Roles
Roles is a standard configuration interface for the permissions that user groups use when accessing the UI. Multiple user groups can use the same role.
For conceptual information about roles, user groups, users, and permissions see the following topics in Unified Assurance Security Guide:
For information about interacting with the grid and form, see Standard Configuration Interface in Unified Assurance Concepts.
This user interface calls REST methods from the api/AAA/roles endpoints. See REST API for Unified Assurance Core for details.
To open this interface, from the main navigation menu, select Configuration, then AAA, and then Roles.
Form Fields
-
Name: The name of the role. The configured role names are visible when configuring user groups.
-
Description: The description of the role.
-
Permissions: Selection groups for the available ACLs that control access to the different sections of Unified Assurance.
Best Practices
-
When creating a new role, ensure it has the correct permissions for each section in Unified Assurance. Proper role creation is required in a multitenant environment.
-
When assigning a permission to a role, always enable the Read flag of that permission. Without this flag enabled, members of groups assigned to this role will be unable to access the configured secure area of the application.
Default Roles
-
Administrator: This role has all read, create, update, delete, and execute permissions for every secured area of the application.
-
Anonymous: This role has login ability, but no read, create, update, delete, or execute privileges to any secured area of the application.
-
API: This role is intended to provide read, create, update, and execute access for applications which act as a user to call the Unified Assurance API. This role also has delete permissions for some areas of the application.
-
Operator: This role has read access to every secured area of the application except UserProfiles and GlobalProperties.
-
Publisher: This role is intended to provide limited read and write access to User Groups, Users, Queries, Files, TL1 Gateways, TL1 Gateway Elements, Graph Vertices, Dashboards, Reports, Event Displays, Event Filters, SLM Services, SLM Events, and SLM Metrics. For entities configured with viewers, use this role for delegated users who need to share records with user groups outside their own visible user group hierarchy without granting them SUPER administrative permission. See Publisher Role for Multi-Tenant Sharing in Unified Assurance Security Guide.
Global Permissions
These permissions override or extend configured security options for objects within the application. SUPER grants unrestricted access to read and edit application objects regardless of configured ownership or viewer settings. PUBLISHER allows delegated users to edit access permissions for application objects, such as reports and files, and to view and select users and user groups when setting ownership and viewer access, including groups outside their own visible user group hierarchy.
-
PUBLISHER: The ability to edit access permissions for application objects, such as dashboards, event filters, reports, files, and other viewer-enabled records. Use this permission when a delegated user needs to publish records to groups outside their own visible user group hierarchy.
-
SUPER: The ability to read and edit everything in the application.
Navigation Permissions
You use navigation permissions to control which components and menus appear in the navigation bar for the different user groups.
To show the Bookmarks and Configuration menus, add the Read permission for them under the navigation package. Other permissions under other packages control access to the Configuration submenus and options.
To show other components, add them under their respective componentNameNavigation package. For example:
-
Under analyticsNavigation, add Analytics to show the Analytics menu.
- To show submenus, add Admin, Operator, or Viewer permissions under the eventAnalytics, metricAnalytics, flowAnalytics and vision packages.
-
Under eventNavigation, add Events to show the Events component.
-
Under SLMNavigation, add NavServices to show the Services component.