- Getting started
- Best practices
- About the Tenant Context
- Folders Context
- Storage Buckets
- Test Suite - Orchestrator
- Action Catalogs
- System Administrator
- Identity Server
- Configuring the Active Directory Integration
- Configuring SSO: Google
- Configuring SSO: Azure Active Directory
- SmartCard Authentication
- Setting Up Auto Login for Users Under an Active Directory Group
- Configuring the SMTP Server
- Changing the Windows Authentication Protocol
- Other Configurations
- Classic Robots
Orchestrator uses an access-control mechanism based on roles and permissions. Roles are collections of permissions meaning that the permissions needed to use certain Orchestrator entities are assigned to roles.
Role-permissions and user-roles relationships allow for a certain level of access to Orchestrator. A user gets the permissions required to perform particular operations through one or multiple roles. Since users are not assigned permissions directly, but only acquire them through roles, management of access rights involves assigning appropriate roles to the user. See Modifying the Roles of a User.
There are two categories of permissions when defining roles:
- Tenant Permissions - Define a user's access to resources at the tenant level.
Folder Permissions - Define the user's access and ability within each folder they are assigned to.Note: For a global operation, only the user's permissions set at tenant level are taken into consideration. For a folder specific operation, if a custom role is defined those permissions are applied in favor of any tenant level permissions present.
- Background tasks
- ML Logs
- Storage Files
- Storage Buckets
- Execution Media
- Folder Packages
- Action Assignment
- Action Catalogs
- Tasks Assignment
- Test Case Execution Artifacts
- Test Data Queue Items
- Test Data Queues
- Test Set Executions
- Test Sets
- Test Set Schedules
The Orchestrator interface enables the selection of all applicable rights (View, Edit, Create, Delete) for all listed permissions, but please note that not all rights are applicable to each listed permission:
By default, the following roles exist in Orchestrator:
A user with all tenant level permissions granted. This is the default role granted to the
admin user of each tenant and cannot be edited.
All permission required for the execution of processes in Classic folders.
See the Default Roles page for the permissions specific to each role.
For all users, Orchestrator automatically creates the following roles:
The equivalent of the Administrator role, a user with tenant level permissions granted.
Assign at the tenant level to those users, if any, that are delegated the management of all tenant entities.
Allow to be Folder Administrator
A user with the minimum tenant level permissions needed to manage their own folders and subfolders.
Assign at the tenant level in conjunction with the Folder Administrator role, below, at folder level to enable folder management for that user.
A user with the minimum folder level permissions needed to manage their own folders and subfolders.
Assign at the folder level in conjunction with the Allow to be Folder Administrator role, above, at tenant level to enable folder management for that user.
Allow to be Automation User
A user with the minimum tenant level permissions needed to execute processes.
Assign at the tenant level in conjunction with the Automation User role, below, at folder level.
A user with the minimum folder level permissions needed to execute processes.
Assign at the folder level in conjunction with the Allow to be Automation User role, above, at tenant level.
Note that the associated permissions for these roles may change between versions as new features and integrations are added. When this occurs, the affected role(s) appear red in your Tenant Settings page. Click on the affected role(s) to display a prompt enabling you to add the missing permissions for this role.