Role-Based Access Control (RBAC)

Overview
RBAC Concepts
   Authentication
   Role
   Authorization
   Rights Profile
Sun Cluster RBAC Rights Profiles

Actions
Setting Up and Using RBAC
Specifying a Role When You Log In to SunPlex Manager
Changing a Role


RBAC Concepts

Authentication

The ability to securely identify a user, a user's name, and some form of proof of the user's identity (typically a password). The process of specifying a client's user identity to the cluster, and then demonstrating that that client really is that particular user by specifying that user's credentials.

Role

A special identity for running privileged applications that only assigned users can assume.

Authorization

A permission that can be assigned to a role or user (or embedded in a rights profile) for performing a class of actions that are otherwise prohibited by security policy. A privileged application can check a user's authorizations before that application grants access to specific features or functionality. The auth_attr(4) man page contains additional information.

Rights Profile

A collection of authorizations, profiles, and permitted commands (referred to as security attributes), and other rights profiles that are assigned to a user or to a role identity.

You can grant permissions to a user, or role identity, that allow that user to access and modify cluster parameters. You grant these permissions by using the Rights tool in the Solaris Management Console User tool. The granting of permissions to a user is described in "Creating or Changing a Rights Profile" in System Administration Guide: Security Services. The prof_attr(4) man page contains additional information.

Return to top


Sun Cluster RBAC Rights Profiles

SunPlexTM Manager and selected SunTM Cluster commands use RBAC for authentication. Several RBAC rights profiles are included in the Sun Cluster software. You can assign these rights profiles to users or to roles to give users different levels of access to Sun Cluster. Sun provides the following rights profiles with Sun Cluster software.

Rights Profile Includes Authorizations This Authorization Permits the Role Identity to

Basic Solaris User

This existing Solaris rights profile contains Solaris authorizations, as well as:

Perform the same operations that the Basic Solaris User role identity can perform, as well as:

solaris.cluster.device.read

Read information about device groups

solaris.cluster.gui

Access SunPlex Manager. The authenticated user must also have read authorizations for one or more cluster objects to view cluster information through SunPlex Manager.

solaris.cluster.network.read

Read information about IP Network Multipathing

Note: This authorization does not apply to SunPlex Manager.

solaris.cluster.node.read

Read information about attributes of nodes

solaris.cluster.quorum.read

Read information about quorum devices and the quorum state

solaris.cluster.resource.read

Read information about resources and resource groups

solaris.cluster.system.read

Read the status of the cluster

solaris.cluster.transport.read

Read information about transports

Cluster Operation

solaris.cluster.appinstall

Install clustered applications

solaris.cluster.device.admin

Perform administrative tasks on device group attributes

solaris.cluster.device.read

Read information about device groups

solaris.cluster.gui

Access SunPlex Manager. The authenticated user must also have read authorizations for one or more cluster objects to view cluster information through SunPlex Manager.

solaris.cluster.install

Install clustering software

Note: This authorization does not apply to SunPlex Manager.

solaris.cluster.network.admin

Perform administrative tasks on IP Network Multipathing attributes

Note: This authorization does not apply to SunPlex Manager.

solaris.cluster.network.read

Read information about IP Network Multipathing

Note: This authorization does not apply to SunPlex Manager.

solaris.cluster.node.admin

Perform administrative tasks on node attributes

solaris.cluster.node.read

Read information about attributes of nodes

solaris.cluster.quorum.admin

Perform administrative tasks on quorum devices and quorum state attributes

solaris.cluster.quorum.read

Read information about quorum devices and the quorum state

solaris.cluster.resource.admin

Perform administrative tasks on resource attributes and resource group attributes

solaris.cluster.resource.read

Read information about resources and resource groups

solaris.cluster.system.admin

Administer the system

Note: This authorization does not apply to SunPlex Manager.

solaris.cluster.system.read

Read the status of the cluster

solaris.cluster.transport.admin

Perform administrative tasks on transport attributes

solaris.cluster.transport.read

Read information about transports

System Administrator

This existing Solaris rights profile contains the same authorizations that the Cluster Management profile contains.

