|Commerce Server Installer / What are the required accounts and groups?|
Web Service Administrator Role Assignments
The following table lists the Web services and their corresponding authorization stores and administrator roles. You must assign each Web service account to the corresponding authorization role.
|Authorization Store||Role||Account Assignments|
|CatalogAuthorizationStore.xml||Administrator||CatalogWebSvc, <CS Installer>|
|MarketingAuthorizationStore.xml||MarketingAdministrator||MarketingWebSvc, <CS Installer>|
|OrdersAuthorizationStore.xml||OrdersAdministrator||OrdersWebSvc, <CS Installer>|
|ProfilesAuthorizationStore.xml||ProfileAdministrator||ProfilesWebSvc, <CS Installer>|
After you assign write permissions to the authorization stores, assign users to the administrator roles for each Web service. This is necessary to perform any operation in the Business Management applications. By adding <CS Installer> to each administrator role, you can open and use each Business Management application.
BizTalk Adapters Role Assignments
The following table lists the role assignments that must have the BizTalk adapters identity CSLOB added to them.
|CatalogAuthorizationStore||CatalogAdministrator||Gives the catalog adapter permission to import catalog changes and export catalogs.|
|MarketingAuthorizationStore||InventoryAdministrator||Gives the inventory adapter permission to import inventory catalog changes and export inventory catalogs.|
|OrdersAuthorizationStore||OrdersAdapter||Enables the orders adapter to perform all basic functions, such as Update Purchase Order, Save Purchase Order, Accept Basket, Orders Query, and Orders Export.|
|ProfilesAuthorizationStore||UserObject, ProfileWriter_Adapter||Enables the profiles adapter to update profile objects when it uses the following operations: Profile Delete, Profile Update, Profile Import, Profile Query, and Profile Export.|
Additional User Groups for Granular Security
The following sections list the various authorization roles that are predefined for the Commerce Server systems. For each authorization role of interest, create an associated user group on the domain controller, and add business user accounts to the user group as needed.
For each user group that you create, you must assign the groups to authorization roles through the Authorization Manager. For more information, see Authorizing Users and Groups to Access Web Services.
Catalog and Inventory Systems
The following table lists the predefined authorization roles for the Catalog System and the Inventory System.
|CatalogAdministrator||Members can manage the Catalog System.|
|CatalogViewer||Members have read access to the Catalog System.|
|CatalogManager||Members can manage all the catalogs in the Catalog System.|
|SchemaManager||Members can manage the catalog and inventory schema, including property, category, and product definitions.|
|CatalogSetsAdministrator||Members can manage all the catalog sets.|
|CatalogSetsViewer||Members can view all the catalog sets in the Catalog System.|
|InventoryAdministrator||Members can manage the Inventory System.|
|InventoryViewer||Members can view all the catalogs in the Inventory System.|
|InventorySynchronizationManager||Members can synchronize the run-time Inventory System with the management system.|
|Administrator||Members can manage the Catalog System and the Inventory System.|
The following table lists the predefined authorization roles for the Marketing System.
|MarketingAdministrator||Members have full access to every operation in the Marketing System.|
|MarketingApprover||Members can approve or reject marketing items, such as campaigns, discounts, and expressions.|
|MarketingAuthor||Members can create marketing-related items, such as customers, campaigns, discounts, and expressions.|
|MarketingViewer||Members can view and search marketing items, such as campaign event logs.|
|GlobalExpressionAuthor||Members can create, edit, and delete global expressions across multiple discounts.|
|RuntimeSiteManager||Members can refresh the Discounts and Advertisements caches of the run-time site.|
The following table lists the predefined authorization roles for the Orders System.
|OrdersAdministrator||Members can manage data integrity and cleanup issues.|
|OrdersConfigurationEditor||Members can manage orders configuration data for the site.|
|OrdersViewer||Members have read access to view orders.|
|OrdersAdapter||Members can search orders for order processing and updates.|
The following table lists the predefined authorization roles for the Profiles System.
|ProfileAdministrator||Members have complete access to the Profiles System.|
|ProfileWriter_BusinessManager||Members of this scope-level role have access to the profile definition within the scope. There are six profile definitions: UserObject, Address, Organization, BlanketPO, CreditCard, and Currency.|
|ProfileWriter_CSR||Members of this scope-level role have access to the profile definition within the scope.|
|ProfileWriter_Adapter||Members of this scope-level role have access to the profile definition within the scope.|