Expert Reference Series of White Papers Role-Based Access Control in Avaya Aura System Manager 6.2 1-800-COURSES www.globalknowledge.com
Role-Based Access Control in Avaya Aura System Manager 6.2 Jose Gaona, Global Knowledge Principal Instructor Introduction Before describing the process of creating a role and how to assign this new role to a user, let s pause for a minute and review the concepts and functionality of Avaya Aura System Manager. Avaya Aura System Manager provides centralized administration for multiple instances of Avaya Aura Session Manager and Avaya Aura Communication Manager. It is also designed to manage all Avaya Aura components present and future and all Third-Party Supported Applications and Services. Avaya Aura System Manager Avaya Aura System Manager centralizes provisioning, maintenance, and troubleshooting to simplify and reduce management complexity and solution servicing, and it delivers a set of management services that you can access using the System Manager common console. Upon Initial Installation, Avaya Aura System Manager requires a first-time login using the admin account. The default password for accessing the System Manager common console is admin123. The account name remains the same, but the password must be changed on the initial login. The admin account is already created within System Manager and is already associated by default with the System Administrator Role, which is one of the out-of-the box default roles and gives the admin total access to any user, application/element, or Network Service available via the System Manager main screen, also referred to as the Dash Board. A customer may choose to continue to use this account and password to subsequently administer any and all Elements and Network Services available via the System Manager Dash Board. However, this may not necessarily be the best practice due to the level of access given to this account. Typically a small customer with one or two administrators may use the admin account; but, as the company grows, the number of users, applications, and services grow along with it. It may be necessary to create additional users with different levels of access and permissions. To accomplish this, we assign the user to one of the existing default roles that provides the level of access and permissions needed, or we can create a new custom role with the specific settings for the user. When you login using the admin account you already have, among other privileges, the ability to create Roles. You do not have to create a custom role for every new administrator. It is possible to assign the same role to multiple users. Copyright 2013 Global Knowledge Training LLC. All rights reserved. 2
It is also possible to assign multiple roles to the same user which provides you with a great level of flexibility. Let s say, for example, that you have a right hand person with a high degree of responsibilities, but he also has a large number of subordinates. Instead of creating a powerful role for this user, you could create several roles, assign all roles to this user and then reassign one or several of these roles to his subordinates without giving them the same level of access as your right hand person. Now that you have an understanding of Avaya Aura System Manager and its relation to other products on the network, let s explore the steps required for the creation of a new role. Creating a New Role Creating a new role can be summarized in the next 5 steps. Keep in mind we will discuss these steps in more detail later. 1. Give the new role a name and a description. The name should be in accordance with the resources and/or network services accessible via its permissions (e.g., CM administrator, User Administration etc.). 2. Add mapping. Mapping relates to the inclusion of Elements and Network services accessible via the role. There is no limit on what Elements and Network Services can be mapped to a role. However, you can t access an Element if the Element is not being managed by System Manager. For example, if an instance of Communication Manager is present on your Enterprise, but it is not a Managed Element of System Manager. 3. Assign actions. Actions define what a role can perform to an attributes. Examples of actions are: view, edit, delete, etc. 4. Define attributes. Attributes are fields of data associated with an Element or Network Service. For example, a role is mapped to users as a resource; the action is only to edit, and the attribute is first name. As a result, an administrator assigned to this role would be able to access all users, but only be able to edit the user s first name and nothing else. 5. Commit the new role. Once committed, the new role will appear on the list of roles, but it has not yet been assigned to a user. Copyright 2013 Global Knowledge Training LLC. All rights reserved. 3
The degree of detail assigned to a role depends on the customer s criteria regarding the level of access and permissions. 1. To initiate the role creation process, you must first login using the admin account. If this is the first time using the admin account, you must change the default password. Login Change Password First admin admin123 Warning. You must change password before logging in for the first time! 2012 Avaya, Inc. All rights reserved, Page 7 After successful login, the System Manager Dash Board will appear. System Manager Navigation: The SMGR Home Page User tasks Network element tasks General services Current log on info Context sensitive help Task oriented panels 2012 Avaya, Inc. All rights reserved, Page 11 Copyright 2013 Global Knowledge Training LLC. All rights reserved. 4
Go to the Users-oriented panel/groups and Roles/Roles. The role screen will display a list of all the outof-the-box roles and any customized roles previously created. SMGR Roles: Out-of-the-Box Roles The System Administrator role is an outof-the-box role. It has permission (keys) to almost all SMGR resources, operations and groups 2012 Avaya, Inc. All rights reserved, Page 26 Select New, and then Add and provide a name and a description appropriate with the permissions associated with the role. SMGR Roles: Custom Roles We can create custom roles that provide permissions to specific resources, operations and groups. 2012 Avaya, Inc. All rights reserved, Page 27 Copyright 2013 Global Knowledge Training LLC. All rights reserved. 5
2. Click on Add Mapping to determine Elements and Network Services accessible via this Role Elements and Network Services The Elements / Services Categories are organised in to 4 subsets: All Elements by Type Individual Element by name Network Services Individual Resource by name Here is another example of the mapping screen. 2012 Avaya, Inc. All rights reserved, Page 36 3. Select Actions. Now that the Elements and Network Services that will be accessible via this role have been defined by mapping, the next step is to determine what can be done with the attributes. Permissions to Take Action and Change Attributes An Action determines what can be done with the Attribute i.e. permissions to View Edit Delete, etc An Attribute maps directly to a field of data EG. A user s Last Name Selecting ALL has the effect of permitting the selected Actions on all attributes. 2012 Avaya, Inc. All rights reserved, Page 63 Copyright 2013 Global Knowledge Training LLC. All rights reserved. 6
