4 Managing Management Users and Management User Groups

This chapter describes how to set up and manage administrative users of Oracle Communications Services Gatekeeper.

Task Overview

Management of Services Gatekeeper is performed by administrative users. There are a set of management users, identified by their user type. Each management user is also assigned a user level.

Table 4-1 provides an overview of the operations for managing management users.

Table 4-1 Operations Associated with Management Tasks

To...	Use
Create an administrative user	Operation: addUser
Change password	Operation: changeUserPassword
Delete an administrative user	Operation: deleteUser
Get user level	Operation: getUserLevel
List administrative users	Operation: listUsers

Users and User Groups

Services Gatekeeper classifies its users as either Traffic users or Management users.

• Traffic users are users (application instances) who use the application-facing interfaces to send traffic.

• Management users are users who have access to and can perform management and administration functions.

Traffic users cannot login to the Administration Console or perform any management operations.

During installation, default groups are created in the WebLogic Server Embedded LDAP server. Table 4-2 lists the names of the default user groups, their membership criteria, and classification of user roles.

Table 4-2 User Groups and Privileges

Group Name	Membership and Privileges	Role
Traffic User	All application instances belong to this group. They should be able to just send traffic and should not have access to management functions. They should not have access to WebLogic Server or Services Gatekeeper MBeans. They should not be able to log into the console and perform WebLogic Server administration operations.	TrafficUser
OamUser	Management users who are of OAM type They have access to the console based on their level. They should not be able to send traffic.	OamUser
PrmUser	Management users who are of PRM type They should not have access to the console. They should perform their management operations using the PRM interfaces.	PrmUser

When an Application Instance sends a Simple Object Access Protocol (SOAP) request to the application-facing interfaces, it is authenticated by the WLNG Application Authenticator; upon successful authentication, it adds the WLNGTrafficUsers group to the user principals, in addition to the service provider ID, application ID, service provider group ID, and application group ID.

When Management users log in successfully, they are added to the oamUser group.

Each group contains a user or set of users and is associated with a security role. Groups are generally static; they do not change at run time.

A basic role condition can include users or user groups in a particular security role. For example: set Admin Role to all users in Administrators group.

Roles are evaluated at run time by the Role Mapping Provider by checking the authenticated subject.

A policy contains one or more conditions. For example, a simple policy can be Allow access if the user belongs to Admin Role.

User Types

Following are the predefined management user types:

• Administrative users use the Administration Console or Java Management Extensions (JMX) to interact with Services Gatekeeper.

• PRM operator users use the Partner Relationship Management (PRM) Operator Web Services interfaces to interact with Services Gatekeeper.

• PRM service provider users use the PRM Service Provider Web Services interfaces to interact with Services Gatekeeper.

When creating a management user, the user is mapped to the Weblogic Server authentication provider WLNG Operation, Administration, and Maintenance (OAM) Authenticator.

User Level

Management users are assigned different user levels based on which JMX resources they will be able to access. Table 4-3 lists the access privileges associated with user levels on Services Gatekeeper and WebLogic Server.

Table 4-3 User Levels and Privileges

User Level	Access on Services Gatekeeper	Access on WebLogic Server
1000	Administration access to management functions	Administration access: View, modify, and administer server configuration. Deploy applications. Start, resume and stop servers.
666	Read-write access on management functions	Deployer access: View the server configuration, including some encrypted attributes related to deployment activities. Change startup and shutdown classes, Web applications, JDBC data pool connections, EJB, Java EE Connector, Web Service. If applicable, edit deployment descriptors. Access deployment operations in the Java EE Deployment Implementation (JSR-88).
333	Read-only access on management functions	Monitor access: View the server configuration. Have read-only access to Administration Console, WLST, and other MBean APIs.
0	No access to management functions; Assigned to PRM Service Provider users internally.	Anonymous access: No access to the console

At a more granular level, an administrator may want to give access to only a subset of management interfaces. This can be achieved by applying XACML policies.

Following is an outline of how to apply these policies to add more granular access control:

1. Add a new management user.

2. Create a user group.

3. Add the user to the user group

4. Add an XACML policy to assign role to the group

5. Add an XACML policy to the user group. It is possible to restrict access at a granular level; MBean, MBean attribute, or MBean operation level. See Understanding WebLogic Resource Security in Oracle WebLogic Server Securing WebLogic Resources Using Roles and Policies at

   http://docs.oracle.com/cd/E24329_01/web.1211/e24421/understdg.htm#i121442996

   for a detailed description of this process. The basic process includes:

   • Determine a special identifier, the resourceId, for each MBean.

