Role-based user accounts
Role-based user accounts on Onboard Administrator serve two purposes: to control the functions a user has access to on Onboard Administrator and to control permissions a temporary user account adopts on iLO when autologin is used.
There are two major aspects of role-based user accounts on Onboard Administrator: bay permissions and a user privilege level. Bay permissions determine which bays the user is allowed to access. Bay permissions are selected during user account creation and allow access to specific device bays, interconnect bays, or Onboard Administrator bays. The privilege level determines which administrative functions the user is allowed to perform. A user’s privilege level can be administrator, operator, or user.
A user with an administrator privilege level and with permission to the OA bays in the enclosure is automatically given full access to all bays and can perform any function on the enclosure or bays including managing user accounts and configuring the enclosure. An operator with permission to only the OA bays can configure the enclosure, but the operator cannot manage users or any security settings, nor access any other bays. A user with permission to the OA bays can view only configuration settings, but the user cannot change the settings. The user accounts can be created with multiple bay permissions, but the same privilege level, across those bays.
User accounts configured to permit access to device bays can be created for server administrators. If the user logs into the Onboard Administrator, the user is given information on the permitted server bays. If the user selects the iLO from the Onboard Administrator web GUI, the user is automatically logged into that iLO using a temporary user account with their privilege level. iLO users with administrator privilege level have complete control including modifying user accounts. Operators have full control over the server power and consoles. Users have minimum read-only access to server information. Using this single-sign on feature greatly simplifies managing multiple servers from the Onboard Administrator web GUI.
Permissions for interconnect modules are slightly different. Autologin is not supported for interconnect modules, and all user levels have access to the Management Console link for interconnect bays to which they have permission. Administrators and operators can use the virtual buttons from Onboard Administrator to control power and the UID light on the interconnect module. Users can view only status and information about the interconnect module.
Examples
The following are examples of management scenarios in a c-Class environment and the user accounts that can be created to provide the appropriate level of security.
Scenario 1: A member of an organization needs to have full access to the servers in bays 1-8 to view logs, control power, and use the remote console. The user does not have clearance to manage any settings on Onboard Administrator. The user account to accomplish this security level has an administrator access level and permission to server bays 1-8. Thus, the user does not have permission to Onboard Administrator bays or any interconnect bay.
Scenario 2: A member of an organization needs to manage ports on two interconnect modules in bays 3 and 4. This person needs to know which ports on the switch map to certain servers, but this person must not be able to manage any of the servers. The user account to accomplish this security level has a user access level, permission to all server bays, and permission to interconnect bays 3 and 4. However, this user is not able to control the power or UID LED for the interconnect modules or blades. To control the power or UID to the interconnect modules the user privilege would have to be an operator. To restrict this user from performing server operations such as power control or consoles, the account is restricted to just bay permissions for interconnect bays 3 and 4.