topic Re: Admin Roles in General Topics

Admin Roles

nawaza — Wed, 21 Feb 2018 14:55:21 GMT

I created a 'read only' admin role, simple superuser priviledges, everything set to default.

when i login with RO, the HA view for example dissappears, and the commit link is still present desite it being disabled within the Admin Role profile.

I'm wondering if this is because we're using ISE...?

Many thanks

Ajaz Nawaz

JNCIE-SEC No.254

CCIE-RS No.15721

Re: Admin Roles

reaper — Thu, 22 Feb 2018 07:50:12 GMT

HA view needs to be enabled per user from the widget dropdown

Did you create an admin role with all sections set to readonly, or did you create a read-only superuser account (not a role)?

A read-only superuser has access to everything, he's simply not allowed to change anything (superuser, still)

if you want to restrict access to certain parts, you can create a role and disable access to what you don't want the user to see and read-only for what they are allowed to see

the admin account needs to be changed from dynamic to role-based for this to work

Re: Admin Roles

nawaza — Thu, 22 Feb 2018 09:53:21 GMT

Thanks Reaper

In answer to your question I created a RO Admin role and disabled 'save' and 'commit' - I also set CLI to superrader

Reaper can I ask if its possible to remove the 'commit' link for RO users.

Regards

Ajaz

Re: Admin Roles

reaper — Thu, 22 Feb 2018 09:54:24 GMT

hi @nawaza

you can't remove the physical links as they are an integral part of the GUI, but you can restrict access to it by using the profile