   • Create an XACML policy for the new security role.

   • Specify one or more rule elements that define which users, groups, or roles belong to the new security role.

   • Attach this role to the MBean using the resourceId.

Reference: Attributes and Operations for ManagementUsers

Managed object: Container Services−>ManagementUsers−>ManagementUsers

MBean: com.bea.wlcp.wlng.user.management.ManagementUserMBean

Following is a list of attributes and operations for configuration and maintenance:

• Operation: addUser

• Operation: changeUserPassword

• Operation: deleteUser

• Operation: getUserLevel

• Operation: listUsers

Operation: addUser

Scope: Cluster

Adds a Services Gatekeeper administrative user.

Signature:

addUser(Username:String, Password: String, userLevel: int, type: int)

Table 4-4 describes these parameters.

Table 4-4 Parameters for addUser

Parameter	Description
Username	User name
Password	Password
UserLevel	Defines the user level when administrating Oracle Communications Services Gatekeeper. See "User Level".
Type	Type of management user. Use: 0 for management user 1 for PRM operator user 2 for PRM service provider user See "User Types".

Operation: changeUserPassword

Scope: Cluster

Changes the password for an existing Services Gatekeeper administrative user.

Signature:

changeUserPassword(UserName: String, OldPasswd: String, NewPasswd: String)

Table 4-5 describes these parameters.

Table 4-5 Parameters for changeUserPassword

Parameter	Description
UserName	User ID for administrative user
OldPasswd	Current password
NewPasswd	New password

Operation: deleteUser

Scope: Cluster

Deletes an Services Gatekeeper administrative user.

Signature:

deleteUser(UserName: String)

Table 4-6 describes this parameter.

Table 4-6 Parameters for deleteUser

Parameter	Description
UserName	User ID for administrative user

Operation: getUserLevel

Scope: Cluster

Gets the user level for a management user. See "User Level".

Signature:

getUserLevel(UserName: String)

Table 4-7 describes this parameter.

Table 4-7 Parameters for getUserLevel

Parameter	Description
UserName	User ID for the management user

Operation: listUsers

Scope: Cluster

Displays a list of all registered management users and their corresponding user levels. See "User Level".

listUsers(Type: int, Offset: int, Size: int)

Table 4-8 describes these parameters.

Table 4-8 Parameters for listUsers

Parameter	Description
Type	Type of user. Use: 0 for management user 1 for PRM operator user 2 for PRM service provider user See "User Types".
Offset	Offset in the list. Starts with 0.
Size	Size of the list

Reference: Attributes and Operations for ManagementUserGroup

Managed object: Container Services−>ManagementUsers−>ManagementUserGroup

MBean: com.bea.wlcp.wlng.user.management.ManagementUserGroupMBean

Following is a list of attributes and operations for configuration and maintenance:

• Operation: addUsertoGroup

• Operation: createUserGroup

• Operation: listGroups

• Operation: listUsers

Operation: addUsertoGroup

Scope: Cluster

Adds an Oracle Communications Services Gatekeeper administrative user to a user group.

Signature:

addUsertoGroup(Username:String, GroupName: String)

Table 4-9 describes these parameters.

Table 4-9 Parameters for addUsertoGroup

Parameter	Description
Username	User name
GroupName	Group name

Operation: createUserGroup

Scope: Cluster

Creates a new user group.

Signature:

createUserGroup(GroupName: String, Description: String)

Table 4-10 describes these parameters.

Table 4-10 Parameters for createUserGroup

Parameter	Description
GroupName	Name of the new administrative group
Description	A textual description

Operation: listGroups

Scope: Cluster

Lists all registered user groups.

Signature:

listGroups(Offset: int, Size: int)

Table 4-11 describes these parameters.

Table 4-11 Parameters for listGroups

Parameter	Description
Offset	Offset in the list. Starts with 0.
Size	Size of the list

Operation: listUsers

Scope: Cluster

Lists user based on user group.

Signature:

listUsers(GroupName: String, Offset: int, Size: int)

Table 4-12 describes these parameters.

Table 4-12 Parameters for listUsers

Parameter	Description
GroupName	Group name
Offset	Offset in the list. Starts with 0.
Size	Size of the list