4. Select Attributes. Attributes allow you to define the capabilities of a role even further by selecting the exact attributes (fields of data) the role can access. Not all resource types have attributes (e.g., operations). Attributes are selected on the same screen as actions. Permissions to Take Action and Change Attributes An Action determines what can be done with the Attribute i.e. permissions to View Edit Delete, etc An Attribute maps directly to a field of data EG. A user s Last Name Selecting ALL has the effect of permitting the selected Actions on all attributes. 2012 Avaya, Inc. All rights reserved, Page 63 5. Commit. Once the name, resource mapping, actions, and attributes have been configured, the last step is to commit. This will automatically add the new role to the list of existing roles, but it is not assigned to a user yet. Note: It is also possible to copy an existing role and then modify the copy. This will simplify the creation of new roles if the required criteria of a new role is similar to an existing role. Copyright 2013 Global Knowledge Training LLC. All rights reserved. 7
SMGR Roles: Out-of-the-Box Roles The System Administrator role is an outof-the-box role. It has permission (keys) to almost all SMGR resources, operations and groups 2012 Avaya, Inc. All rights reserved, Page 26 Assign a Role to a User To assign a role to a user you must login to System Manager, navigate to User Management > Manage, select the user you wish to assign the role, select Tab Membership and assign the role. The last step is to Commit the new role. Users: Roles & Groups Membership Tab Roles End User Groups System Administrator Mostly for Administration: Roles determine which SMGR resources a user can access (typically an administrator user) Groups are for organising resources (including users) into subset groups. Need to understand Resources and Operations in order to understand Roles coming next 2012 Avaya, Inc. All rights reserved, Page 22 Copyright 2013 Global Knowledge Training LLC. All rights reserved. 8
Now logout from the admin account and proceed to login with the new account. You will notice, based upon the permissions, some of the links may appear in a gray color. This indicates those areas of the System Manager dash board you do not have access to via this particular new Role. System Manager Navigation: The SMGR Home Page User tasks Network element tasks General services Current log on info Context sensitive help Task oriented panels 2012 Avaya, Inc. All rights reserved, Page 11 With the ability to successfully login to System Manager, you have access to the following. System Manager Tools Common Console. A browser-based console that provides a central access point for accessing all management needs: user administration, network routing policy, monitoring, security, etc. User Administration. Provides a single interface for provisioning users on Avaya Aura Session Manager, Avaya Aura Communication Manager, and Avaya Modular Messaging currently, and Presence Services and other Avaya Aura components in the future. Dial Plan Administration. Central administration of enterprise-wide dial plans across multi-vendor PBX environments. Phone number adaptations can be uniquely created for each location or PBX supporting up to 24 digits. Network Routing. Create system-wide dialing rules to cost-effectively route calls using the enterprise s on-net IP network including: - Enterprise-wide least cost routing - Enterprise-wide time of day routing - Tail end hop off - Toll avoidance Network Routing Verification Tool. In support of network routing, Avaya Aura System Manager provides a flexible and powerful tool to test complex routing rules with easy-to-read output. Copyright 2013 Global Knowledge Training LLC. All rights reserved. 9
Event and Fault Management:. A platform for centralized logs and alarms, helping ensure that all the supported entities in the network can contribute to a single, central repository for viewing items for the enterprise. System Manager Benefits Single Point of Management. End-to-end view, single unified console with workflow-based management. Less Complexity. Reduces complexity of operations for distributed multi-site networks with multiple control points. Better Data Consistency. Integrated provisioning to reduce configuration errors. Faster Deployment. Accelerate application integration with standards-based interfaces. Lower Total Cost of Ownership (TCO). Reduces TCO and service support costs through automation of time-consuming, error-prone tasks. Less Training. Better skill set re-use and increased productivity through easy-to-use tools. More Value. Increases the value of convergence through tight integration with the enterprise IT infrastructure (identity, security, directory, single sign on). Conclusion Now that we have explored the steps necessary to create new roles and how to assign them to users, you should understand the benefits and flexibility of Avaya Aura System Manager coupled with the level of security it provides. System Manager Role Based Access Control (RBAC) offers an extensive level of granularity that allows you to configure as many as 250 administrators, 50 of which can login simultaneously allowing for efficient and controlled administration of all Elements and Network Services within your Enterprise. Learn More To learn more about how you can improve productivity, enhance efficiency, and sharpen your competitive edge, Global Knowledge suggests the following courses: System Manager Administration (R6.1) (5U00080) Session Manager and System Manager Administration Boot Camp (R6.1) (5U00082) Session Manager Administration (R6.1) (5U00081) Avaya Aura System Manager Implementation, Administration, Maintenance, and Troubleshooting (R6.2) (5U00095) Avaya Aura Session Manager Implementation, Administration, Maintenance, and Troubleshooting (R6.2) (5U00096) Avaya Aura Session and System Manager Implementation, Administration, Maintenance, and Troubleshooting (R6.2) (5U00097) CS 1000 Upgrade and Avaya Aura Integration Boot Camp (9U00166I) Copyright 2013 Global Knowledge Training LLC. All rights reserved. 10
Visit www.globalknowledge.com or call 1-800-COURSES (1-800-268-7737) to speak with a Global Knowledge training advisor. About the Author Jose Gaona has been in Telecommunications for 32 years. He has been a Principal Technical Instructor for Global Knowledge since 1989. He has held positions as Field Engineer and Marketing Manager for the Latin America and Caribbean regions. His trajectory dates back to the days of TDM Telephony and his experience has evolved with new Technologies such as VOIP and ancillary Applications such as Voice Messaging, PSTN gateways and many other applications. Jose is certified on the products associated with the courses he teaches. Copyright 2013 Global Knowledge Training LLC. All rights reserved. 11