By default, the Grid Master denies access to Grid members when a limited-access admin group does not have defined permissions. You can grant an admin group read-only or read/write permission, or deny access to all Grid members or you can grant permission to specific Grid members, as described in Applying Permissions and Managing Overlaps About Administrative Permissions#bookmark423.

Note: Only superusers can modify DNS and DHCP Grid properties.

The following sections describe the types of permissions that you can set with Grid permissions:

• • Administrative Permissions for Grid Members
  • Administrative Permissions for Network Discovery
  • Administrative Permissions for Scheduling Tasks
  • Administrative Permissions for Microsoft Servers

Administrative Permissions for Grid Members
Table 4.8 lists the tasks admins can perform and the required permissions for Grid members.


















NIOS 8.1NIOS Administrator Guide (Rev. A)241
Managing Administrators

Table 4.8 Grid Member Permissions

Administrative Permissions for Network Discovery
Limited-access admin groups can initiate a discovery and manage discovered data based on their administrative permissions.
You can set global permissions for network discovery as described in Defining Global Permissions . The following table lists the tasks admins can perform and the required permissions for network discovery.
Table 4.9 Permissions for Network Discovery

242NIOS Administrator Guide (Rev. A)NIOS 8.1
Administrative Permission for the Grid
Administrative Permissions for Scheduling Tasks
You can schedule tasks, such as adding hosts or modifying fixed addresses, for a future date and time. To schedule tasks, you must first enable the scheduling feature at the Grid level, and then define administrative permissions for admin groups and admin roles. For information, see Scheduling Tasks . Only superusers can enable and disable this feature and grant scheduling permissions to admin groups. Limited-access admin groups can schedule tasks only when they have scheduling permissions.
Superusers can do the following:

• • Enable and disable task scheduling at the Grid level
  • Grant and deny scheduling permissions to admin groups and admin roles
  • Schedule tasks for all supported object types
  • Reschedule and delete any scheduled task

You can set global permissions to schedule tasks as described in Defining Global Permissions . The following table lists the tasks admins can perform and the required permissions. Users with read/write permission to scheduling can view, reschedule, and delete their own scheduled tasks.
Table 4.10 Scheduling Task Permissions

To schedule tasks for specific resources, admins must have Read/Write permission to scheduling tasks, plus the required permissions to the supported resources. For information about permissions for specific resources, see the following:

• • Grid members—See Administrative Permission for the Grid 1.
  • DNS resources—See Administrative Permissions for DNS Resources 6.
  • DHCP resources—See Administrative Permissions for DHCP Resources .

Note that the appliance deletes all pending scheduled tasks when superusers disable task scheduling at the Grid level. The appliance deletes an admin's scheduled tasks when superusers do the following:

• • Set the scheduling permission of admin groups and roles to "Deny"
  • Delete or disable an admin group or an admin role
  • Delete or disable local admins
  • Delete the scheduling permission from any admin group or admin role that contains users with pending scheduled tasks
  • Change the admin group of a limited-access admin

Administrative Permissions for Microsoft Servers

By default, only superusers can add Microsoft servers as managed servers to the Grid. Limited-access admins can add and manage Microsoft servers from the Grid based on their administrative permissions.
The following table lists the tasks admins can perform and the required permissions. Note that only superusers can add a Microsoft server to a name server group.



NIOS 8.1NIOS Administrator Guide (Rev. A)243
Managing Administrators

Table 4.11 Microsoft Server Permissions

Administrative Permissions for IPAM Resources
Limited-access admin groups can access certain IPAM resources only if their administrative permissions are defined. By default, the appliance denies access when a limited-access admin group does not have defined permissions. You can grant admin groups read-only or read/write permission, or deny access to the following IPAM resources:

• • Network views
  • IPv4 networks
  • IPv6 networks
  • Hosts

The appliance applies permissions for IPAM resources hierarchically. Permissions to a network view apply to all networks and resources in that view. You can also grant an admin group broad permissions to IPAM resources, such as read/write permission to all IPv4 networks and IPv6 networks in the database. In addition, you can grant permission to a specific host in a network. Permissions at more specific levels override global permissions.
The following sections describe the types of permissions that you can set for IPAM resources:

• • Administrative Permissions for Network Views

244NIOS Administrator Guide (Rev. A)NIOS 8.1
Administrative Permissions for IPAM Resources

• • Administrative Permissions for IPv4 and IPv6 Networks
  • Administrative Permissions for Hosts

Administrative Permissions for IPv4 and IPv6 Networks

Limited-access admin groups can access IPv4 and IPv6 networks only if their administrative permissions are defined. Permissions for a network apply to all its DNS and DHCP resources, if configured. To override network-level permissions, you must define permissions for specific objects within the networks. You can also define permissions for specific DHCP objects and Grid member to restrict admins to perform only the specified DHCP tasks on the specified member. For more information, see Defining DNS and DHCP Permissions on Grid Members .
You can grant read-only or read/write permission, or deny access to networks, as follows:

• • All IPv4 or IPv6 networks—Global permission that applies to all networks in the database.
  • A specific network—Network permissions apply to all objects in the network. This overrides global permissions.
  • A specific network on a specific member—Network permissions apply to all objects in the network and member permissions apply to the specific member. For information about member permissions, see Modifying Permissions on a Grid Member .

Administrative Permissions for Hosts

A host record can contain both DNS and DHCP attributes if you configure them. When applying administrative permissions to host records, the permissions apply to all relevant DNS and DHCP resources within the host records. You can define global permissions to all hosts. To override global permissions, you must define permissions for specific hosts.
You can grant read-only or read/write permission, or deny access to host records, as follows:

• • All hosts—Global permission that applies to all host records in the Grid.
  • A specific host—Object permission that applies only to a selected host.

Administrative Permissions for DHCP Fingerprint Permissions

NIOS provides a global permission for all All DHCP Fingerprints; however, it does not support object level permissions for fingerprints. To use fingerprint filters, you must have superuser privileges.

Administrative Permissions for Network Insight Tasks

Table 4.12 summarizes the permissions you need to perform various tasks related to device discovery.
Table 4.12 Permissions for Network Discovery

NIOS 8.1NIOS Administrator Guide (Rev. A)245
Managing Administrators