# Documentation Nexus IQ Server 1.26 **Nexus IQ Server 1.26** Our documentation site has moved. For the most current version, please see [http://help.sonatype.com](http://help.sonatype.com/) ## 7.5. Role Management Roles provide a set of permissions that grant various levels of access and control over the IQ Server as well as the connected suite of tools. To grant permissions, you assign a user to either a system-wide administrator role or an organizational role at one of the levels in the system hierarchy: root organization, organization, or application. Which role and level you choose for a user determines what permissions that user receives. You can assign roles to individual users or groups of users. IQ Server has a built-in group called _Authenticated_ _Users_ that contains any authenticated user. In addition, LDAP groups may be available, if you configured IQ Server to use an LDAP server with users mapped to specific groups. ### 7.5.1. Viewing Built-in Roles IQ Server has several built-in roles, which are shown below. If one does not suit your needs, you can create a custom role. **Administrator Roles** - System Administrator - Manages system configuration and users, which includes LDAP and product license management as well as the ability to assign other users to the System Administrator role. - Policy Administrator - Provides full control over organizations, applications, policies, policy violations and custom roles. Only the Policy Administrator has the ability to create organizations. **Organizational Roles** - Owner - Manages assigned organizations, applications, policies, and policy violations. - Developer - Views all information for their assigned organization or application. - Application Evaluator - Evaluates applications and views policy violation summary results. - Component Evaluator - Evaluates individual components and views policy violation results for a specified application. To view roles in IQ Server: 1. Click the _System Preferences_ icon on the IQ Server toolbar. 2. Click _Roles_ on the _System Preferences_ submenu. A list of built-in roles is displayed. | | | | Only a user assigned to an administrator role can see the information
below. If you are using the built-in Admin user account, it is assigned to all
administrator roles. It is highly recommended that you change the Admin
password. | **Figure 7.13. Role and Permission Descriptions** ### 7.5.2. Viewing Permissions of Built-in Roles To view permissions assigned to built-in roles: 1. Click the _System Preferences_ icon on the IQ Server toolbar. 2. Click _Roles_ on the _System Preferences_ submenu. A list of roles is displayed. 3. Click the arrow next to a specific role to view its details and permissions. The built-in roles have the permissions shown below. **Figure 7.14. Permissions of Built-in Roles** | | | | IQ Elements includes organizations, applications, policies, component labels, license threat groups,
application categories, policy violations and waivers. | ### 7.5.3. Understanding the Importance of Hierarchy The scope of permissions granted to a role is governed by where that role is assigned in the system hierarchy. A role assigned to: - Root organization - Grants permissions to all organizations, applications, and repositories. - Organization - Grants permissions to that individual organization and any applications attached to it. - Application - Grants permissions only to the individual application. Firewall solution users have an additional entity for which roles can be assigned: - Repositories - Grants permissions to repositories. ### 7.5.4. Managing Administrator Roles To manage administrator roles, you must log into IQ Server as a user assigned to the System Administrator role. By default, the built-in Admin user account is assigned to the System Administrator role. #### Viewing Administrator Roles 1. Click the _System Preferences_ icon on the IQ Server toolbar. 2. Click _Administrators_. A list of administrator roles and assigned members is displayed. **Figure 7.15. Viewing Administrator Roles** #### Assigning Users to Administrator Roles 1. Click the _System Preferences_ icon on the IQ Server toolbar. 2. Click _Administrators_. The _Administrators_ view is displayed. 3. Click the _Edit Role_ button (looks like a pencil) for the role to which you want to add users. The _Administrators_ view is updated to display the role and its members 4. Search for a user you want to add to the role by entering a full name or part of a name with an asterisk into the search box, then click _Search_. You can use an asterisk as a wildcard at the beginning or end of a character string. For example, _isa*_, *_mov_, and *_asi*_ will all match the name, "Isaac Asimov." Any matching names are displayed in the _Available_ list. 5. To add a user to the role, click a user’s name in the _Available_ list and use the right arrow to move the name to the _Associated_ list. To remove a user from a role, click a user’s name in the _Associated_ list and use the left arrow to move the name to the _Available_ list. 6. Click _Save_ to save the role assignment(s). **Figure 7.16. Assigning Users to Administrator Roles** ### 7.5.5. Managing Organizational Roles To manage organizational roles, you must log into IQ Server as a user assigned to the Policy Administrator role or Owner role. By default, the built-in Admin user account is assigned to the Policy Administrator role. #### Viewing Organizational Role Assignments To view organizational role assignments: 1. Click the _Organization & Policies_ icon on the IQ Server toolbar. 2. Select an entity (organization, application, or _Repositories_) in the sidebar. 3. Click _Access_ in the menu bar at the top of the page to scroll to the _Access_ section. Assigned roles are grouped as follows: - _Local_ \- Role assignments with a scope that’s specific to the selected organization or application. - _Inherited_ \- Role assignments derived from an organization that’s higher in the system hierarchy than the currently selected organization or application. **Figure 7.17. Viewing Role Assignments** #### Assigning Users to Organizational Roles To assign a user to an organizational role: 1. Click the _Organization & Policies_ icon on the IQ Server toolbar. 2. Select an entity (organization, application, or _Repositories_) in the sidebar. 3. Click _Access_ in the menu bar at the top of the page to scroll to the _Access_ section. 4. Click the _Add Role_ button. The Access editor is displayed. 5. In the _Role_ box, select a user role. 6. In the _Search Users_ box, search for a user by entering a full name or part of name with an asterisk, then click _Search_. You can use an asterisk as a wildcard at the beginning or end of a character string. For example, _isa*_, *_mov_, and *_asi*_ will all match the name, "Isaac Asimov." Any matching names are displayed below in the _Associated Users_ list. | | | | If you integrated an LDAP server with IQ Server, the LDAP users and groups are also displayed in the search
