test

N1 Grid Service Provisioning System 5.0 System Administration Guide

Chapter 4 Managing Users

Through the N1 Grid Service Provisioning System, you can create user accounts and define user groups. Because an individual user's permissions are determined by the permissions granted to his or her group, you must consider how you plan to set up accounts and groups.

This chapter covers the following topics.

Planning User Groups and User Accounts

All permissions are tied to user groups. By adding or removing a user from a user group, you directly impact the tasks that the user can perform. For more information about permissions, see Chapter 3, Controlling Access Using Permissions.

When setting up user groups and user accounts, you must also consider how you plan to set up your folders. Folder-based permissions establish permissions on objects that are contained within a folder, which are components, plans, and subfolders. System-wide permissions establish permissions on objects not contained in folders, for example, hosts, comparisons, and users. You can set system-wide permissions in each user group's Details page. You can also set permissions at the folder level.

You should first set up user groups based on the roles you expect users to take. Then you create new user accounts and decide to which user groups they should be added.

When setting up user accounts, consider the following items.

Managing User Groups

A user group is a user-definable object that is used to categorize users and define permissions. By carefully planning out the names for user groups and which permissions to grant each group, you can easily manage individual user permissions by making them part of one or more groups.

User Group Characteristics

For more information about the different types of user group permissions, see Chapter 3, Controlling Access Using Permissions.

Default User Groups

The provisioning system provides three default user groups after installation: admin, registered, and universal. Default user groups cannot be deleted and cannot have their names changed.

admin User Group

The provisioning system provides the admin user group after installation to allow initial system configuration. This user group is designed for administrators of the provisioning system.

Members of the admin user group have all permissions on all objects in the provisioning system and can modify an object whether or not they own it.

Members of the admin user group perform many functions.

The admin user group comes with one default user, the admin user. However, if you have more than one administrator of the provisioning system, you can add other users to the admin user group.

Caution – Caution –

Since the admin user group has complete control over all aspects of the provisioning system, be careful when assigning users to this group.

For more information about the admin user, see Default User Account.

For more information about creating new users, see How to Create User Accounts.

registered User Group

The registered user group consists of all users that have been created in the provisioning system.

registered User Group Characteristics

universal User Group

The universal user group includes all users. By default, no permissions are granted to this group. However, new permissions can be granted, which has the affect of allowing anyone to perform the associated operation. The registered group may not be removed as a child of this group.

ProcedureHow to Create User Groups

This procedure describes how to create user groups by using the browser interface. You can also create user groups by using the following command.

For a detailed description of this command, see udb.g: Managing User Groups in N1 Grid Service Provisioning System 5.0 Command-Line Interface Reference Manual.

Before You Begin

Before you create user groups, you should determine how you want to organize your users. For information about how to set up user groups, see Planning User Groups and User Accounts.

To create a user group, you must belong to a user group that has write permissions on users and groups.

Steps

  1. Go to the User Groups page.

    See How to View User Groups.

  2. In the top row of the table that lists user groups, type a name and a description for the new user group and click Create.

    The Details page for the new user group is displayed.

  3. Add a user or user group to the group.

    Newly created user groups do not contain any members.

    • To add a user, select the user account from the User menu in the Members of Group area and click Add.

      Users added to the user group inherit the permissions given to this user group and all user groups that contain this user group.

    • To add a user group, select the user group from the User Group menu in the Members of Group area and click Add.

    The Details page updates to show the added user or members of the added user group in the Current Group Members field.

    Note –

    The Current Group Members field lists a user only once, even if that user belongs to two or more groups that you have added to the group.

  4. In the Permissions of Group Users area of the page, set system-wide permissions for the new user group.

    Permissions set in this user group are inherited by members of the user group. These members include individual users as well as other, nested user groups.

    Note –

    If you give the user group comparison permissions, select the host set on which the users in the group can run comparisons.

    For more information, see System-Wide Permissions.

  5. When you have finished configuring the group, click Save.

    The User Groups page lists the new user group.

ProcedureHow to View User Groups

You can view the users and the permissions of a particular user group.

This procedure describes how to view user groups by using the browser interface. You can also view user groups by using the following commands.

For a detailed description of these commands, see udb.g: Managing User Groups in N1 Grid Service Provisioning System 5.0 Command-Line Interface Reference Manual.

Steps

  1. From the navigation menu, choose User Setup.

    The User Setup page is displayed.

  2. In the User Setup page, click User Groups.

    This displays the User Groups page, which lists the user groups already defined.

  3. (Optional) To view a list of users within a group or the permissions held by a user group, find the row that lists the group that you want to view and click Details.

Editing User Groups

Editing user groups allows you perform the following tasks after you have created a user group.

ProcedureHow to Edit User Groups

This procedure describes how to edit user groups by using the browser interface. You can also edit user groups by using the following command.

