Understanding security roles for PureApplication® System

System level administration

In general, administering each area of responsibility requires users to have either a full-permission security role or a read-only view security role. Occasionally, the full-permission security role is referred to as the administrative writer role and the read-only view role as the administrative reader role. An administrative writer role naturally includes the reader role and also has privileges to perform all administrative operations. An administrative reader role can only view configuration and monitor status but cannot modify configuration.

Table 1 lists each security role and the administrative console menus that are visible to users who are granted the security role. A detailed description of each security role is provided later in this topic.

The following list describes each security role. As indicated in the list, the authority to access a type of resource does not equate with the authority to access all instances of that resource. In some cases, users can access a resource only if they are granted authority by the creator of that resource. This implementation of resource level access control is explained in the next section.

Workload resources administration

• View all workload resources (Read-only)

  Users with this administrative option can view all workload management-related configuration and status on the console, such as view deployed virtual application, deployed virtual systems, and deployed shared services.

• Manage workload resources (Full permission)

  Users who are assigned this option can manage all workload-related operations and resources such as deployment patterns, environment profiles, system plug-ins and shared services, plus all the functions previously mentioned in read-only view. Users are also granted administration privileges on database configuration management and performance monitoring operations.

Cloud group administration

• View all cloud resources (Read-only)

  Users with this administrative option can view virtual cloud resources configuration such as cloud groups.

• Manage cloud resources (Full permission)

  Users who are assigned this option can manage the above virtual resources.

Hardware administration

• View all workload resources (Read-only)

  View configuration and status of hardware components such as computer node, networks, memory, and disk storage, and also reports, events, and job queues.

• Manage workload resources (Full permission)

  Hardware administrators with full permissions can manage hardware components, reports, events, and job queues.

Auditing

• View all auditing reports (Read-only)

  Users who are assigned this option can only view auditing settings and download audit data.

• Manage auditing (Full permission)

  Auditors with full permissions can modify auditing settings. They can also set up external storage server connection data and credential data so as to automatically archive auditing event logs to external servers for long term storage to meet security compliance requirements.

Block Storage Replication administration

• View block storage replication profiles (Read-only)

  Users who are assigned this option can view block storage replication profile related information.

• Manage block storage replication profiles (Full permission)

  Block storage replication administrators with full permissions can create, validate, enable or disable and delete block storage replication profiles.

Security administration

• View users/groups (Read-only)

  Security administrators who are assigned this option can only view users and groups.

• View all security resources (Read-only)
  Security administrators who are assigned this option can only view security resources.

  Note: Administrators with this security setting cannot deploy shared services.
• Manage security (Full permission)

  Security administrators with full permissions can manage security resources. Moreover, users with the security administrator full permission role and the delegation security role can grant and revoke access rights of four console managed resource types: cloud groups, IP groups, virtual machines, and virtual appliances.

Resource level administration

Resource level administration refers to the security roles and access control permissions that are required to administer individual resources in the system, for example cloud groups, IP groups, compute nodes, storage devices, and more. At the resource level, administration responsibility for the Workload resources administration, Cloud group administration, Hardware administration, and Security administration functional areas is further divided into sub-roles to support the least privileged security principle. For example, users and groups who are responsible for creating and administering deployment patterns can be granted the Create new patterns security role, and not the full-permission Workload resources administration writer role.

Users and groups who are granted the Workload resources administration writer role are automatically granted all workload administrative sub-roles. The Security administration role has an additional user administrative reader role that allows a user or group to view a list of users and groups. This additional role is useful when an administrator is authorized to grant or revoke security roles from other users and groups so that they would have visibility to the list of users and groups.

The Cloud group administration role provides resource level access control for individual cloud resources, including cloud groups, IP groups, virtual machines, virtual appliances, virtual machine groups, volumes, and volume groups. Also, the Hardware administrator role provides resource level access control for individual hardware resources, including compute nodes, storage devices, and network devices. This model of providing more granular access control at the resource level is designed to limit access to only those resources that need to be managed at a particular time. The level of access (read, write, all, none) assigned to specific resources can be selected individually. For example, a user may be granted read access to some resources, and write access to other resources.

