Web Service authorization

Web Service Administrator Role Assignments

The following table lists the Web services and their corresponding authorization stores and administrator roles. You must assign each Web service account to the corresponding authorization role.

Authorization Store Role Account Assignments
CatalogAuthorizationStore.xml Administrator CatalogWebSvc, <CS Installer>
MarketingAuthorizationStore.xml MarketingAdministrator MarketingWebSvc, <CS Installer>
OrdersAuthorizationStore.xml OrdersAdministrator OrdersWebSvc, <CS Installer>
ProfilesAuthorizationStore.xml ProfileAdministrator ProfilesWebSvc, <CS Installer>

After you assign write permissions to the authorization stores, assign users to the administrator roles for each Web service. This is necessary to perform any operation in the Business Management applications. By adding <CS Installer> to each administrator role, you can open and use each Business Management application.

BizTalk Adapters Role Assignments

The following table lists the role assignments that must have the BizTalk adapters identity CSLOB added to them.

Authorization Store Role Description
CatalogAuthorizationStore CatalogAdministrator Gives the catalog adapter permission to import catalog changes and export catalogs.
MarketingAuthorizationStore InventoryAdministrator Gives the inventory adapter permission to import inventory catalog changes and export inventory catalogs.
OrdersAuthorizationStore OrdersAdapter Enables the orders adapter to perform all basic functions, such as Update Purchase Order, Save Purchase Order, Accept Basket, Orders Query, and Orders Export.
ProfilesAuthorizationStore UserObject, ProfileWriter_Adapter Enables the profiles adapter to update profile objects when it uses the following operations: Profile Delete, Profile Update, Profile Import, Profile Query, and Profile Export.

Additional User Groups for Granular Security

The following sections list the various authorization roles that are predefined for the Commerce Server systems. For each authorization role of interest, create an associated user group on the domain controller, and add business user accounts to the user group as needed.

For each user group that you create, you must assign the groups to authorization roles through the Authorization Manager. For more information, see Authorizing Users and Groups to Access Web Services.

Catalog and Inventory Systems

The following table lists the predefined authorization roles for the Catalog System and the Inventory System.

Role Description
CatalogAdministrator Members can manage the Catalog System.
CatalogViewer Members have read access to the Catalog System.
CatalogManager Members can manage all the catalogs in the Catalog System.
SchemaManager Members can manage the catalog and inventory schema, including property, category, and product definitions.
CatalogSetsAdministrator Members can manage all the catalog sets.
CatalogSetsViewer Members can view all the catalog sets in the Catalog System.
InventoryAdministrator Members can manage the Inventory System.
InventoryViewer Members can view all the catalogs in the Inventory System.
InventorySynchronizationManager Members can synchronize the run-time Inventory System with the management system.
Administrator Members can manage the Catalog System and the Inventory System.

Marketing System

The following table lists the predefined authorization roles for the Marketing System.

Role Description
MarketingAdministrator Members have full access to every operation in the Marketing System.
MarketingApprover Members can approve or reject marketing items, such as campaigns, discounts, and expressions.
MarketingAuthor Members can create marketing-related items, such as customers, campaigns, discounts, and expressions.
MarketingViewer Members can view and search marketing items, such as campaign event logs.
GlobalExpressionAuthor Members can create, edit, and delete global expressions across multiple discounts.
RuntimeSiteManager Members can refresh the Discounts and Advertisements caches of the run-time site.

Orders System

The following table lists the predefined authorization roles for the Orders System.

Role Description
OrdersAdministrator Members can manage data integrity and cleanup issues.
OrdersConfigurationEditor Members can manage orders configuration data for the site.
OrdersViewer Members have read access to view orders.
OrdersAdapter Members can search orders for order processing and updates.

Profiles System

The following table lists the predefined authorization roles for the Profiles System.

Role Description
ProfileAdministrator Members have complete access to the Profiles System.
ProfileWriter_BusinessManager Members of this scope-level role have access to the profile definition within the scope. There are six profile definitions: UserObject, Address, Organization, BlanketPO, CreditCard, and Currency.
ProfileWriter_CSR Members of this scope-level role have access to the profile definition within the scope.
ProfileWriter_Adapter Members of this scope-level role have access to the profile definition within the scope.