For a detailed description of this command, see udb.g: Managing User Groups in N1 Grid Service Provisioning System 5.0 Command-Line Interface Reference Manual.

Before You Begin

To edit a user group, you must belong to a user group that has write permissions on users and groups.

Steps

  1. Go to the Details page of the user group that you plan to edit.

    See How to View User Groups.

  2. (Optional) Add a user or user group to the group.

    Newly created user groups do not contain any members.

    • To add a user, select the user account from the User menu in the Members of Group area and click Add.

      Users added to the user group inherit the permissions given to this user group and all user groups that contain this user group.

    • To add a user group, select the user group from the User Group menu in the Members of Group area and click Add.

    The Details page updates to show the added user or members of the added user group in the Current Group Members field.

    Note –

    The Current Group Members field lists a user only once, even if that user belongs to two or more groups that you have added to the group.

  3. (Optional) In the Permissions of Group Users area of the page, set system-wide permissions for the user group.

    Permissions set in this user group are inherited by members of the user group. These members include individual users as well as other, nested user groups.

    Note –

    If you give the user group comparison permissions, select the host set on which the users in the group can run comparisons.

    For more information, see System-Wide Permissions.

  4. (Optional) In the Permissions of Group Users area of the page, select the host set on which users can run comparisons.

  5. When you complete your modifications, click Save.

Deleting User Groups

When a user group is deleted, the user group is removed from all user groups to which it belonged. Users and user groups that belonged to the deleted group continue to exist, but they no longer belong to the user group, and therefore, no longer have the permissions granted by the deleted user group.

If a folder granted the user group certain permissions, those permissions are also deleted when the user group is deleted.

ProcedureHow to Delete User Groups

The browser interface provides two options for deleting user groups. You can delete multiple user groups at once from the User Groups page or one at a time from the user group's Details page. This procedure provides instructions on how to delete several user groups at a time.

You can also delete user groups by using the following command.

For a detailed description of this command, see udb.g: Managing User Groups in N1 Grid Service Provisioning System 5.0 Command-Line Interface Reference Manual.

Before You Begin

To delete a user group, the following requirements must be met.

Steps

  1. Go to the User Groups page.

    See How to View User Groups.

  2. Select the user groups that you plan to delete.

  3. At the bottom of the User Groups table, click Delete.

    A verification page lists the user groups that you selected.

  4. Click Continue to Delete.

    After the user groups have been deleted, the User Groups page updates and the user groups that you deleted no longer appear.

About User Accounts

The N1 Grid Service Provisioning System software restricts access and provides audit trails through the use of user accounts and the plan run history. All users are required to log in to use the application. The Master Server includes a single default account, admin. All other accounts are user definable.

Default User Account

The provisioning system's default user account provides initial access to the product and is intended for system administrators. The user name for this account is admin and the default password is defined during product installation.

After you have logged in as admin, you can set up other user accounts and user groups.

The admin user is a member of the admin user group. The admin user cannot be removed from the admin user group. For more information on the role of the admin user, see admin User Group.

Managing User Accounts

This section describes how to view and create user accounts. You can also modify user accounts and passwords after an account is created.

ProcedureHow to Create User Accounts

You will need to create new user accounts when users need to access the system.

Note –

Any user added to the provisioning system has read permissions on all objects within the system. If you are storing sensitive information in the system, ensure that you only add users that should have access to that sensitive information.

You can also create user accounts by using the following command.

For a detailed description of these commands, see udb.g: Managing User Groups in N1 Grid Service Provisioning System 5.0 Command-Line Interface Reference Manual.

Before You Begin

To create a user account, you must belong to a user group that has write permissions on users and groups.

If you plan to add a user who will be externally authenticated, ensure the following criteria are met.

Steps

  1. Go to the Users page.

    See How to View User Accounts.

  2. In the top row of the table that lists user accounts, type a name for the new user account and click Create.

    The Details page for the new user account is displayed.

  3. Select an authentication method from the menu.

    If the authentication method that you select has an asterisk, *, you will need to enter a password for the user account in the New Password and Confirm New Password fields.

    To add new login configurations to the provisioning system, see Appendix A, Authentication Methods.

  4. Use the controls in the Member of User Groups area to add this user account to one or more user groups.

    Note –

    In the provisioning system, permissions are based on user groups rather than on individual user accounts. By adding this user account to a group, you determine the privileges it is assigned. For more information, see Folder-Specific Permissions.

    For more information about adding a user to a user group, see How to Edit User Groups.

  5. (Optional) To hide this user account, select Hidden.

  6. Click Save.

Viewing User Accounts

You might want to view user accounts in the following situations.

ProcedureHow to View User Accounts

This procedure describes how to view user accounts by using the browser interface. You can also view user accounts by using the following commands.

