Roles in your AEB product – AEB Help Center

Depending on whether you manage users as an admin or manage AEB accounts as a tenant admin, the information on the roles differs slightly. Therefore, first select the use case that suits you best. (Am I a tenant admin?)

Roles that you can assign to users as an admin
Roles that you can assign for AEB accounts as a tenant admin

Roles that you can assign to users as an admin

You can view, create, and assign roles to users in the User administration.

You can use predefined general roles in any AEB product. Additional product-specific roles are also available for some products.

Product-specific roles

For some products, there are product-specific roles available. An overview of these roles for your specific product can be found in the AEB Documentation Center. When searching, enter "Product-specific roles in [your product]", e.g. "Product-specific roles in Carrier Connect”.

Predefined general roles

Here you can find an overview of roles with the associated rights.

You cannot modify pre-defined roles. All pre-defined roles begin with “I_” to make it easy to distinguish them from the roles you define.

Name	Properties
I_BUSINESSFACADE	This role allows a host system to use APIs – that is, to interact with the application externally. It can only be assigned to a system-based user such as a WSM user. This user type is not allowed to have any other role besides I_BUSINESSFACADE. WSM user: AEB creates a user for the WebServiceManager (WSM) with this role by default when you use an AEB product through your host system. Please note: Using this role to edit a user name or password can corrupt the connection to an ERP system. For this reason, such changes require the approval of your system administrator or AEB Support. Do you use other host systems that you would like to connect? Contact the person from your company with an I_CLIENTADMIN role. Only persons with this role can create additional system-based users analogous to the initial WSM user.
I_CLIENTADMIN	Users with this role are client administrators. They can create users for the respective client and can assign and remove user roles. If no one in your company has this role yet, AEB Support can create it for you. (How do I become an admin for managing logins to web applications?)
I_CLIENTGROUPADMIN	If client groups have been set up in the system, this role grants rights that include configuring the display settings, managing user tips, or viewing the change history for these client groups.
I_DDACCESSRIGHT	This role allows the configuration of data-related access rights.
I_DEFAULTPREF	A user with this role defines default settings (column definitions for overviews, etc.). These apply to all users of the current client, as long as individual users do not overwrite them with private settings.
I_EVERYONE	This role assigns the rights of a normal user. This role is included in every other pre-defined role. Every user whom you have not assigned any specific rights has all the rights of this role. This can later be expanded by the addition of other roles or rights or restricted by the removal of rights.
I_READONLY	A user with this role may view various datasets but is not allowed to make any changes. For this reason, this role should be combined with the appropriate views from other roles so that the user has access but is blocked from making changes. This role makes sense for an auditor, for example.

All other predefined roles with explanations can be found in the Office under User administration – Roles.

Roles that you can assign for AEB accounts as a tenant admin

As a tenant admin, you can use the access management to assign roles for your AEB products and test systems to yourself and others.

The tenant admin role is a top-level role. (How do I create an additional tenant admin?) All other roles are system-specific and created by assigning system access rights. (How do I assign system access rights?)

You can use basic roles in any AEB product. Additional product-specific roles are also available for some products.

Product-specific roles

Basic roles

Here you can find an overview of basic roles with the associated rights.

Name	Rights
I_CLIENTADMIN	With the I_CLIENTADMIN role, you can create AEB accounts for other users within the selected system and assign and revoke roles.
I_CLIENTGROUPADMIN	If client groups have been set up in the system, this role grants rights that include configuring the display settings, managing user tips, or viewing the change history for these client groups.
I_DDACCESSRIGHT	This role allows the configuration of data-related access rights.
I_DEFAULTPREF	A user with this role defines default settings (column definitions for overviews, etc.). These apply to all AEB accounts in the system unless overwritten with personalized settings.
I_EVERYONE	This role assigns the rights for normal system usage. This role is included in every other pre-defined role. Everyone to whom you have not assigned any specific rights has all the rights of this role. This can later be expanded by the addition of other roles or rights or restricted by the removal of rights.
I_READONLY	Someone with this role may view various datasets but is not allowed to make any changes. For this reason, this role should be combined with the appropriate views from other roles so that the user has access but is blocked from making changes. This role makes sense for an auditor, for example.
I_BUSINESSFACADE	This role allows a host system to use APIs – that is, to interact with the application externally. It can only be assigned to a system-based user such as a WSM user. This user type is not allowed to have any other role besides I_BUSINESSFACADE. WSM user: AEB creates a user for the WebServiceManager (WSM) with this role by default when you use an AEB product through your host system. Please note: Using this role to edit a user name or password can corrupt the connection to an ERP system. For this reason, such changes require the approval of your system administrator or AEB Support. Do you use other host systems that you would like to connect? Contact the person from your company with an I_CLIENTADMIN role. Only persons with this role can create additional system-based users analogous to the initial WSM user.

Custom roles

As an admin, you can create custom roles in your AEB product and assign rights to them.

Consider whether multiple people need access that is not yet covered by the existing roles. If so, you can create a custom role for this purpose.
How can I restrict rights?

Custom roles are automatically transferred from your AEB product to Access Management once a day. If necessary, you can also start the transfer manually.

How to start the manual transfer of custom roles

Log in with your AEB account at the AEB Home.
In the Administration section, click Manage logins to open the access management for AEB accounts.
Under Systems, click on the system to which you wish to transfer the role.
Click Synchronize roles.

The custom roles are transferred from the AEB product to the access management. You can now assign the roles you have created yourself and which are currently available in your AEB product to AEB accounts when assigning or editing system access rights.