HP 3PAR StoreServ 7450 4-node HP 3PAR StoreServ Storage Concepts Guide (OS 3.1 - Page 23

Authorization on Systems Using Virtual Domains, Managing User Accounts and Connections

Get HP 3PAR StoreServ 7450 4-node PDF manuals and user guides View all HP 3PAR StoreServ 7450 4-node manuals
Add to My Manuals
Save this manual to your list of manuals

Page 23 highlights

Each group to which a user is a member is compared against the mapping parameters. Mapping occurs sequentially with a group first compared to the super-map parameter. If no match is made, the group is then compared with the service-map parameter, and so on. For example, if a match is made for group A with the super-map parameter, the user belonging to group A is authorized with Super rights to the system. With this process, a user can be authenticated, but not authorized if no group membership exists. In this case, the user is subsequently denied access to the system. Authorization on Systems Using Virtual Domains As discussed in "Authorization" (page 22), a user's group association determines that user's role within the system. On systems using virtual domains, this process is taken one step further where the user's groups are mapped to system domains. Therefore, the user's role within a specific group is carried over to the domain(s) mapped to that group. For instructions on authorizing LDAP users on systems using Domains, see Chapter 4, Managing User Accounts and Connections in the HP 3PAR OS CLI Administrator's Manual. The group-to-domain mapping relationship: • LDAP User 1 has membership to Group B. • Group-to-role mapping determines that Group B uses the Edit role. • Group-to-domain mapping establishes a match between Group B and Domain A. • LDAP User 1 has Edit role access to all objects in Domain A. LDAP Authentication and Authorization 23

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
Each group to which a user is a member is compared against the mapping parameters. Mapping
occurs sequentially with a group first compared to the
super-map
parameter. If no match is made,
the group is then compared with the
service-map
parameter, and so on. For example, if a match
is made for group A with the
super-map
parameter, the user belonging to group A is authorized
with Super rights to the system.
With this process, a user can be authenticated, but not authorized if no group membership exists.
In this case, the user is subsequently denied access to the system.
Authorization on Systems Using Virtual Domains
As discussed in
“Authorization” (page 22)
, a user’s group association determines that user’s role
within the system. On systems using virtual domains, this process is taken one step further where
the user’s groups are mapped to system domains. Therefore, the user’s role within a specific group
is carried over to the domain(s) mapped to that group. For instructions on authorizing LDAP users
on systems using Domains, see Chapter 4,
Managing User Accounts and Connections
in the
HP
3PAR OS CLI Administrator’s Manual
.
The group-to-domain mapping relationship:
•
LDAP User 1
has membership to
Group B
.
•
Group-to-role mapping determines that
Group B
uses the Edit role.
•
Group-to-domain mapping establishes a match between
Group B
and
Domain A
.
•
LDAP User 1
has Edit role access to all objects in
Domain A
.
LDAP Authentication and Authorization
23