Users Guide

Scope-Based Access Control (SBAC) in OpenManage Enterprise
With the use of Role-Based Access Control (RBAC) feature, administrators can assign roles while creating users. Roles
determine their level of access to the appliance settings and device management features. Scope-based Access Control (SBAC)
is an extension of the RBAC feature that allows an administrator to restrict a Device Manager role to a subset of device groups
called scope.
While creating or updating a Device Manager (DM) user, administrators can assign scope to restrict operational access of DM to
one or more system groups, custom groups, and / or plugin groups.
Administrator and Viewer roles have unrestricted scope. That means they have operational access as specified by RBAC
privileges to all devices and groups entities.
Scope can be implemented as follows:
1. Create or Edit User
2. Assign DM role
3. Assign scope to restrict operational access
For more information about managing users, see Manage OpenManage Enterprise users on page 141.
When a Device Manager (DM) user with an assigned scope logs in, the DM can see and manage scoped devices only. Also,
the DM can see and manage entities such as jobs, firmware or configuration templates and baselines, alert policies, profiles and
so on associated with scoped devices, only if the DM owns the entity (DM has created that entity or is assigned ownership
of that entity). For more information about the entities a DM can create, see Role-Based Access Control (RBAC) privileges in
OpenManage Enterprise.
For example, by clicking Configuration > Templates, a DM user can view the default and custom templates owned by the DM
user. Also, the DM user can perform other tasks as privileged by RBAC on owned templates.
By clicking Configuration > Identity Pools, a DM user can see all the identities created by an administrator or the DM user.
The DM can also perform actions on those identities specified by RBAC privilege. However, the DM can only see the usage of
those identities that are associated to the devices under the DM's scope.
Similarly, by clicking Configuration > VLANs Pools, the DM can see all the VLANs created by the admin and export them. The
DM cannot perform any other operations. If the DM has a template, it can edit the template to use the VLAN networks, but it
cannot edit the VLAN network.
In OpenManage Enterprise, scope can be assigned while creating a local or importing AD/LDAP user. Scope assignment for
OIDC users can be done only on Open ID Connect (OIDC) providers.
SBAC for Local users:
While creating or editing a local user with DM role, admin can select one or more device groups that defines the scope for the
DM.
For example, you (as an administrator) create a DM user named dm1 and assign group g1 present under custom groups. Then
dm1 will have operational access to all devices in g1 only. The user dm1 will not be able to access any other groups or entities
related to any other devices.
Furthermore, with SBAC, dm1 will also not be able to see the entities created by other DMs (let's say dm2) on the same group
g1. That means a DM user will only be able to see the entities owned by the user.
For example, you (as an administrator) create another DM user named dm2 and assign the same group g1 present under custom
groups. If dm2 creates configuration template, configuration baselines, or profiles for the devices in g1, then dm1 will not have
access to those entities and vice versa.
A DM with scope to All Devices has operational access as specified by RBAC privileges to all devices and group entities owned
by the DM.
SBAC for AD/LDAP users:
While importing or editing AD/LDAP groups, administrators can assign scopes to user groups with DM role. If a user is a member
of multiple AD groups, each with a DM role, and each AD group has distinct scope assignments, then the scope of the user is
the union of the scopes of those AD groups.
For example,
● User dm1 is a member of two AD groups (RR5-Floor1-LabAdmins and RR5-Floor3-LabAdmins). Both AD groups have been
assigned the DM role, with scope assignments for the AD groups are as follows: RR5-Floor1-LabAdmins gets ptlab-servers
and RR5-Floor3-LabAdmins gets smdlab-servers. Now the scope of the DM dm1 is the union of ptlab-servers and smdlab-
servers.
144
Managing OpenManage Enterprise appliance settings