The following list describes each major functional area that is covered under the Workload Management category. Users can access a resource instance only if they are granted authority by the creator of that instance.

Deploy patterns in the cloud

This security role is automatically granted to all users by the system, and cannot be revoked. With this basic security role, users can view the classic virtual system instances, patterns, and catalog content to which they are granted access. They can deploy virtual system patterns and virtual application patterns, but cannot add, delete, or modify any of those items unless they are granted access permission to a particular resource instance. This security role assignment is not displayed on the console because every user has this fixed role assignment.

Create new patterns

Only a workload administrator with full permissions can assign this permission to users. Pattern creators can create both virtual system patterns and virtual application patterns. These users can also modify or delete any patterns that they create, or to which they have access. While users can view the list of catalog images, this permission does not authorize users to accept the licenses for the catalog images.

Create new environment profiles

Only a workload administrator with full permissions can make this assignment. With this permission, users create environment profiles to group related cloud topology settings for easy deployment of virtual system patterns. Environment profile creators can also modify or delete any profile that they create, or to which they have access.

Create new catalog content

Only a workload administrator with full permissions can make this assignment. With this permission, users can add objects to the system catalog. They can also modify or delete any catalog content that they create, or to which they have access. While users can view the list of catalog images, this permission does not authorize users to accept the licenses for the catalog images.

Use IBM License Metric Tool (ILMT)

Only a workload administrator with full permissions can make this assignment. IBM® License Metric Tool users do not gain any additional access in the system to create patterns, profiles, and so on. Instead, they can start tool-related REST API calls to manage product licensing. (Use the license tracking permission to designate users to run licensing scripts or agents while limiting those users' ability to perform administrative tasks on the system.)

Note: This user type applies only to IBM License Metric Tool 7.x, which is no longer supported.

Manage cloud group resources

Only a cloud group administrator who has been assigned full permissions and role delegation can make this assignment. With full permission, users can manage multiple cloud groups resources, including cloud group instances, IP groups, virtual machines, virtual appliances, virtual machine groups, volumes, and volume groups. With access control at the resource level, users can manage only those resources to which they have access. Cloud group resource managers can modify or delete any cloud group resource that they create, or to which they have full access.

The level of access (read, write, all, or none) assigned to specific cloud group resources can be selected individually on the System > Users or System > User Groups pages in the console.

Manage hardware resources

Only a hardware administrator who has been assigned full permissions and role delegation can make this assignment. With full permission, users can manage multiple hardware resources, including compute nodes, storage devices, network devices, and virtual LANs. With access control at the resource level, users can manage only those resources to which they have access. Hardware resource managers can modify or delete any hardware resource that they create, or to which they have full access.

The level of access (read, write, all, or none) assigned to specific hardware resources can be selected individually on the System > Users or System > User Groups pages in the console.

The following table describes the visibility of console menus for each security sub-role. Note that the options that are visible in each menu depend on the access permissions that users are assigned at the resource level.

Access control with security roles

All users are not authorized to grant or revoke security roles. To grant or revoke security roles, a user must have at least one full-permission administrative writer role from one of the six responsibility areas. Moreover, a user or group who has a full-permission administrative role further needs the delegation security role to allow delegation when full permission is selected. Again, this is based on separation of duty and least-privileged security principles, that not all administrative users need to be granted delegation authority. When full-permission administrative users are granted the delegation security role, such users can grant and revoke security roles from themselves and from other users and groups. Those users, however, can only grant or revoke security roles that they have but not any security roles that they do not have. In other words, administrators can only delegate or revoke their own authorization to and from others but cannot garner any new authorization that they do not originally begin with. A user can only gain more privileges if administrators grant their own privileges to the user.

Resource instance-based access control in PureApplication System

• Virtual system instances
• Classic virtual system instances
• Shared services instances
• Patterns
• Virtual Images
• Script Packages
• Emergency Fixes
• Cloud groups
• Environment profiles

Workload resources access rights delegation

Console resource access rights delegation

Users who have at least one full permission role and also the delegation role can grant other users and user groups access to the security roles that they themselves have. In addition, users who have access rights to a particular resource, for example a hardware resource or a cloud group resource, can grant other users and user groups access to that resource. Users cannot grant permissions that they themselves do not have.

Access rights definition