For a detailed description of these commands, see udb.g: Managing User Groups in N1 Grid Service Provisioning System 5.0 Command-Line Interface Reference Manual.

Steps

  1. From the navigation menu, choose User Setup.

    The User Setup page is displayed.

  2. In the User Setup page, click Users.

    The Users page lists user accounts that are active and not hidden.

  3. (Optional) To view hidden or deactivated users, select Show Hidden Users.

    The browser interface displays all users. Hidden or deactivated user accounts appear in different colors.

  4. (Optional) To view the details of a particular user, find the row describing the user and click Details.

    The Details page for the selected user is displayed.

ProcedureHow to Deactivate or Hide User Accounts

When you deactivate a user account, the user is no longer allowed to access the provisioning system. Since the provisioning system tracks system activity by user account, you are not able to remove user accounts from the provisioning system.

You can hide a user account as a way to manage the number of users that display in the Users page.

This procedure describes how to deactivate or hide user accounts by using the browser interface. You can also deactivate or hide user accounts by using the following command.

For a detailed description of this command, see udb.g: Managing User Groups in N1 Grid Service Provisioning System 5.0 Command-Line Interface Reference Manual.

Before You Begin

To deactivate a user account, you must belong to a user group that has write permissions on users and groups.

Steps

  1. Go to the Details page of the user account that you plan to edit.

    See How to View User Accounts.

  2. In the table that lists users, find the row describing the user you plan to deactivate, and click Details.

    The user's Details page is displayed.

  3. To hide or deactivate this user account, select Hidden or Deactivate.

    If you select Deactivate, the user account will automatically be hidden.

  4. Click Save.

ProcedureHow to Change a User's Group Membership

This procedure describes how to change a user's group membership by using the browser interface. You can also change group membership by using the following command.

For a detailed description of this command, see udb.g: Managing User Groups in N1 Grid Service Provisioning System 5.0 Command-Line Interface Reference Manual.

Before You Begin

To edit a user account, you must belong to a user group that has write permissions on users and groups.

Steps

  1. Go to the Details page of the user account that you plan to edit.

    See How to View User Accounts.

  2. In the table that lists users, find the row describing the user account you plan to modify, and click Details.

    The user's Details page is displayed.

  3. To change membership in any group, use the controls in the Member of User Groups area to add this user account to or remove it from one or more user groups.

  4. Click Save.

ProcedureHow to Change Your Password From the Log In Page

If you need to need to change your password, you can change your password from the Log In page as long as you are using internal authentication for your password. If you are using external authentication, change your password through that application.

Note –

When you use this procedure to change your password, all of your encrypted session variables are re-encrypted using your new password.

Steps

  1. In the navigation menu on the Log In page, click Change Password.

    If you are already logged in, click Log Out in the top right corner to navigate to the Log In page.

  2. Type your user name in the User Name field.

  3. Type your current password in the Current Password field.

  4. Type the new password you would like to use in the new password field.

  5. Confirm that you have typed the new password correctly by typing it in the Confirm New Password field.

  6. Click the Change Password button.

ProcedureHow to Change a User's Password from the User Account's Details Page

You can change anyone's password under the following conditions.

If you don't have user and group permissions, see How to Change Your Password From the Log In Page.

This procedure describes how to change a user's password by using the browser interface. You can also change passwords by using the following command.

For a detailed description of these commands, see udb.g: Managing User Groups in N1 Grid Service Provisioning System 5.0 Command-Line Interface Reference Manual.

Note –

When you change the password on a user account and the user account has session variables encrypted by the user account's old password, the user is prompted to clear or restore the session variables the next time the user logs in.

Before You Begin

To change the password of someone else's user account, you must belong to a user group that has write permissions on users and groups.

Steps

  1. Go to the Details page of the user account.

    See How to View User Accounts.

  2. Type the new password in the New Password field.

  3. Confirm the new password by typing it in the Confirm New Password field.

  4. Click Save.

ProcedureHow to Change a User's Authentication Method

This procedure describes how to change a user's authentication method by using the browser interface. You can also change authentication methods by using the following command.

Note –

When you change a user's authentication method and the user account has session variables encrypted by the user account's old password, the user is prompted to clear or restore the session variables the next time the user logs in.

Before You Begin

Before you can change the authentication method of a user account, the new authentication method must be configured with the provisioning system. See Appendix A, Authentication Methods.

To change a user's authentication method, you must belong to a user group that has write permissions on users and groups.

Note –

You cannot change the authentication method of the admin user. The admin user must always be set to internal authentication.

Steps

  1. Go to the Details page of the user account.

    See How to View User Accounts.

  2. From the Authentication Method menu, select the new authentication method.

  3. If you change the user from an external to an internal authentication method, you must supply the user a new password.

  4. Click Save.