How to grant access to AutoSys Web Services to a Global Group in EEM

Products

• Autosys Workload Automation

Issue/Introduction

General access to the AutoSys Web Server is granted by adding a user to the WorkloadAutomationAEWebService application group in EEM under the WorkloadAutomationAE application. You are able to add individual global users to this group, but you are not able to add a global group. The document provides steps that will allow you to grant access to a global group rather than adding each individual user to the WorkloadAutomationAEWebService group.

Resolution

When a user attempts to access the AutoSys Web Server, it will send an authorization request to EEM to see if the user is a member of a group called "WorkloadAutomationAEWebService". However, it does not matter whether the group is an application group, a global group, or a dynamic user group in EEM. As long as the user is a member of any of those group types and it is called "WorkloadAutomationAEWebService", the user will be granted general access. Therefore, if you want to grant web service access to a global group, you can do so by creating a Dynamic User Group (DUG) policy in EEM under the WorkloadAutomationAE application and adding the global group to that policy. Here are the steps to do this...

Login to EEM under the WorkloadAutomationAE application

Click on the "Manage Access Policies" tab

To the left of the folder called "Dynamic User Group Policies", click the icon to create a new DUG.

On the right, the fields appear to create a new DUG policy.

In the "Folder Name" field, enter "WorkloadAutomationAEWebService"

Under "Identities", add the global group for which you want to grant access to the AE Web Services.

Under "Access Policy Configuration", add a resource called "WorkloadAutomationAEWebService" by typing it in the "Add resource:" field and clicking the "+" to the right of it.

Save the new DUG policy. 

Users that are members of the global group that was added to the policy should now have access to the AE Web Server.

NOTE: The users are still subject to other AE EEM policies that control access to jobjects being accessed by web services. (ex. as-job)