Difference between revisions of "Permissions"

From Veloopti Help
Jump to: navigation, search
m
m
Line 22: Line 22:
 
----
 
----
 
{|
 
{|
−
| [[file:slider_right.png|30px]]
+
| style="vertical-align:top;border-bottom:0.5px solid gray;" | [[file:slider_right.png|30px]]
−
| Install
+
| style="vertical-align:top;border-bottom:0.5px solid gray;" | Install
−
| The user can install an agent on a server by providing their username and password.
+
| style="vertical-align:top;border-bottom:0.5px solid gray;" | The user can install an agent on a server by providing their username and password.
 
|-
 
|-
−
| [[file:slider_right.png|30px]]
+
| style="vertical-align:top;border-bottom:0.5px solid gray;" | [[file:slider_right.png|30px]]
−
| Upgrade
+
| style="vertical-align:top;border-bottom:0.5px solid gray;" | Upgrade
−
| The user can initiate an agent to upgrade
+
| style="vertical-align:top;border-bottom:0.5px solid gray;" | The user can initiate an agent to upgrade
 
|-
 
|-
−
| [[file:slider_right.png|30px]]
+
| style="vertical-align:top;border-bottom:0.5px solid gray;" | [[file:slider_right.png|30px]]
 
| Restart
 
| Restart
 
| The users can stop an start the Veloopti agent
 
| The users can stop an start the Veloopti agent
Line 45: Line 45:
 
----
 
----
 
{|
 
{|
−
| [[file:slider_right.png|30px]]
+
| style="vertical-align:top;border-bottom:0.5px solid gray;" | [[file:slider_right.png|30px]]
−
| List all
+
| style="vertical-align:top;border-bottom:0.5px solid gray;" | List all
−
| The user is able to view the complete list of applications in the application list view.
+
| style="vertical-align:top;border-bottom:0.5px solid gray;" | The user is able to view the complete list of applications in the application list view.
 
|-
 
|-
−
| [[file:slider_right.png|30px]]
+
| style="vertical-align:top;border-bottom:0.5px solid gray;" | [[file:slider_right.png|30px]]
−
| View all
+
| style="vertical-align:top;border-bottom:0.5px solid gray;" | View all
−
| The user is able to enter all applications in the application list view. This gives the user a read only view of the Dashboards, users and nodes in the application.
+
| style="vertical-align:top;border-bottom:0.5px solid gray;" | The user is able to enter all applications in the application list view. This gives the user a read only view of the Dashboards, users and nodes in the application.
 
|-
 
|-
−
| [[file:slider_right.png|30px]]
+
| style="vertical-align:top;border-bottom:0.5px solid gray;" | [[file:slider_right.png|30px]]
−
| Create and Rename
+
| style="vertical-align:top;border-bottom:0.5px solid gray;" | Create and Rename
−
| The user can create a new application and rename an existing one
+
| style="vertical-align:top;border-bottom:0.5px solid gray;" | The user can create a new application and rename an existing one
 
|-
 
|-
−
| [[file:slider_right.png|30px]]
+
| style="vertical-align:top;border-bottom:0.5px solid gray;" | [[file:slider_right.png|30px]]
−
| Change application owner
+
| style="vertical-align:top;border-bottom:0.5px solid gray;" | Change application owner
−
| User can change an application owner to another user.
+
| style="vertical-align:top;border-bottom:0.5px solid gray;" | The user can change an application owner to another user.
 
NOTE: This permission allows the user to assume full rights over any application. As the Owner of an application is the only user that is able to delete an application that means that this permission is also the "Delete Application" permission.
 
NOTE: This permission allows the user to assume full rights over any application. As the Owner of an application is the only user that is able to delete an application that means that this permission is also the "Delete Application" permission.
 
|-
 
|-
Line 322: Line 322:
 
| Close Events
 
| Close Events
 
| User can close an open event.
 
| User can close an open event.
−
NOTE: Once closed an event cannot be re-opened.
+
NOTE: Once an event is closed it cannot be re-opened.
 
