Role-Based Administration

You can use Novell ConsoleOne, a directory-enabled framework for running Novell network administration utilities. The Novell ZENworks Server Management snap-ins to Novell ConsoleOne fully leverage Novell eDirectory to enable role-based administration and higher levels of security. Through Novell eDirectory, users will be able to log in once and have access to the management components as specified by their roles within their specific scope.

The Server Management snap-ins to Novell ConsoleOne allows you to divide the task of network administration amongst administrators. With Novell ConsoleOne, the functions and tasks of Server Management are organized into different, customized "views" based on each administrator's role in your organization.

The following sections discuss role-based administration:


Novell ZENworks Management Site

The Novell ZENworks management site sets boundaries for accessing object data on the management server through the role-based services. You can create roles and tasks and further define the level of access to network objects and information from the network container space.

When you install Management and Monitoring Services, a management site, a system administrator role (Role-based Services Admin), and all the site objects are created in Novell eDirectory. A management site defines the scope of objects (networks, segments, routers, bridges, switches, servers, workstations, and so on) discovered on your network. You can create a single site or multiple sites, depending on the size of your network or network management requirements. A management site could include a single local network configuration or could encompass your entire network. The boundaries of a site are defined by the scope of network discovery. By default, network discovery is set to discover all connected networks and network nodes. The site object is created in the same context as the server object.

During installation, the default management site that is created is shown below. A single administration role is established with rights and permissions to all configuration and management tasks in the management system.


A default Novell ZENworks Server Management site

Some default roles that monitor network traffic, handle alarms, and manage server systems, are available and allow you to add users. You can also use them as examples for your new role creations.

In the Server Management role-based services (Role-based Services), permissions that are required to access network objects, configurations, and information are associated with roles. Novell eDirectory User objects can be assigned to appropriate roles. The levels of abstractions in a role are described below:

The users added to a role, however, retain the access rights, permissions, and policies granted through the Novell eDirectory user account. For example, a user may be granted permission to access and configure a server through Novell eDirectory, but may not be granted permission to manage the server through the Role-based Services in Server Management. Therefore the management role that the user is assigned has limited access to the management services or components/modules in the Novell ZENworks Server Management system.


General Novell ZENworks Server Management Roles

Novell ZENworks Server Management components support role-based services (Role-based Services) and task management through Novell eDirectory. Server Management uses Role-based Services to organize Novell ZENworks Server Management tasks into roles and to assign scope information to a role, user or a group.

Role-based Services roles specify the tasks that users are authorized to perform. Defining an Role-based Services role includes creating an Role-based Services role object and specifying the tasks that the role can perform.

The tasks that Role-based Services roles can perform are displayed as Role-based Services Task objects in your Novell eDirectory tree. These objects are organized into one or more Role-based Services modules, which are containers that correspond to the different Server Management components. As shown in the figure below, Novell ZENworks Server Management provides predefined modules and Role-based Services role objects.

IMPORTANT:  You cannot create new modules or tasks. You have to select from the pre-defined modules and tasks that are available.


A list of predefined Novell ZENworks Server Management modules and Role-based Services role objects

You can create any role using the modules and tasks. Each module can have one or more tasks. For example, Role-based Services defines the task for Monitoring Services as Enable Remote Ping. If this task is assigned to your role, you can use the Monitoring Services facility. For a list of the predefined Novell ZENworks Server Management modules and roles along with the associated tasks, see Novell ZENworks Server Management Role-Based Modules and Roles.

For more information on creating role objects using tasks and modules, see Configuring Role-Based Administration.


Novell ZENworks Server Management Role-Based Modules and Roles

This section provides the following tables:


Configuring Role-Based Administration

Defining an Role-based Services role includes creating an Role-based Services role object and specifying the tasks that the role can perform.

The following sections discuss how to configure Role- Based Administration:


Defining Role-based Services Role

Role-based Services roles specify the tasks that users are authorized to perform in specific administration applications. Defining an Role-based Services role includes the following sections:


Creating an Role-based Services Role Object

To create an Role-based Services role object:

  1. In Novell ConsoleOne, right-click the container that you want to create the Role-based Services role object, then click New > Object.

  2. Under Class, select Role-based Services:Role, then click OK.

  3. Enter a name for the new Role-based Services role object.

    Ensure to follow proper Novell eDirectory naming conventions. For Novell eDirectory naming conventions see Novell eDirectory Administration Guide.

    Example: Password Administrator Role.

  4. Click OK.


Specifying the Tasks that Role-based Services Roles Can Perform

To specify the tasks:

  1. In Novell ConsoleOne, right-click an Role-based Services role, then click Properties.

    Role-based Services task objects are located only in Role-based Services module containers

  2. In the Role Based Services tab, make the associations you want.

  3. Select the Role Content page > Add the list of tasks that the role can perform.

  4. Click OK.


Creating an External Scope

To create an external scope:

  1. In Novell ConsoleOne, right-click the container that you want to create the scope object, then click New > Object.

  2. Under Class, select MW:Scope, then click OK.

  3. Enter a name for the new MW:Scope object.

    Ensure to follow proper Novell eDirectory naming conventions. For Novell eDirectory naming conventions see Novell eDirectory Administration Guide.

    Example: Password Administrator Role.

  4. Click OK.


Configuring a Scope Object

To configure a scope object:

  1. In Novell ConsoleOne, right-click the scope object, then click Properties.

  2. Browse the site object to which the scope is associated.

  3. In the Site scope browse to select the computers to the site scope.

  4. In the SQL script specify the scope by selecting the object and the operator from the drop-down list.

  5. Click OK.

IMPORTANT:  By default the scope object will have all-site access.

The effective scope will be a union of Site scope and the objects specified in SQL script.


Assigning Role-based Services Role Membership and Scope

To assign an Role-based Services role and scope to a user:

  1. In Novell ConsoleOne, right-click the user object to which you want to assign the role and scope, then click Properties.

  2. Click Role Based Services Tab, then Assigned Roles.

  3. Click Add to add the required role to the user.

  4. Click Scope to add the scope for the user.

  5. Click OK.

IMPORTANT:  If a user is assigned two different roles with different scopes, the user has rights to all the tasks (union of tasks in role1 and tasks in role2) irrespective of the scopes.

You cannot assign role and scope to User groups and Organization Unit.