud instance includes a development, test, and a process runtime environment. If you have the account administrative role, you specify which environments a user can access and the IBM Business Process Manager groups that the user is assigned to within each environment.

Before you begin

To add and configure environments for users, you must have the Account Administrator role.

About this task

Each IBM BPM on Cloud environment provides the functions that users need to accomplish the tasks that are assigned to them, such as developing or testing business processes and applications. For example, a user with access to the IBM BPM on Cloud development environment can author processes.

When users are invited to join the IBM BPM on Cloud instance, their user IDs are assigned access to the process runtime environment as a business user. Users who are listed under the Full Name column of the User Management window as Invited User were invited to the instance. These users must click the link in the invitation they were emailed to create their access and log in.

Tip: If you want to use a REST API calls to add or remove users, see IBM BPM on Cloud user provisioning REST API.

Procedure

  1. Log in to IBM BPM on Cloud (https://www.bpm.ibmcloud.com).
  2. Click Admin > User Management.
  3. Assign or remove access to the IBM BPM on Cloud environments for each user ID. For example, to author processes and process applications using Process Designer, users must have access to the development environment.
    Important: You can assign access to the development environment to five users in the IBM BPM on Cloud environment, by default. If the maximum number of users are assigned, you must remove access from a user before you can assign it to another user. If you need more developers, you can purchase extra development users.
  4. Assign users to or remove them from the IBM BPM groups for each environment. Click the name of the user to assign or remove the following IBM BPM group privileges:
    Table 1. Group privileges
    Group Privileges
    tw_admins Members have full access to IBM Process Center, where they can administer IBM BPM user groups and applications. They can also perform health management tasks in the Process Admin console, such as deleting processes and snapshots. To work with BPEL processes too, members must also have the Operator role.
    Debug Members have access to the debug feature.
    twem Members have access to Event Manager.
    tw_authors Members can author processes and process applications in IBM Process Designer.
    Your changes are automatically saved as you make them.

    For example, to enable users to author processes in Process Designer, assign them access to the development environment and add them to the tw_authors group. If you also add the users to the tw_admins group, they can also manage user groups in IBM BPM.

  5. Optional: Assign a user, or users, to the Operator role. An operator can access the Performance Admin Console for any environment that they are assigned access to. An operator monitors the environment, for example by retrieving logs, viewing performance, measuring concurrent users, and monitoring Java™ database connectivity (JDBC).

Results

As you add and configure users, you can track user access from the User Management window. The column headers for each environment show the number of available users in each IBM BPM on Cloud environment and the number currently assigned. When you add or remove user access, the numbers are automatically updated. The maximum number is the maximum number of user accesses that were purchased with your subscription.

What to do next

You can also remove a user from your IBM BPM on Cloud environment. You might want to remove users who are not actively using IBM BPM on Cloud, for example, to add new users. You can remove a user by clicking the Remove icon (The Remove icon deletes the selected user from your IBM BPM on Cloud environment) at the end of the row of the user to be removed.