|-
 
|-
 
|}
 
|}
Line 333: Line 333:
 
| [[file:slider_right.png|30px]]
 
| [[file:slider_right.png|30px]]
 
| Manage Node Groups
 
| Manage Node Groups
−
| x
+
| The user can add and remove node groups
 
|-
 
|-
 
| [[file:slider_right.png|30px]]
 
| [[file:slider_right.png|30px]]
 
| Add Node to Node Group
 
| Add Node to Node Group
−
| x
+
| The user can add a node to a node group
 
|-
 
|-
 
| [[file:slider_right.png|30px]]
 
| [[file:slider_right.png|30px]]
 
| Link Policy Group to Node Group
 
| Link Policy Group to Node Group
−
| x
+
| The user can link a policy group to a node group
 
|-
 
|-
 
| [[file:slider_right.png|30px]]
 
| [[file:slider_right.png|30px]]
 
| Link Action Group to Node Group
 
| Link Action Group to Node Group
−
| x
+
| The user can link an action group to a node group
 
|-
 
|-
 
| [[file:slider_right.png|30px]]
 
| [[file:slider_right.png|30px]]
 
| Remove Node from Application
 
| Remove Node from Application
−
| x
+
| The user can remove a node from an application
 
|-
 
|-
 
| [[file:slider_right.png|30px]]
 
| [[file:slider_right.png|30px]]
 
| Run action from Node
 
| Run action from Node
−
| x
+
| Users can run an action on a node.
 +
NOTE: The user also needs to have the run Operator/Power User/Administrator permission in order for the action to be available to them.
 
|-
 
|-
 
|}
 
|}
Line 364: Line 365:
 
| [[file:slider_right.png|30px]]
 
| [[file:slider_right.png|30px]]
 
| View Policies
 
| View Policies
−
| x
+
| The user can see all policies in the policies list and open them
 
|-
 
|-
 
| [[file:slider_right.png|30px]]
 
| [[file:slider_right.png|30px]]
 
| Manage Policies
 
| Manage Policies
−
| x
+
| The user can create, edit and delete policies
 
|-
 
|-
 
| [[file:slider_right.png|30px]]
 
| [[file:slider_right.png|30px]]
 
| Manage Policy Groups
 
| Manage Policy Groups
−
| x
+
| The user can create and delete policy groups.
 
|-
 
|-
 
| [[file:slider_right.png|30px]]
 
| [[file:slider_right.png|30px]]
 
| Add Policy to Policy Group
 
| Add Policy to Policy Group
−
| x
+
| The user can add policies to policy groups
 
|-
 
|-
 
| [[file:slider_right.png|30px]]
 
| [[file:slider_right.png|30px]]
 
| List Policies on a Node
 
| List Policies on a Node
−
| x
+
| The user can see the policies that have been deployed to a node
 
|-
 
|-
 
| [[file:slider_right.png|30px]]
 
| [[file:slider_right.png|30px]]
 
| Deploy Policies
 
| Deploy Policies
−
| x
+
| The user can deploy policies
 
|-
 
|-
 
| [[file:slider_right.png|30px]]
 
| [[file:slider_right.png|30px]]
 
| Assign Action to Policy
 
| Assign Action to Policy
−
| x
+
| The user can assign an action to a policy.
 
|-
 
|-
 
| [[file:slider_right.png|30px]]
 
| [[file:slider_right.png|30px]]
 
| Manage Node Overrides
 
| Manage Node Overrides
−
| x
+
| The user can add a node override for a policy. This enables the node to have different thresholds from the policy defaults.
 
|-
 
|-
 
|}
 
|}
Line 402: Line 403:
 
{|
 
{|
 
| [[file:slider_right.png|30px]]
 
| [[file:slider_right.png|30px]]
−
| Manage USer Groups
+
| Manage User Groups
−
| x
+
| The user can create and delete user groups
 
|-
 
|-
 
| [[file:slider_right.png|30px]]
 
| [[file:slider_right.png|30px]]
 
| Add User to User Group
 
| Add User to User Group
−
| x
+
| The user can create and delete user groups
 
|-
 
|-
 
| [[file:slider_right.png|30px]]
 
| [[file:slider_right.png|30px]]
 
| Add / Remove user to Application
 
| Add / Remove user to Application
−
| x
+
| The user can add and remove users from the application
 
|-
 
|-
 
| [[file:slider_right.png|30px]]
 
| [[file:slider_right.png|30px]]
 
| Add User to Application Role
 
| Add User to Application Role
−
| x
+
| User can add other users to application roles
 
|-
 
|-
 
| [[file:slider_right.png|30px]]
 
| [[file:slider_right.png|30px]]
 
| Edit Application Role Permissions
 
| Edit Application Role Permissions
−
| x
+
| The user can create, edit and delete application roles
 
