ADCM role model

Mikhail Serov

Contents

Built-in roles
Permissions and roles

A role model is implemented in ADCM. Specific sets of permissions for operations with various ADCM objects can be grouped into roles. The roles are used to create policies to grant roles’s permissions to user groups.

Permission is a basic element of the role model. Role is a set of permissions. Permissions can not be assigned directly to the groups. Permissions can be only added to the roles.

Some permissions are necessary to work with any product via ADCM. Such permissions are always present in ADCM. Other permissions are necessary to work only with a particular product. Those permissions appear in ADCM when a bundle is uploaded.

The role is assigned to a user group via policy. Assignment of multiple roles is not supported. Each user inherits the roles of the group to which they belong.

NOTE

Only the ADCM administrator (= superuser) can assign roles to the users. In particular, only the superuser can grant a superuser role to another user.

Policy is a triad that consists of the following elements:

User group.
Role.
Object, to which the role’s permissions are applied. Object can have one of the following types:
- Cluster
- Service
- Host
- Provider

While creating a policy, the user is prompted to select one or more objects of the type that corresponds to the chosen user role.

NOTE

A policy is applied to an object as well as to all of its child objects. For example, if a policy is given to a cluster, then that policy also affects all services, components, and hosts of that cluster.

Built-in roles

ADCM comes with a few built-in roles. Changing the permissions of built-in roles is prohibited.

Built-in ADCM roles
Role name	Description	Object type
ADCM User	View-only role that provides ability to view all objects information	None
ADCM Auditor	View-only role that provides ability to view audit results	None
Service Administrator	Role provides ability to configure and control the life cycle of the relevant service	Service
Cluster Administrator	Role provides ability to configure and control the relevant cluster, its hosts, and its services	Cluster
Provider Administrator	Role gives full control over the relevant hostprovider and its hosts	Provider
ADCM Administrator	Role gives full control over all aspects of ADCM	None

Permissions and roles

In addition to the built-in roles, ADCM administrator can create custom roles with permissions. Available permissions and their relations to the built-in roles are listed in the table below.

Permissions and roles
Permission name	Description	ADCM User	Service Administrator	Provider Administrator	Cluster Administrator	ADCM Administrator	ADCM Auditor
View any object configurations	The ability to view any object configurations	+				+
View cluster configurations	The ability to view cluster configurations				+	+
View service configurations	The ability to view service configurations		+		+	+
View component configurations	The ability to view component configurations		+		+	+
View provider configurations	The ability to view hostprovider configurations			+		+
View host configurations	The ability to view host configurations		+	+	+	+
Edit cluster configurations	The ability to edit cluster configurations				+	+
Edit service configurations	The ability to edit service configurations		+		+	+
Edit component configurations	The ability to edit component configurations		+		+	+
Edit provider configurations	The ability to edit hostprovider configurations			+		+
Edit host configurations	The ability to edit host configurations			+	+	+
View any object imports	The ability to view imports of all objects	+				+
View imports	The ability to view imports of a chosen object		+		+	+
Manage Imports	The ability to manage imports		+		+	+
View any cluster host-components	The ability to view any cluster hosts and components mappings	+				+
View Host-Components	The ability to view hosts and components mapping		+		+	+
Manage Host-Components	The ability to change hosts and components mapping				+	+
Add service	The ability to add services to cluster				+	+
Remove hosts	The ability to remove hosts (in the *Hosts* section)			+		+
Add hosts to the cluster	The ability to add hosts to the cluster				+	+
Remove hosts from the cluster	The ability to remove hosts from the cluster				+	+
Upgrade cluster bundle	The ability to upgrade the cluster bundle				+	+
Upgrade provider bundle	The ability to upgrade the hostprovider bundle			+		+
Create hostprovider	The ability to create hostproviders					+
Create host	The ability to create hosts			+	+	+
Remove hostprovider	The ability to remove hostproviders					+
Create cluster	The ability to create clusters					+
Remove cluster	The ability to remove clusters					+
Upload bundle	The ability to upload bundles			+	+	+
Remove bundle	The ability to remove bundles			+	+	+
View audit operations	The ability to view results of operations audit	+	+	+	+	+	+
View audit logins	The ability to view results of logins audit	+	+	+	+	+	+
View ADCM settings	The ability to view settings					+
Edit ADCM settings	The ability to edit settings					+
View users	The ability to view users					+	+
Add new user	The ability to create users					+
Delete user	The ability to remove users					+
Update user	The ability to update users					+
View roles	The ability to view roles					+	+
Add new role	The ability to create roles					+
Delete role	The ability to remove roles (only for custom roles)					+
Update role	The ability to update roles (only for custom roles)					+
View groups	The ability to view groups					+	+
Add new group	The ability to create groups					+
Delete group	The ability to remove groups					+
Update group	The ability to update groups					+
View policies	The ability to view policies					+
Add new policy	The ability to create policies					+
Delete policy	The ability to remove policies					+
Update policy	The ability to update policies					+
Cluster Action: <Action name>	The ability to perform the <Action name> action				+	+
Host Action: <Action name>	The ability to perform the <Action name> action			+	+	+
Service Action: <Action name>	The ability to perform the <Action name> action		+		+	+
Component Action: <Action name>	The ability to perform the <Action name> action		+		+	+
Provider Action: <Action name>	The ability to perform the <Action name> action			+		+

Found a mistake? Seleсt text and press Ctrl+Enter to report it