results. If you hover over a list item, the LDAP realm and email address are displayed when available. | 7. In the _Associated Users_ list, select a user in the _Available_ column on the left, then click the right arrow button to move the user to the _Associated_ column on the right. If you accidentally add a wrong user, select the user in the _Associated_ column, then click the left arrow to return the user to the _Available_ column. 8. Click Add. **Figure 7.18. Assigning Users to Roles** | | | | If you want to continue adding role assignments for the selected organization, application or Repositories,
click _Add Role_ in the sidebar. | #### Editing Organizational Role Assignments To edit an organizational role assignment: 1. Click the _Organization & Policies_ icon on the IQ Server toolbar. 2. In the sidebar, select the entity (organization, application or _Repositories_) in which the role is assigned. 3. Click _Access_ in the menu bar at the top of the page to scroll to the _Access_ section. 4. Click a listed role (or the chevron next to its name) to display the Access editor. 5. In the _Search Users_ box, search for a user by entering a full name or part of name with an asterisk, then click _Search_. You can use an asterisk as a wildcard at the beginning or end of a character string. For example, _isa*_, *_mov_, and *_asi*_ will all match the name, "Isaac Asimov." Any matching names are displayed below in the _Associated Users_ list. 6. In the _Associated Users_ list, you can add a user to a role by selecting the user in the _Available_ column on the left and clicking the right arrow button to move the user to the _Associated_ column. To remove a user from a role, select the user in the _Associated_ column, then click the left arrow to return the user to the _Available_ column. 7. Click _Update_. **Figure 7.19. Editing Role Assignments** | | | | If you want to continue editing role assignments for the selected organization, application or Repositories,
click a desired role in the sidebar. | #### Removing Organizational Role Assignments To remove organizational role assignments: 1. Click the _Organization & Policies_ icon on the IQ Server toolbar. 2. In the sidebar, select the entity (organization, application or _Repositories_) in which the role is assigned. 3. Click _Access_ in the menu bar at the top of the page to scroll to the _Access_ section. 4. Click a listed role (or the chevron next to its name) to display the Access editor. 5. Click the _Remove Role_ button, then click _Continue_ to remove the role or click _Cancel_ to keep the role. | | | | This is the equivalent of removing or disassociating all users from a role. | ### 7.5.6. Creating Custom Roles | | | | You must have permission to _Edit Custom Roles_ if you want create a
custom role. The default Admin account and the built-in Policy Administrator role
have this permission. | Custom roles allow you to fine tune IQ security permissions for different users. The following permissions are available for custom roles: **Administrator Roles** - View All Roles - Edit Proprietary Components **Organizational Roles** - Claim Components - Edit IQ Elements - View IQ Elements - Evaluate Applications - Evaluate Individual Components - Add Applications | | | | To achieve desired behavior in the IQ user interface, you may need to assign View IQ Elements along with
other permissions. For example, to allow a user to create applications in an organization but not edit the
organization, you should add View IQ Elements and Add Applications to the role. | To create a custom role: 1. Click the _System Preferences_ icon on the IQ Server toolbar and then click Roles. 2. Click the _Create Role_ button. 3. Enter a name and description for the role. 4. Click the _Can/Cannot_ slider to enable or disable a permission as desired. 5. Click the _Save_ button. **Figure 7.20. Creating Custom Roles** | | | | Whenever a user assigned to a custom role with Add Applications permission creates an application, that
user is automatically assigned to the Owner role for that application. | ### 7.5.7. Assigning Groups to Roles without Searching If you have an LDAP configuration that prohibits searching for groups, then the Access editor will have an additional section called _Associate Group._ You can use this section to enter manually a group name and add it to a role. To assign groups to roles without searching: 1. Click the _Organization & Policies_ icon on the IQ Server toolbar. 2. In the sidebar, select an entity (organization, application or _Repositories_). 3. Click _Access_ in the menu bar at the top of the page to scroll to the _Access_ section. 4. Open the Access editor by clicking _Add Role_ or the chevron next to an existing role. 5. In the _Associate Group_ box, enter the group name. The text must be an exact match. 6. Click _Add_. The group name is added to the _Associated_ column without performing a search of users and groups. ### 7.5.8. Viewing Role Assignments To view role assignments: 1. Click the _Organization & Policies_ icon on the IQ Server toolbar. 2. Select an organization or application in the sidebar. A page of customizable settings is displayed. 3. Click _Access_ in the menu bar at the top of the page to scroll to the _Access_ section. Users are displayed by their assigned roles for the selected entity (i.e. organization or application). The information is grouped by where the role assignments were made: locally in the current entity or inherited from an entity higher in the system hierarchy. **Figure 7.21. Viewing Role Assignments**