|-
 
|-
 
|}
 
|}
Line 430: Line 431:
 
| [[file:slider_right.png|30px]]
 
| [[file:slider_right.png|30px]]
 
| Manage Dashboards
 
| Manage Dashboards
−
| x
+
| The user can create, edit and delete dashboards
 
|-
 
|-
 
|}
 
|}

Revision as of 16:20, 17 January 2019


1 Overview

A central design point of Veloopti security is that no user has permission to perform any operation unless they have been specifically granted it. The purpose of granting a permission is to enable a user to perform a specific action. Permissions either extend globally to the whole of Veloopti, or locally to a single application. Each application has total control of its own permissions and they do not interfere with another application.

2 Design considerations

A central design point of Veloopti permissions is to empower the owner of an application to have everything they need to monitor their application. They should be able to write and deploy any monitoring for their application without being interfered by another application.


3 Roles and permissions

Permissions are bundled together and can appear in one or more roles.


Global permissions and application permissions Global permissions reach to the entire Veloopti organisation and can extend into every application. Application permissions exist only in the application.

4 Global permissions

AGENTS

Slider right.png Install The user can install an agent on a server by providing their username and password.
Slider right.png Upgrade The user can initiate an agent to upgrade
Slider right.png Restart The users can stop an start the Veloopti agent
Slider right.png Create installation token The user can create an installation token that can be used to install an agent that does not require a username and password.


APPLICATIONS

Slider right.png List all The user is able to view the complete list of applications in the application list view.
Slider right.png View all The user is able to enter all applications in the application list view. This gives the user a read only view of the Dashboards, users and nodes in the application.
Slider right.png Create and Rename The user can create a new application and rename an existing one
Slider right.png Change application owner The user can change an application owner to another user.

NOTE: This permission allows the user to assume full rights over any application. As the Owner of an application is the only user that is able to delete an application that means that this permission is also the "Delete Application" permission.


EVENTS

Slider right.png View all The user can view all events for all applications
Slider right.png Manage all The user can change the status and set the event to closed
Slider right.png View internal Veloopti events User can view events that have been created internally by server agents. These can be used to help diagnosing agent issues.


LOGS

Slider right.png View Audit Logs The user can view the logs that are created any time a change is made in Veloopti
Slider right.png View Notification Logs The user can view the logs that are created any time a notification is sent.
Slider right.png View Security Logs The user can view logs that are created any time a user does something in Veloopti. This included logon and logout activities.
Slider right.png View Billing Logs The user can view the logs that relate to billing


NODES

Slider right.png View all The user can view all nodes in the node list. They also can view the node properties.
Slider right.png Deploy policies The user can deploy all application policies to servers whether they have access to the application or not.
Slider right.png Add Node to Applications The user can add a node to any application in the organisation.

NOTE: The user does not need to have permission to view the application to add it.

Slider right.png Relabel Nodes The user is able to change the label of the node
Slider right.png Remove Nodes The user is able to remove the node from the organisation


ORGANISATION

Slider right.png Manage Node Billing Plan The user is able to change the billing plans for any node that they can see
Slider right.png View Organisation Billing Details The user is able to view the invoices for the organisation
Slider right.png View Extra Details x
Slider right.png Change Default Settings The user can change the organisation default settings of: Language; Time Zone and Default new node plan.
Slider right.png Manage Schedules The user can change the schedules
Slider right.png Add Users to Global and Application Roles User can add and remove users in Global and Application roles.

NOTE: The user needs to be granted access to the application before they can add or remove users from the applications roles.

Slider right.png Edit Global and Application Role Permissions User can edit a role by adding or removing permissions from it. They also can create new roles.

NOTE: The user needs to be granted access to the application before they can add or remove permissions from the applications roles.

Slider right.png Manage Auto Discovery The user can manage the auto discovery options for discovering application on servers


STORM RULES

Slider right.png View All The user can view storm rules
Slider right.png Manage All The user can create and edit storm rules


POLICIES

Slider right.png Manage all Allows the user full permissions to policies for any application that they are able to view. Can be used in conjunction with the application "View all" global permission to empower a user to enter any application and modify the policies.


