Effective use of NetMRI requires an efficient and logical plan for user accounts. User account administration is a straightforward but fundamentally important part of a NetMRI rollout.

The two administrative concepts that are involved for NetMRI users include the user accounts themselves, and each account's associated Role.

You can define and authenticate your admin users remotely, where all users and their accounts are authenticated and authorized for their roles and privileges through an external server such as RADIUS or LDAP. This chapter describes how to set up local authentication services in NetMRI. For remote configurations, see NetMRI User Authentication and Authorization. You can also define and authenticate all of your admin users locally, where all user accounts and their assigned roles and privileges are defined in the NetMRI system.

User Administration in NetMRI

You define user administration functions in the Settings window (Settings icon –> User Admin section), performing the following tasks:

• Create, edit, and delete user accounts. Each user account is assigned one or more Device Groups over which they have some administrative functions.
• Define two primary types of users: local user and remote user.
  • Local users have their entire login credentials, user Roles, and device group permissions defined locally on the NetMRI appliance.
  • Remote users have Roles assignments and device group permissions defined in Authentication Service Properties, and those assignments and permissions are granted remotely through an external service.

• Create, edit, and delete user Roles. You assign Roles to each individual user account and define the privileges and tasks, and specific networks and network devices on which the NetMRI user can operate. A user account is ineffective without an assigned Role. A user account can use one or more Roles.
• Each Role is comprised of a set of access Privileges, which are the types of tasks that the user can carry out in their assigned Role.
• Review the Audit Log. The Audit Log provides records of all actions taken by all NetMRI users, showing the timestamp, event type and associated descriptive messages.

Several advanced User Administration settings are located in the Advanced Settings section. For more information, see Advanced User Administration Settings.

User administration provides support from external authentication servers. Because NetMRI supports both external authentication and authorization features through remote groups, mirroring the Roles and Privileges provided in local NetMRI user provisioning, you can leverage remote AAA server configurations (from TACACS+, LDAP, Active Directory, and RADIUS) without having to directly provision significant numbers of users on NetMRI.

Advantages of Remote Authentication and Authorization for Users

When a new user is authenticated and authorized through one of the remote services described in NetMRI User Authentication and Authorization, NetMRI automatically creates the new account locally and learns the Roles and device group assignments from the remote service. If there happens to be an established local user account, and the account login is authenticated and authorized by an external service, NetMRI will update its local profile to reflect the Roles and device group assignments granted by the last external authorization.

• User Roles and privileges are learned from the remote group assignment that is defined on the Authentication Service.
• Passwords, whether encrypted or plaintext, are not stored on the NetMRI appliance, and are consistently checked against the external server.
• On occasions when no external service is available, the user will be asked to use local login credentials. This requires enabling of the Local authentication service.

For more information on remote authentication and authorization of NetMRI users, see NetMRI User Authentication and Authorization and its subsections.

Managing User Data

For the Users and Roles pages, the Select check box is to the left of an Action icon. When you select multiple rows of a table, a whole page, or multiple pages of either data type, you can choose Delete from the Action menu for any selected row. You cannot edit multiple rows of data. The Delete option is the only available option after selecting multiple rows.

Doing so enables you to delete all selected records from the table. Exercise caution when performing this action, as you may unintentionally delete rows of data that you did not wish to select.

While it is possible to select the entire table's worth of data in the Users page (Settings icon –> User Admin –> Users), the admin user account can never be deleted; the default set of NetMRI Roles (Settings icon –> User Admin –> Roles) also may not be deleted (though they are otherwise editable) and the Delete option is ghosted for each of them in the Action menu. In all cases, NetMRI user accounts with read-only privileges will not be able to perform this action.

You can use a feature called Force Local Authentication for any user account in your appliance:

• Administrators can enable the Force Local Authentication check box for local user accounts to provide a specific profile to users that also exist on a remote authentication/authorization service. In the user configuration, you enable the Force Local Authorization option and its read-only Last Login value will show the external service name. Locally created user accounts automatically enable this option, which can be disabled at any time. If the user is learned by NetMRI through a remote authentication/authorization service, this option is automatically disabled.
• When a user is learned by NetMRI through a remote authentication/authorization service, the administration cannot then re-create the user account. You may activate the Force Local Authentication check box for an externally learned account and redefine its password and other user details. The Local authentication service also must be placed first in the Authentication Services list. Taking these steps, you can ensure that an account is verified and authorized locally, without using the same login defined on the external service. An alternative is to define a different local login credential for the user.
• The Force Local Authentication setting is automatically enabled for all new locally created users.

You can change local user accounts settings at any time:

• You can change the local user password.
• You can disable a user account at any time.
• You can change assigned Roles and device groups for an account, but changes will persist only when the account is locally authenticated and authorized, with the Local authentication service taking the highest Priority setting and the Force Local Authentication check box enabled for the account.
• You can define CLI credentials, notes, and Email settings for all users in the User database.

Understanding Users and Roles

User accounts are the standard identities of all users of the NetMRI appliance.

You assign roles to each user account, after assigning the privileges that each user account is allowed to perform. User accounts are granular to individuals, while roles apply across different accounts.

NetMRI provides a set of pre-defined Roles with specific privileges in NetMRI, as follows:

You can create custom Roles, with custom sets of privileges to suit the needs of your organization. You can add and remove privileges and user accounts from each of the pre-defined Roles in the NetMRI appliance.

See Defining and Editing Roles for more information.

