Roles-based administration
| Article:HOWTO37150 | | | Created: 2010-12-24 | | | Updated: 2012-06-27 | | | Article URL http://www.symantec.com/docs/HOWTO37150 |
Use Windows Authorization Manager to configure roles for Enterprise Vault roles-based administration. All such configuration is performed using the Vault Service account.
See Installing and Configuring for details of the prerequisite software that is needed to run Authorization Manager.
For an introduction to using Authorization Manager, see the following article:
http://msdn.microsoft.com/en-us/library/bb897401.aspx
Within Authorization Manager, roles are built up using operations and tasks, as follows:
An operation is a low-level permission that represents a privileged action or capability. When the Administration Console determines whether a role has access to perform a task, it is the operations associated with the role that are checked.
Operations with names prefixed by "{STO}" or "{DIR}" are internal operations that do not affect the Administration Console display. Other, external operations control the view of the Administration Console that an administrator sees.
A task is a group of operations that collectively provide sufficient permissions to do a particular job.
A role is a collection of tasks and, possibly, operations and other roles.
Enterprise Vault supplies the following predefined administrator roles:
Enterprise Vault provides one predefined task role:
Enterprise Vault provides one predefined application role:
You can use the predefined roles as supplied, customize them, or create new roles, as required.
By assigning roles you can adjust the permissions of individual administrators to match their job responsibilities. The mechanism is flexible enough for you to be able to modify an individual's role to cope with any change in responsibility.
You can assign roles to the following:
Windows Users and Groups.
The results of an LDAP query.
Application-specific groups. These are specific to Authorization Manager and can contain a mixture of users and groups. They can also be based on an LDAP query. The main benefit of using application groups is that there is no need to create new groups within Active Directory to support Enterprise Vault.
Enterprise Vault auditing does not log changes to role membership within Authorization Manager. If you require auditing of changes within Authorization Manager, assign Enterprise Vault roles to Windows security groups and enable Windows auditing of changes to those groups.
Note: | The predefined Placeholder Application role does not allow access to the Administration Console. |
Table: Administration Console features and actions shows the Administration Console features and actions that are available to the supplied administrator roles.
Table: Administration Console features and actions
|
|
Legacy ID
v11738033_v34981136
Article URL http://www.symantec.com/docs/HOWTO37150
Terms of use for this information are found in Legal Notices
Thank you.