Contents
|
Roles
A Role is a Directory Server entry mechanism similar to the concept of a group. A group has members; a role has members. A role’s members are LDAP entries that possess the role. The criteria of the role itself is defined as an LDAP entry with attributes, identified by the Distinguished Name (DN) attribute of the entry. Directory Server has a number of different types of roles but Access Manager can manage only one of them: the managed role.
Access Manager uses roles to apply access control instructions. When first installed, Access Manager configures access control instructions (ACIs) that define administrator permissions. These ACIs are then designated in roles (such as Organization Admin Role and Organization Help Desk Admin Role) which, when assigned to a user, define the user’s access permissions.
Users can view their assigned roles only if the Display User’s Roles attribute is enabled in the Administration Service.
This section contains the following topics:
To Create a Static Role
A static role can be created without adding users at the point of the role’s creation. This gives you more control when adding specific users to a given role.
- Click New in the Navigation pane. The New Role template appears in the Data pane.
- Select Static Role and enter a name. Click Next.
- Enter a description of the role.
- Choose the role type from the Type menu.
The role can be either an Administrative role or a Service role. The role type is used by the console to determine and here to start the user in the Access Manager console. An administrative role notifies the console that the possessor of the role has administrative privileges; the service role notifies the console that the possessor is an end user.
- Choose a default set of permissions to apply to the role from the Access Permission menu.
The permissions provide access to entries within the organization. They are discussed in the section “Default Role Permissions (ACIs)” in Part 4 of the Access Manager Administration Guide. (The default permissions shown are in no particular order.)
Generally, the No Permissions ACI is assigned to Service roles, while Administrative roles are assigned any of the default ACIs.
- Click Finish.
The created role is displayed in the Navigation pane and status information about the role is displayed in the Data pane.
You can optionally configure the Display Options and Available Actions by selecting them in the View menu.
To Create a Filtered Role
A filtered role is a dynamic role created through the use of an LDAP filter. All users are funneled through the filter and assigned to the role at the time of the role’s creation. The filter looks for any attribute value pair (for example, ca=user*) in an entry and automatically assign the users that contain the attribute to the role.
- In the Navigation pane, go the organization where the role will be created.
- Choose Roles from the View menu.
A set of default roles are created when an organization is configured, and are displayed in the Navigation pane.
For descriptions of these roles, see “Dynamic Administrative Roles ACIs” in Part 4 of the Access Manager Administration Guide.
- Click New in the Navigation pane. The New Role template appears in the Data pane.
- Select Filtered Role and enter the name. Click Next.
- Enter a description for the role.
- Choose the role type from the Type menu.
The role can be either an Administrative role or a Service role. The role type is used by the console to determine and where to start the user in the Access Manager console. An administrative role notifies the console that the possessor of the role has administrative privileges; the service role notifies the console that the possessor is an end user.
- Choose a default set of permissions to apply to the role from the Access Permission menu.
The permissions provide access to entries within the organization. They are discussed in the section “Default Role Permissions (ACIs)” in Part 4 of the Access Manager Administration Guide. (The default permissions shown are in no particular order.)
Generally, the No Permissions ACI is assigned to Service roles, while Administrative roles are assigned any of the default ACIs.
- Enter the information for the search criteria. The fields are:
Match. Allows you to include an operator for any the fields you wish to include for the filter. ALL returns users for all specified fields. ANY returns users for any one of the specified fields.
First Name. Search for users by their first name.
User Status. Search for users by their status (active or inactive).
User ID. Search for a user by User ID.
Last Name. Search for users by their last name.
Full Name. Search for users by their full name.
Alternatively, you can select the Advanced button to define the filter attributes yourself. For example,
(&(uid=user1)(|(inetuserstatus=active)(!(inetuserstatus=*))))
If the filter is left blank, by default, the following role is created:
(objectclass = inetorgperson)
Click Reset to clear the filter properties, or click Cancel to cancel the role creation process.
- Click Finish to initiate the search based on the filter criteria. The users defined by the filter criteria are automatically assigned to the role.
You can optionally configure the Display Options and Available Actions by selecting them in the View menu.
To Delete a Role
- Navigate to the organization that contains the role to be deleted.
- Choose Organizations from the View menu in Identity Management and select the organization from the Navigation pane. The Location path displays the default top-level organization and chosen organization.
- Choose Roles from the View menu.
- Select the checkbox next to the name of the role.
- Click Delete.
To Add a Role to a Policy
Access Manager objects are added to a policy through the policy’s subject definition. When a policy is created or modified, organizations, roles, groups, and users can be defined as the subject in the policy’s Subject page. Once the subject is defined, the policy will be applied to the object.
Contents |