Overview
RBAC Concepts
Authentication
Role
Authorization
Rights Profile
Sun Cluster RBAC Rights ProfilesActions
Setting Up and Using RBAC
Specifying a Role When You Log In to SunPlex Manager
Changing a Role
You can grant permissions to a user, or role identity, that allow that
user to access and modify cluster parameters. You grant these permissions by
using the Rights tool in the Solaris Management Console User tool. The granting
of permissions to a user is described in
"Creating or Changing a Rights Profile"
in
System Administration Guide: Security Services.
The
Role
A special identity for running privileged applications that only assigned users can assume.
Authorization
A permission that can be assigned to a role or user
(or embedded in a rights profile)
for performing a class of actions that are otherwise prohibited by security policy.
A privileged application can check a user's
authorizations before that application grants access to specific features or functionality.
The auth_attr(4) man page contains additional information.
Rights Profile
A collection of authorizations, profiles, and permitted commands
(referred to as security attributes),
and other rights profiles that are assigned to a user or to a role identity.
Sun Cluster RBAC Rights Profiles
SunPlexTM
Manager and selected
SunTM
Cluster commands use RBAC for authentication.
Several RBAC rights profiles are included in the Sun Cluster software.
You can assign these rights profiles to users or to roles to give users different levels of access to Sun Cluster.
Sun provides the following rights profiles with Sun Cluster software.
Rights Profile | Includes Authorizations | This Authorization Permits the Role Identity to |
---|---|---|
Basic Solaris User |
This existing Solaris rights profile contains Solaris authorizations, as well as: |
Perform the same operations that the Basic Solaris User role identity can perform, as well as: |
solaris.cluster.device.read |
Read information about device groups |
|
solaris.cluster.gui |
Access SunPlex Manager. The authenticated user must also have read authorizations for one or more cluster objects to view cluster information through SunPlex Manager. |
|
solaris.cluster.network.read |
Read information about IP Network Multipathing Note: This authorization does not apply to SunPlex Manager. |
|
solaris.cluster.node.read |
Read information about attributes of nodes |
|
solaris.cluster.quorum.read |
Read information about quorum devices and the quorum state |
|
solaris.cluster.resource.read |
Read information about resources and resource groups |
|
solaris.cluster.system.read |
Read the status of the cluster |
|
solaris.cluster.transport.read |
Read information about transports |
|
Cluster Operation |
solaris.cluster.appinstall |
Install clustered applications |
solaris.cluster.device.admin |
Perform administrative tasks on device group attributes |
|
solaris.cluster.device.read |
Read information about device groups |
|
solaris.cluster.gui |
Access SunPlex Manager. The authenticated user must also have read authorizations for one or more cluster objects to view cluster information through SunPlex Manager. |
|
solaris.cluster.install |
Install clustering software Note: This authorization does not apply to SunPlex Manager. |
|
solaris.cluster.network.admin |
Perform administrative tasks on IP Network Multipathing attributes Note: This authorization does not apply to SunPlex Manager. |
|
solaris.cluster.network.read |
Read information about IP Network Multipathing Note: This authorization does not apply to SunPlex Manager. |
|
solaris.cluster.node.admin |
Perform administrative tasks on node attributes |
|
solaris.cluster.node.read |
Read information about attributes of nodes |
|
solaris.cluster.quorum.admin |
Perform administrative tasks on quorum devices and quorum state attributes |
|
solaris.cluster.quorum.read |
Read information about quorum devices and the quorum state |
|
solaris.cluster.resource.admin |
Perform administrative tasks on resource attributes and resource group attributes |
|
solaris.cluster.resource.read |
Read information about resources and resource groups |
|
solaris.cluster.system.admin |
Administer the system Note: This authorization does not apply to SunPlex Manager. |
|
solaris.cluster.system.read |
Read the status of the cluster |
|
solaris.cluster.transport.admin |
Perform administrative tasks on transport attributes |
|
solaris.cluster.transport.read |
Read information about transports |
|
System Administrator |
This existing Solaris rights profile contains the same authorizations that the Cluster Management profile contains. |
Perform the same operations that the Cluster Management role identity can perform, in addition to other system administration operations. |
Cluster Management |
This rights profile contains the same authorizations that the Cluster Operation profile contains, as well as the following authorizations: |
Perform the same operations that the Cluster Operation role identity can perform, as well as: |
solaris.cluster.device.modify |
Modify device group attributes |
|
solaris.cluster.network.modify |
Modify IP Network Multipathing attributes Note: This authorization does not apply to SunPlex Manager. |
|
solaris.cluster.node.modify |
Modify node attributes Note: This authorization does not apply to SunPlex Manager. |
|
solaris.cluster.quorum.modify |
Modify quorum devices and quorum state attributes |
|
solaris.cluster.resource.modify |
Modify resource attributes and resource group attributes |
|
solaris.cluster.system.modify |
Modify system attributes Note: This authorization does not apply to SunPlex Manager. |
solaris.cluster.transport.modify |
Modify transport attributes |
Sun Cluster Commands |
None, but includes a list of Sun Cluster commands that run with euid=0 |
Execute selected Sun Cluster commands that you use to configure and manage a cluster, including: scgdevs(1M) scswitch(1M) (selected options) scha_control(1HA) scha_resource_get(1HA) scha_resource_setstatus(1HA) scha_resourcegroup_get(1HA) scha_resourcetype_get(1HA) |
To | Refer to |
---|---|
Learn more about RBAC | "Role-Based Access Control (Overview)" in Solaris System Administration Guide: Security Services |
Set up, manage elements of, and use RBAC with Sun Cluster |
"Role-Based Access Control (Tasks)"
in
Solaris System Administration Guide: Security Services
"Sun Cluster and RBAC" in Sun Cluster System Administration Guide |
Learn more about RBAC elements and tools | "Role-Based Access Control (Reference)" in Solaris System Administration Guide: Security Services |
If you do not possess this authorization, you are not allowed to log in to SunPlex Manager.
If a role is assigned to your user account, the Log In With Roles page appears.
Otherwise, the SunPlex Manager workspace appears.
If you selected a role name and that role name or its associated role password is not successfully authenticated, the Role Authentication Failed warning appears on the Log In With Roles page.
If this warning appears, specify another role name or role password.
If you selected a role name, and the role name and role password are successfully authenticated, SunPlex Manager logs you in under that role. SunPlex Manager logs you in with the privileges that are associated with that role. The privileges that are associated with your user account are no longer available.
If you selected No role, SunPlex Manager logs you in under your user name with the privileges that are associated with your user account.
After you log in successfully, the SunPlex Manager workspace appears.
The view of the cluster that you see is based on your authorized access.
SunPlex Manager exits.