HP 6125XLG R2306-HP 6125XLG Blade Switch Fundamentals Configuration Guide - Page 49

Configuring RBAC, Overview, Permission assignment, User role rules

Get HP 6125XLG PDF manuals and user guides View all HP 6125XLG manuals
Add to My Manuals
Save this manual to your list of manuals

Page 49 highlights

Configuring RBAC Role based access control (RBAC) controls user access to commands and resources based on user role. This chapter describes the basic idea of RBAC and guides you through the RBAC configuration procedure. Overview On devices that support multiple users, RBAC is used to assign command and resource access permissions to user roles that are created for different job functions. Users are given permission to access a set of commands and resources based on their user roles. Because user roles are persistent, in contrast to users, separating permissions from users enables easy permission authorization management. When the job responsibilities of a user changes, new users are added, or old users are removed, you only need to change the user roles or assign new user roles. Permission assignment Assigning permissions to a user role includes the following: • Define a set of rules to specify commands accessible or inaccessible to the user role. (See "User role rules.") • Configure resource access policies to specify which interfaces, VLANs, and VPNs are accessible to the user role. (See "Resource access policies.") To use a command related to a specific interface, VLAN, or VPN, a user role must have access to both the command and the interface, VLAN, or VPN. For example, a user role has access to the qos apply policy command and access to only interface Ten-GigabitEthernet 1/1/5. With this user role, you can enter the interface view and use the qos apply policy command on the interface, but you cannot enter the view of any other interface or use the command on any other interface. If the user role has access to any interface but does not have access to the qos apply policy command, you cannot use the command on any interface. User role rules User role rules permit or deny access to commands. You can define the following types of rules for different access control granularities: • Command rule-Controls access to a command or a set of commands that match a regular expression. • Feature rule-Controls access to the commands of a feature by command type: { Read-Commands that display configuration and maintenance information. Examples include the display commands and the dir command. { Write-Commands that configure the feature in the system. Examples include the info-center enable command and the debugging command. { Execute-Commands that execute specific functions. Examples include the ping command and the ftp command. • Feature group rule-Controls access to commands of a group of features by command type. 42

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
42
Configuring RBAC
Role based access control (RBAC) controls user access to commands and resources based on user role.
This chapter describes the basic idea of RBAC and guides you through the RBAC configuration
procedure.
Overview
On devices that support multiple users, RBAC is used to assign command and resource access
permissions to user roles that are created for different job functions. Users are given permission to access
a set of commands and resources based on their user roles. Because user roles are persistent, in contrast
to users, separating permissions from users enables easy permission authorization management. When
the job responsibilities of a user changes, new users are added, or old users are removed, you only need
to change the user roles or assign new user roles.
Permission assignment
Assigning permissions to a user role includes the following:
•
Define a set of rules to specify commands accessible or inaccessible to the user role. (See "
User role
rules
.")
•
Configure resource access policies to specify which interfaces, VLANs, and VPNs are accessible to
the user role. (See "
Resource access policies
.")
To use a command related to a specific interface, VLAN, or VPN, a user role must have access to both
the command and the interface, VLAN, or VPN.
For example, a user role has access to the
qos apply policy
command and access to only interface
Ten-GigabitEthernet 1/1/5. With this user role, you can enter the interface view and use the
qos apply
policy
command on the interface, but you cannot enter the view of any other interface or use the
command on any other interface. If the user role has access to any interface but does not have access to
the
qos apply policy
command, you cannot use the command on any interface.
User role rules
User role rules permit or deny access to commands. You can define the following types of rules for
different access control granularities:
•
Command rule
—Controls access to a command or a set of commands that match a regular
expression.
•
Feature rule
—Controls access to the commands of a feature by command type:
{
Read
—Commands that display configuration and maintenance information. Examples include
the
display
commands and the
dir
command.
{
Write
—Commands that configure the feature in the system. Examples include the
info-center
enable
command and the
debugging
command.
{
Execute
—Commands that execute specific functions. Examples include the
ping
command and
the
ftp
command.
•
Feature group rule
—
Controls access to commands of a group of features by command type.