HP Virtual Connect Enterprise Manager 6.3.1 CLI Guide

Table 2 RBAC privileges (continued)
VCEM User
(read only)
VCEM
Group
Limited
Operator
VCEM
Group
Operator
VCEM
Group
Administrator
VCEM
AdministratorCommand line options
xxx-set iscsi-boot-param
xxx-remove iscsi-boot-param
xxxxx-show job
xxxxx-show version
xxxxx-show vcem-status
xx-startvcdmaint
xx-cancelvcdmaint
xx-completevcdmaint
VCEMCLI commands for read operations require minimum VCEM privilege, whereas write operations
require full privilege to the affected resource. You can set up the VCEM privilege from the System
Insight Manager Options→Security→Users and Authorizations. If the minimum RBAC is not met,
VCEMCLI reports an error. The error message contains a description of the reason for the failure.
RBAC Best Practices
In configurations where VCEM is used in conjunction with an upper-level manager such as HP
Matrix Operating Environment or HP Matrix OE logical server management, ensure that operations
invoked through VCEMCLI do not disrupt the functioning of the upper-level manager. The VCEM
User Interface warns the administrator when it detects the risk of conflict, however VCEMCLI will
not. See “Using VCEM commands” (page 17) for more information on which commands can
cause disruption of upper-level managers.
You can configure SIM using role-based access control to prevent conflicts between VCEM and
upper-level managers by not allowing changes to resources which would disrupt the upper-level
manager.
To prevent conflicts:
• Define specific SIM users for VCEM and VCEMCLI.
• Define additional SIM users for upper-level managers.
• If needed, roles can be removed from the VCEM users to prevent conflict with upper-level
managers.
• Set permissions on VC Domain Groups so only specific SIM users can access them.
• Confirm that the scripts specify the correct username and password credentials to ensure that
they are granted only the appropriate level of permissions.
• Ensure that NTFS permissions are set on the scripts on the CMS so that they are accessible
only to the CMS users who are authorized to run them.
Working with server profiles
VCEMCLI provides the most commonly used profile operations including:
• Server profile creation or update
• Server profile assignment or un-assignment
For more information on server profiles and the available server profile operations, see the HP
Virtual Connect Enterprise Manager 6.3.1 User Guide
Working with server profiles 11