USERS

Slider right.png Add Users to Global Roles The user can add and remove users from global roles
Slider right.png Invite User to Organisation The user can send an invitation to an external email address to add them to their organisation
Slider right.png Remove User from Organisation The user can remove any user, except for the organisation owner, from the organisation
Slider right.png View Active User Sessions The user can view active user sessions for all users
Slider right.png View Expired User Sessions The user can view expired user sessions for all users
Slider right.png Kill any Users Session The user can kill any users active session.
Slider right.png Add User to Application The user can add another user to any application that they can view
Slider right.png Add / Remove user from Application User Group The user can add or remove a user from an application user group that they can view
Slider right.png Add Other Users to this Role Allows any member of the role to add another user to the role. This means that the members of the role are able to self manage rather than having to rely on someone with the Global "Assign User to Global Role" role.


DASHBOARDS

Slider right.png Manage all Can be used in conjunction with the application "View all" global permission to empower a user to enter any application and modify the dashboards.


5 Application permissions

ACTIONS

Slider right.png View all actions The user can view all of actions in the application
Slider right.png Run Operator Actions The user can run actions that have an operator level permission.
Slider right.png Run Power User Actions The user can run actions that have a Power User level permission.

Note: This does not mean that users have permission to run an operator level action.

Slider right.png Run Administrator Actions User can run actions that have an Administrator level permission.

Note: This does not mean that users have permission to run an Operator or Power User level action.

Slider right.png Manage Actions The user is able to create, edit and delete actions.
Slider right.png Assign Action to Action Group The user can add actions to actions group. This allows the action to be available to be run on any server in the application.
Slider right.png Manage Groups The user can add and remove action groups


EVENTS

Slider right.png View Events The user can view events for the application
Slider right.png Edit Event Description The user can change the event description for an open event.

NOTE: Under no circumstances can the description for a closed event be changed.

Slider right.png Change Event Severity The user can change the event severity for an open event.

NOTE: Under no circumstances can the severity for a closed event be changed.

Slider right.png Run Action from Event The user is able to run an action on a node from an event.

NOTE: The user also needs to have the run Operator/Power User/Administrator permission in order for the action to be available to them.

Slider right.png Close Events User can close an open event.

NOTE: Once an event is closed it cannot be re-opened.


NODES

Slider right.png Manage Node Groups The user can add and remove node groups
Slider right.png Add Node to Node Group The user can add a node to a node group
Slider right.png Link Policy Group to Node Group The user can link a policy group to a node group
Slider right.png Link Action Group to Node Group The user can link an action group to a node group
Slider right.png Remove Node from Application The user can remove a node from an application
Slider right.png Run action from Node Users can run an action on a node.

NOTE: The user also needs to have the run Operator/Power User/Administrator permission in order for the action to be available to them.


POLICIES

Slider right.png View Policies The user can see all policies in the policies list and open them
Slider right.png Manage Policies The user can create, edit and delete policies
Slider right.png Manage Policy Groups The user can create and delete policy groups.
Slider right.png Add Policy to Policy Group The user can add policies to policy groups
Slider right.png List Policies on a Node The user can see the policies that have been deployed to a node
Slider right.png Deploy Policies The user can deploy policies
Slider right.png Assign Action to Policy The user can assign an action to a policy.
Slider right.png Manage Node Overrides The user can add a node override for a policy. This enables the node to have different thresholds from the policy defaults.


USERS

Slider right.png Manage User Groups The user can create and delete user groups
Slider right.png Add User to User Group The user can create and delete user groups
Slider right.png Add / Remove user to Application The user can add and remove users from the application
Slider right.png Add User to Application Role User can add other users to application roles
Slider right.png Edit Application Role Permissions The user can create, edit and delete application roles


DASHBOARDS

Slider right.png Manage Dashboards The user can create, edit and delete dashboards

5.1 Owner

The role of owner has permanent permissions that cannot be revoked. Even if all roles are lost to everyone else the owner is still able to access the ones below. Once the role of owner is given to another user it cannot be taken back. If the role of owner is somehow lost to an organisation then contact Veloopti.

Description Location
Permissions URL Global options Context options Item options Button Other
Change Owner ap1.veloopti.com.au/organisation/index/special Yes
Change Billing Administrator ap1.veloopti.com.au/organisation/index/special Yes
Edit Global and Application Role Permissions ap1.veloopti.com.au/permissions Menu item
Add Users to Global and Application Roles ap1.veloopti.com.au//roles/index/ Menu item

5.2 Billing Administrator

Retrieved from "http://help.veloopti.com.au/index.php?title=Permissions&oldid=4592"