Page tree

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

In the context of Lumeta and for the purpose of linking users to zones, an Organization is a set of Zones with a common set of permissions.  There There can be many organizations and these are associated with one another in a single layer without hierarchy. Organizations do not nest within other organizations.  

...

A user is a login and password combination that identifies individuals entitled to use Lumeta. Lumeta=> Username can be a combination of alphanumeric characters but cannot start with number. Valid user names are admin1, manager0056. Invalid user names are: 1admin, 1005m 

Valid usernames: 

  • Use this set of characters: A-Za-z0-9_.-
  • Are one or more characters (but not a single dot, digit or hyphen)
  • Do not start with a hyphen
  • If the id starts with a dot, then there has to be at least one non-dot character afterwards
  • If the id starts with a number, then there must be one non-numeric character afterwards

A superuser is not a role but a flag that allows a user to manage all aspects of the system regardless of zone affiliation. The entire system is accessible to a user with superuser privileges. CRUD operations can only be performed by a superuser.  Also, the superuser can see the Support menu option.

...

Excerpt

Roles define the system features and commands users can access. Each user is assigned a set of permissions, or role.

Lumeta comes with three pre-defined roles that you can assign to a user. You can assign all three rolls to a user, two of the roles to a user, or none of the rolls to a user.

SysAdmin - Manages the system. Is concerned with details at device level (i.e., software and hardware). Can manage the Lumeta System (Installation of License, Upgrading the System, Configuring CEF, Resetting the IP, Restarting services or system). The SysAdmin cannot log in to the Lumeta GUI unless he or she has also been given the Viewer role, the Manager role, or has been flagged as a superuser.

Manager - Concerned with Lumeta-specific details. Manages the Organization to which he/she belongs. Creates zones and collectors, assigning roles to users, subscribes to notifications, configures dashboards.
Manager can access GUI for the following functionality:

  • Can modify users – can edit the roles and password of a user.
  • Can add/modify/delete zones

  • Can add/modify collectors (and all its sub functionality)

  • Can configure notifications

  • Can not configure CEF notifications

  • Can view reports, maps and zones

Manager can access the following commands in CLI:

Viewer - Read only. User cannot manipulate zones or Lumeta system software or hardware. Views the organization to which he/she belongs. Can view zones, collectors, maps, and dashboards.

Permissions

  • GREEN: If the role can perform the task
  • RED: If the role is not allowed to perform the task
  • A user with ONLY the SysAdmin Role will not be allowed to log in to GUI.
  • A user with the superuser flag is allowed EVERYTHING

The following chart can help answer role-related questions such as  . . .

  1. Which role can subscribe to notifications? (superuser, Manager and Viewer)
  2. Which role can add Reports/Dashboards? (superuser, Manager and Viewer)
  3. When a user adds Reports/Dashboards, it is visible for other users who log in? (yes)
  4. OSPF, CEF configuration, which role can perform this? (superuser)

...

    • Add

...

    • Modify

...

    • Delete

...

    • View

...

    • Add

...

    • Modify

...

    • Delete

...

    • View

...

    • Add

...

    • Modify

...

    • Delete

...

    • View

...

  • Lumeta Systems

...

  • OSPF Config

...

    • CEF Notifications

...

    • License Installation

...

    • Upgrade

...

    • Add/Modify/Delete Scouts

...

    • View

...

    • Browse Real-time

...

    • Browse Historical

...

    • Schedule

...

    • Basic

...

    • Advanced

...

    • Add Dashboards

...

    • Delete

...

    • View

...

User Roles

Every GUI and CLI command calls an API. Every API call has either a single permission associated with it, or no permissions at all. If no permission, or the permission NONE, anyone can use that API.

Permission

Notes

NO_ACCESSAPI is disabled
NONENo permission required (default) – Anyone can use the API
VIEW_ZONEViewing reports and dashboards
MANAGE_USERSAdding and deleting users, assigning roles
MANAGE_ZONESAdding/deleting/configuring zones and collectors
MANAGE_SYSTEMAll system-wide functions, like importing configs, starting/stopping services, etc.
MANAGE_SCOUTInterpreted as "manage remote" for adding and deleting remote systems
BYPASS_ACCESSOnly superuser may use this API

 

Every role has a group of permissions. If a user has a role, then that role's permissions define which APIs the user can call, and in turn which GUI and CLI commands. Superuser is not a role; it's a flag. When a user has the superuser flag enabled, the system bypasses (ignores) the roles and allows the user to run any API, and therefore any command.Some APIs require BYPASS_ACCESS permission, which means that only a superuser can use those APIs.

Role

Permissions

ManagerMANAGE_USERS, MANAGE_ZONES, VIEW_ZONE
SysAdminMANAGE_SCOUTS, MANAGE_SYSTEM
ViewerVIEW_ZONE
PortalUserMANAGE_SCOUTS, VIEW_ZONE

FAQs

Excerpt

If a user needs access to all zones, view only, what access would they need?
 This user would need the "Viewer" role for each organization.

A user has admin right access, why can't that user see all zones?
Assuming the user has the "SysAdmin" role, this role is focused on managing the Lumeta appliance. It does not provide view access.

Is there any conflict or issue with multiple users logging into the same CC at the same time, under the default admin account?
This is not recommended as a standard operation as there is no individual accountability in such a process. As to conflict, the only area where there would be an issue is around the map. The map automatically saves changes for the user. This means that if User Bob goes to the map, moves stuff around, and makes certain display choices; these get saved. Bob then goes off duty, and Mary logs in. Mary goes to the map and makes changes. Mary goes off duty, Bob logs in, goes to the map and the map is different than what he expects from his last save because Mary's (more recent) choices have overwritten Bob's. 

...