Configuring User Access to Event Broker Services

The user roles for Mission Control include access and permissions to Cluster Manager and its event broker services.

The level of access you have to Cluster Manager and its event broker services depends on the role you are assigned and the permissions granted to that role. For more information, see Mission Control Roles and Permissions.

If you are using group management, you can assign roles to user groups and map the roles to user groups in your IdP.

If your organization uses LDAP or OAuth groups for authentication for management access to event broker services, group members can also have permissions for a specific service. For more information, see Configuring LDAP for Management Access or Configuring OAuth Profiles for Management Access to Event Broker Services.

Mission Control Roles and Permissions

The roles you can be granted in Mission Control, and the actions each can perform are detailed below. Every role listed provides access to Cluster Manager:

Mission Control User

The Mission Control User role can only be assigned to user groups. Members of groups with the Mission Control User role can access Cluster Manager but have limited access and viewing capabilities.

If your organization uses LDAP or OAuth groups for authentication for management access to event broker services, group members can also have been granted a higher access level for a specific service. For more information, see Configuring LDAP for Management Access or Configuring OAuth Profiles for Management Access to Event Broker Services.

The following event broker service access levels can be granted to user groups with the Mission Control User role:

Viewer

The Mission Control User role with Viewer access to an event broker service allows users to view event broker service details.

Editor

The Mission Control User role with Editor access to an event broker service allows users to view event broker service details, as well as modify event broker service configuration, and add, delete, and modify queues.

Manager

The Mission Control User role with Manager access to an event broker service allows users to perform the same functions as users with Editor access. They can also perform these functions:

• Delete the event broker service.
• Add, delete, and modify Dynamic Message Routing (DMR) links, message replay, client profiles, bridge SSL certificates, SEMP over message bus, and client authentication. Modify replication for disaster recovery.
• Assign access to the event broker service to other users with the Mission Control User role.

Mission Control Viewer

Users with the Mission Control Viewer role can access Cluster Manager and can view the details of all event broker services in Cluster Manager but cannot edit or delete them.

Users with the Mission Control Viewer role can also be given Editor or Manager level access to specific event broker services.

Mission Control Manager

Users with the Mission Control Manager role can access Cluster Manager and have full access to all Cluster Manager capabilities. They also have Manager level access to all event broker services.

Account Administrator

Users with the Account Administrator role have full access to all advanced event mesh capabilities. Account Administrators can assign other users any role. In Cluster Manager, Account Administrators have the same access as Mission Control Managers.

For more information about assigning user roles, see Managing Users, Groups, Roles, and Permissions.

The following table provides a detailed breakdown of the permissions available to each role in Mission Control.

Roles	Account Administrator	Mission Control Manager	Mission Control Viewer	Mission Control User
Assign access to event broker services
Create event broker services
Modify event broker services
Delete event broker services
View event broker services
Create a message replay log

The following table provides a detailed breakdown of the operations available on an individual event broker service for Mission Control Users and Mission Control Viewers with elevated permissions.

Roles	Mission Control Viewer			Mission Control User
Access Level	Manager	Editor	No additional access	Manager	Editor	Viewer	No additional access
Assign access to the event broker service
Create an event broker service
Modify an event broker service
Delete an event broker service
View an event broker service

Setting Mission Control User Access for Event Broker Services in Cluster Manager

You must have user groups configured and use LDAP or OAuth groups for authentication for management access to event broker services, to use role-based access controls. For more information, see Configuring LDAP for Management Access or Configuring OAuth Profiles for Management Access to Event Broker Services.

1. Log in to the Cloud Console if you have not done so yet. The URL to access the Cloud Console differs based on your SAP BTP region. For more information, see Logging In to the Cloud Console.
2. Select Cluster Manager on the navigation bar. If the event broker service is not listed, make sure you have the right environment selected. For more information, see Selecting Environments.
3. On the Services page, find the tile matching the service that you want to set access for, click Actions , and then select Set User Access to open the User Access dialog.
4. In the User Access dialog, click Add User Groups.
5. Select a group using the Name field and then set the access level using the Access Level field.

   

6. Click Save.