Search <book_title>...

Veritas InfoScale™ Operations Manager 7.4 Installation and Configuration Guide

Last Published: 2019-11-04

Product(s): InfoScale & Storage Foundation (7.4)

Platform: AIX,Linux,Solaris,Windows

Example: Managing user access in Veritas InfoScale Operations Manager using Organizations and existing user groups

As an Administrator you may need to restrict user groups from performing certain tasks on specific objects. Using the Management Server console, you can assign roles to existing user groups on a perspective. Alternately you can also create Organizations in a perspective, and assign roles to user groups on these Organizations. Organizations can be created using hosts, clusters, virtualization servers, and enclosures in Server, Availability, Virtualization, and Storage perspective respectively.

You can create an Organization in one of the following ways:

Create an empty Organization.
Create an Organization by manually selecting the objects.
Create an Organization by selecting objects based on a rule.

This example explains how you can restrict user groups from performing certain tasks on objects.

You can do any one of the following to restrict access:

Provide access only to the selected perspective.
Create an Organization in a perspective, and provide access to the same.
Provide access to an object within the Organization.

For more information on creating Organizations within a perspective and assigning predefined roles, refer to the Veritas InfoScale Operations Manager Management Server User Guide.

In this example, we use the following names:

Domain	alpha.veritasdomain.com
User group 1	UserGroup_A
User group 2	UserGroup_B
User group 3	Operations_team
Organization 1	Windows_cluster
Organization 2	Linux_cluster
Service group	Beta_SG

Provide access to user groups on a perspective

As an Administrator, you can provide access to user groups on a perspective. Veritas InfoScale Operations Manager makes use of the existing user groups which are present in Lightweight Directory Access Protocol (LDAP) or Active Directory (AD), or the authentication mechanism in the native operating system of Windows and UNIX. Before you assign permissions to user groups, you need to create user groups in LDAP or AD. Create user groups called UserGroup_A, UserGroup_B, and Operations_team. User group names are case-sensitive.

User groups with Admin role on a perspective can perform all the tasks in that perspective. In addition to the Admin role, Operator role is available only in the Availability perspective. User group with Operator role can perform certain tasks such as onlining and offlining service groups, freezing or unfreezing service groups, clearing faults on service groups or, running the disaster recover fire drill.

A user group having the Guest role on any perspective can only view the information and not perform any task.

Consider the Operations_team user group which is responsible for tasks such as freezing or unfreezing service groups, clearing faults on service groups, running the high availability or disaster recover fire drill. These tasks are performed on the services groups in the Availability perspective. A user group having either Admin or Operator role can perform these tasks. As an Administrator, you can assign the Operator role to Operations_team, thereby restricting them from performing other tasks which require Admin role.

Using the Management Server console, you can assign the Operator role on the Availability perspective to the Operations_team user group.

To assign Operator role to Operations_team on the Availability perspective

In the Home page on the Management Server console, click Settings.
Click Security.
Click the Permissions tab.
Select Availability perspective.
Under Add Permission, click Select user group.
In the Select user group panel, select alpha.veritasdomain.com, and enter Operations_team.
Verify the user group, and click OK.
Under Add Permission, select Operator role from the list, and click Add.

Create an Organization in a perspective, and provide access to the same

Assigning the Admin role to user groups on a perspective, allows the user groups to perform all tasks on all the objects within the perspective. As an Administrator, you may want to restrict the access to certain objects within the perspective. To do this, you need to create an Organization by grouping the objects. You can then provide appropriate roles to user groups on these Organizations.

For example, in the Availability perspective, you can create an Organization called Windows_cluster which consists of all Windows cluster nodes and another called Linux_cluster having all Linux cluster nodes. You can assign the clusters to the Organization based on a rule.

To create a Windows_cluster Organization

In the Home page on the Management Server console, go to Availability perspective and select Manage in the left pane.
Right-click Data Center and select Create Organization.
In the Create Organization wizard panel, enter Windows_cluster in the name field.
Select Assign Clusters to Organization Based on Rule, and click Next.
In the Create Organization - Based on a rule wizard panel, do the following:
- In the Attribute list, select Platform.
- In the Condition list, select Is One-of.
- In the Values list, select Windows.
Click Finish.

The rule is applied and all the cluster nodes having Windows platform are moved from Uncategorized Clusters into the Organization named Windows_cluster. When a new Windows cluster node is added to the Management Server domain, it is automatically moved into Windows_cluster Organization.

Similarly you can create another Organization called Linux_cluster for all cluster nodes on Linux platform.

You can now restrict access to these Organizations. You can provide Admin role to UserGroup_A on the Windows_cluster Organization, and UserGroup_B on Linux_cluster.

To assign Admin role to UserGroup_A on Windows_cluster

In the Home page on the Management Server console, go to Availability perspective and select Manage in the left pane.
Right-click Windows_cluster, and select Properties.
Under Add Permission, click Select user group.
In the Select user group panel, select alpha.veritasdomain.com, and enter UserGroup_A.
Verify the user group, and click OK.
Under Add Permission, select Admin role from the list, and click Add.

The UserGroup_A is now assigned the Admin role on Windows_cluster. This team can now perform all the tasks on the cluster.

Similarly you can assign Admin role to UserGroup_B on Linux_cluster. If required, you can also assign Guest role to UserGroup_A on Linux_cluster, and Guest role to UserGroup_B on Windows_cluster.

Provide access to an object within the Organization.

Since UserGroup_A is assigned Guest role on Linux_cluster, all the service groups within Linux_cluster inherit the Guest role for UserGroup_A.

Consider a service group, Beta_SG, which belongs to the Linux_cluster Organization. You want to assign Admin role to UserGroup_A on this service group. To do this you need to modify the role.

To modify role on Beta_SG to Admin for UserGroup_A

In the Home page on the Management Server console, go to Availability perspective and select Manage in the left pane.
Expand Linux_cluster, expand Service Groups, and select Beta_SG.
Right-click Beta_SG, and select Properties.
Click the Permissions tab.
Right-click UserGroup_A, select Modify Role.
Select Admin role and click OK.

UserGroup_A now has Admin role on Beta_SG, and Guest role on the remaining service groups in the Linux_cluster Organization.

More Information

Adding Lightweight Directory Access Protocol or Active Directory-based authentication on Management Server

About predefined roles in Veritas InfoScale Operations Manager

Assigning permissions to user groups for a perspective