Allowing Multiple Administrators

Multiple administrators can change specific parts of the server through distributed administration. A directory server must be installed before distributed administration can be enabled. The default directory service must be LDAP-based.

The two levels of users for distributed administration are superuser and administrator.

• Superuser is the user listed in server-root/proxy-admserv/config/admpw. This is the user name and password specified during installation. This user has full access to all forms in the Administration Server except the Users and Groups forms, the access for which depends on the superuser having a valid account in an LDAP server.

• Administrators go directly to the Server Manager forms for a specific server, including the Administration Server. The forms they see depend on the access control rules configured for them, usually by the superuser. Administrators can perform limited administrative tasks and also make changes that affect other users, such as adding users or changing access control.

For more information about access control, see Chapter 8, Controlling Access to Your Server.

To Enable Distributed Administration

1. Verify that a directory server is installed.

2. Access the Administration Server.

3. (Optional) After a directory server has been installed, you might also need to create an administration group if you have not already done so. To create a group:

   1. Click the Users and Groups tab.

   2. Click the Create Group link.

   3. Create an administrators group in the LDAP directory, and add the names of the users to whom you are granting permission to configure the Administration Server or any of the servers installed in its server root.

      For more information about specific fields, see the online Help.

      All users in the administrators group have full access to the Administration Server, but access control can be used to limit the servers and forms they are allowed to configure.

      Once an access control list is created, the distributed administration group is added to that list. If the name of the administrators group is changed, you must manually edit the access control list to change the group it references.

4. Click the Preferences tab.

5. Click the Configure Distributed Administration link.

6. Select Yes, specify the administrator group, and then click OK.