Search <book_title>...

NetBackup™ Web UI Security Administrator's Guide

Last Published: 2019-08-29

Product(s): NetBackup (8.2)

Add a custom role

If the default NetBackup roles for RBAC do not meet your needs, you can configure a role with custom role permissions. Note, however, that custom roles do have certain limitations. See Limitations of custom roles.

To add a custom role

On the left, select Security > RBAC.
Select the Roles tab and click Add.
Provide a Role name and a description.
For example, you may want to indicate that role is for any users that are backup administrators for a particular department or region.
For Role permissions, choose the permission or type of access that you want users with that role to have for each permission type.
For example, you may want a user to be able to view, but not manage protection plans. Or you may want to give only some users the ability to perform recovery of assets, but not to configure application servers or asset groups.
See Table: Description of permissions for custom roles.
Click Add.

Permissions for custom roles

Table: Description of permissions for custom roles describes the individual permissions that you can select for a custom role.

Table: Description of permissions for custom roles

Permission category	Permission	Action that the permission allows
Job management Allow a user view to jobs or to manage job operations.	Manage Jobs	Manage current or completed jobs. Includes the ability to delete, cancel, restart, and suspend a job.
	View Jobs	View the current or the completed jobs for the master server.
Asset management Allow a user to manage assets, subscribe assets to protection plans, or to view assets. Note that a user can only manage assets for which that user is granted access.	Manage Application Servers and Asset Groups	Add credentials, so NetBackup can discover additional information for the workload. For example, when the user adds VMware credentials, NetBackup discovers more details for the VMware server. The user can then view and select objects within the vCenter. Create and manage asset groups (or "intelligent" groups) and subscribe groups to protection plans. When the backup runs, NetBackup dynamically creates a list of all VMs that meet the conditions for the intelligent group. For example, a user can create an intelligent VM group named "Finance Department". Then the user can add a condition so the group contains all VMs that have a display name that starts with the specific string "finance".
	Manage Assets	Manage the assets that are associated with the supported workloads and subscribe assets to protection plans.
	View Assets	View assets that are associated with the supported workloads.
Storage Management Allow a user to view and manage storage servers and storage units.	Manage Storage	Create, view, edit, or delete storage servers and storage units. Note: Users that only have this permission are not able to sign in to the web UI.
	View Storage	View the attributes for storage servers and storage units. Note: Users that only have this permission are not able to sign in to the web UI.
Recovery Point Management	Manage Recovery Point Expiration	Expire the recovery points available for an asset. This functionality is currently only available from the NetBackup APIs. Note: Users that only have this permission are not able to sign in to the web UI.
Recovery Point Management	Manage Recovery Points	Manage the recovery points available for an asset. This permission lets the user restore, copy, and duplicate a recovery point and change the primary copy of an image. These functions are currently only available from the NetBackup APIs. Note: Users that only have this permission are not able to sign in to the web UI.
Security management Allow a user to view audit logs or to manage security settings or certificates in NetBackup.	Manage Global Security Settings	Manage security settings for the NetBackup master server. These settings affect communication with 8.0 and earlier hosts, automatic mapping of host names, the security level for certificate deployment, and the disaster recovery passphrase. Note: Users that only have this permission are not able to sign in to the web UI.
	Manage API Keys	Add, edit, view, or delete any API keys that are created for NetBackup users.
	Manage Certificates	Manage NetBackup security certificates and view external CA certificate details for hosts. For NetBackup certificates, includes the ability to revoke a certificate, create a resissue token so a certificate can be reissued, or create a new token. Users with this permission can also manage user sessions.
	View Audit Logs	See who has signed in to NetBackup, made changes to security settings, or who has browsed or restored a backup image. Also view the access history for the current user.
	Manage User Authentication	Manage the settings for authenticating users with a smart card or digital certificate. Users with this permission can also manage locked NetBackup user accounts.
	View API Keys	View the API keys that are created for NetBackup users. A NetBackup user is able to view and manage their own key.
Protection plan management Note that a user can only manage or select a protection plan for which that user is granted access.	Manage Protection Plans	Create, edit, or delete protection plans. Also can subscribe assets to protection plans.
	View Protection Plans	View the protection plans that are available and subscribe assets to a protection plan.
Role based access control Allow an administrator to create the access rules that determine the permissions a user has for a specific workload or asset and for specific protection plans.	View Access Rules	View the access rules that are configured.
	Manage Access Rules	Create, manage, or delete access rules. Create custom roles and object groups.
Recovery Allow a user to perform one or more types of recovery. Note that users can only view and recover assets for which that user is granted access.	Instant Access	Create an instant access image. This permission also enables View Recovery Points and View Assets.
	Overwrite Asset	Allows the user to restore assets to their original location. Without this permission a user must restore assets to a different location.
	View Recovery Points	View the recovery points that are available for an asset. Note: Users that only have this permission are not able to sign in to the web UI.
	Restore Files	Restore individual files from the backup image. This permission also enables View Recovery Points and View Assets.
	Recover/Restore	Restore the data from a backup image to a different location.
	Download Files	Download individual files from an instant access mount point. This permission also enables View Recovery Points and View Assets.

Limitations of custom roles

When you create custom roles, note the following:

Some permissions are only available with default RBAC roles or for a custom role that is configured with the NetBackup APIs.
- A user can only manage Hosts settings if that user has the Security administrator role.
- A user can only manage Alerts and notifications and view Usage reporting if that user has the Backup administrator role.
- A user with the Security administrator role also has certain "view" permissions. This way that user can find and add assets, application servers, and protection plans to an object group. If you want a user with a custom role to create access rules, be sure to select the appropriate view permissions for the custom role.
Some individual permissions do not have a direct correlation with a screen in the web UI. Users that attempt to sign in but that only have a permission of this kind receive an "Unauthorized" message. When you create custom roles, be sure to enable the minimal number of permissions so the user can sign in to and use the web UI.