Perform the same operations that the Cluster Management role identity can perform, in addition to other system administration operations.

Cluster Management

This rights profile contains the same authorizations that the Cluster Operation profile contains, as well as the following authorizations:

Perform the same operations that the Cluster Operation role identity can perform, as well as:

solaris.cluster.device.modify

Modify device group attributes

solaris.cluster.network.modify

Modify IP Network Multipathing attributes

Note: This authorization does not apply to SunPlex Manager.

solaris.cluster.node.modify

Modify node attributes

Note: This authorization does not apply to SunPlex Manager.

solaris.cluster.quorum.modify

Modify quorum devices and quorum state attributes

solaris.cluster.resource.modify

Modify resource attributes and resource group attributes

solaris.cluster.system.modify

Modify system attributes

Note: This authorization does not apply to SunPlex Manager.

solaris.cluster.transport.modify

Modify transport attributes

Sun Cluster Commands

None, but includes a list of Sun Cluster commands that run with euid=0

Execute selected Sun Cluster commands that you use to configure and manage a cluster, including:

scgdevs(1M)

scswitch(1M) (selected options)

scha_control(1HA)

scha_resource_get(1HA)

scha_resource_setstatus(1HA)

scha_resourcegroup_get(1HA)

scha_resourcetype_get(1HA)

Return to top


Setting Up and Using RBAC

Use the following table to determine the documentation to consult about setting up and using RBAC.

To Refer to
Learn more about RBAC "Role-Based Access Control (Overview)" in Solaris System Administration Guide: Security Services
Set up, manage elements of, and use RBAC with Sun Cluster "Role-Based Access Control (Tasks)" in Solaris System Administration Guide: Security Services

"Sun Cluster and RBAC" in Sun Cluster System Administration Guide

Learn more about RBAC elements and tools "Role-Based Access Control (Reference)" in Solaris System Administration Guide: Security Services

Return to top


Specifying a Role When You Log In to SunPlex Manager

To specify a role or no role when you log in to SunPlex Manager, complete the following steps.

  1. Ensure that you possess the solaris.cluster.gui authorization.

    If you do not possess this authorization, you are not allowed to log in to SunPlex Manager.

  2. On the SunPlex Manager Log In page, in the User Name and Password fields, type your user name and password.

    Example of the SunPlex Manager Log In page, with user name and password shown

  3. Click Log In.

    If a role is assigned to your user account, the Log In With Roles page appears.

    Example of the SunPlex Manager Log In With Roles page

    Otherwise, the SunPlex Manager workspace appears.

  4. Do you want to log in under a role or as yourself?

    • To log in as a role, choose the role that you want from the Role Name pull down menu, type the password for that role in the Role Password field, and click Log In.

    • To log in as yourself, choose No role from the Role Name pull down menu and click Log In.

    If you selected a role name and that role name or its associated role password is not successfully authenticated, the Role Authentication Failed warning appears on the Log In With Roles page.

    Role Authentication Failed warning displayed on Log In With Roles page

    If this warning appears, specify another role name or role password.

    If you selected a role name, and the role name and role password are successfully authenticated, SunPlex Manager logs you in under that role. SunPlex Manager logs you in with the privileges that are associated with that role. The privileges that are associated with your user account are no longer available.

    If you selected No role, SunPlex Manager logs you in under your user name with the privileges that are associated with your user account.

    After you log in successfully, the SunPlex Manager workspace appears.

    Example of the SunPlex Manager workspace

    The view of the cluster that you see is based on your authorized access.


Changing a Role

To change a role while you are using SunPlex Manager, complete the following steps.
  1. In the upper right corner of the SunPlex Manager workspace, click Log Out.

    SunPlex Manager exits.

  2. Restart SunPlex Manager.

  3. Follow the steps in Specifying a Role When You Log In to SunPlex Manager to log in to SunPlex Manager under the new role.

Return to top