The 17 default Roles built into the system cannot be deleted from the appliance. Custom Roles can be deleted and edited.

Creating User Account s

You create, edit, and delete user accounts in the Users page (Settings icon –> User Admin section –> Users). By default, the admin account is the single user account built into the appliance. You cannot remove this account.

In the Users window, each user account lists the following:

• User Name: The network identity of the user.
• First Name and Last Name: The configured first name and surname for the user.
• Last Login: The time and date of the last login.
• Last Authentication: Shows the authentication service that granted the last login.
• Last Authorization: This field is updated at each user login. Possible values are as follows:
  • Remote: When the user logs in using their remote password, and their Force Local Authorization setting is set to False for their user account. The user is granted the roles defined from the remote group assignment in the authentication service properties.
  • Local: In cases where the user simply logs in using their local appliance password or, when the user logs in to the remote authentication service using their remote password, and the Disable Authorization checkbox is enabled for that service is disabled for their account.
  • Forced Local: When the user logs-in using their remote password and their Force Local Authorization setting is set to False in their User properties. The user is granted the local roles and access to their device groups.
    
    For remotely authenticated users, including new accounts learned from logins to a configured remote service, the field will show No and the service will show the service name.

• Roles: The role(s) assigned to the account.
• Account Status (active or disabled): An admin can disable a user account by enabling its Account Disabled check box. When you do so, the user will receive a User Disabled or Locked message upon the subsequent login.

When scheduling or running a job (see Creating and Scheduling Jobs for more information), if user credentials are required and the Use the requester's stored CLI credentials or Use the approver's stored CLI credentials job options are selected, then the CLI credentials associated with the given user account are used to login to the network devices that are part of the job. Admins can modify command-line execution credentials for each created user account through the CLI Credentials tab. For more information, see the corresponding procedure further in this section.

To create a new user account, complete the following:

1. Click Add User (below the table).
2. In the Add New User dialog –>User Details tab, enter values for the First Name, Last Name, Username, and Password fields. Fill in optional fields as needed.
   • If you want the new account to be disabled by default, check the Account Disabled check box.
   • If you want the user to be authenticated and authorized by the NetMRI appliance for their roles and device group assignments, check the Force Local Authorization check box. This enables the user to have a locally defined login that is separate from the remote one on the AAA server. Leaving this check box clear enables the user account to be subjected to authorization through a remote AAA server.
3. Click Save. The Roles and CLI Credentials tabs activate, allowing you to assign Roles to the account.
4. In the Roles tab, click Add.
5. In the Add Role to User <username> dialog, choose a role from the drop-down list.
6. In the Device Groups list, click to choose the device group(s) the user is allowed to access. Click All (the first item in the list) to allow the user account to access all device groups.
7. Click OK. The new Role settings are saved for the user account.
8. In the Add New User dialog, click the Close button.

To edit an existing user account, complete the following:

1. Click the Edit icon for the account.
2. In the Edit User dialog, make the necessary changes, and then click the Close button.

To delete a user account, complete the following:

1. Click the Delete icon for the account.
2. Confirm the deletion.

To define command-line credentials for a user account, complete the following:

1. In the Edit User dialog, click the CLI Credentials tab for the user account. This tab allows CLI credentials (username, password, and Enable password for devices) to be associated with specific user accounts.
2. If desired, enable the User CLI Credentials Enabled check box. The admin account can log in to network devices using the CLI credentials associated with the given account, instead of the admin credentials associated with devices during their Discovery.
3. Enter the user's Username and Password values, and confirm the password.
4. Enter the admin account's Enable Password and confirm it.

Defining and Editing Role s

A role defines what a user can do within NetMRI. Each role consists of a set of privileges, each of which specifies a distinct permitted activity. The Roles page (Settings icon –> User Admin –> Roles) enables an administrator to create, edit, and delete roles.

To create a new role, complete the following:

1. Click Add (below the table).
2. In the Add Role dialog –> Users tab, enter a descriptive name in the Name field.
3. In the Description field, describe the role.
4. Click Save. This adds the new role to the Roles table. Users and Privileges tabs appear.

5. In the Users tab, click Add. The Add User for <Username> Role dialog appears, displaying a Users drop-down list and the list of Device Groups in the appliance.

6. In the Add User for <Username> Role dialog –> User drop-down list, choose one or more users for the role.

7. In the Device Group table, select the device group check boxes to be associated with this role.

8. Click OK.

9. As needed, repeat steps 5 through 8 for other accounts.

To specify privileges for the role, perform the following:

1. In the Edit Role –> Privileges tab, click Add.
2. In the Add Privileges dialog, select the Privileges check boxes (see list below) to be associated with the role.
3. Click OK.
4. In the Edit Role dialog, click Save & Close.

Editing Roles

To edit a role, perform the following:

1. Click the Edit button for the role.
2. In the Edit Role dialog, as needed, edit the Name and/or Description.
3. Add or delete users/device groups in the Users tab and add or delete privileges in the Privileges tab.
4. Click Save.

To copy a role, perform the following:

1. Click the Copy button for the role.
2. Confirm the copy.

The copied role appears in the list as "<previous name Copy>." To delete a role, complete the following:

1. Click the Delete button for the role.
2. Confirm the deletion.

Privilege Descriptions

The following NetMRI system privileges can be assigned to Roles:

Viewing the User Audit Lo g

The Audit Log (Settings icon –> User Admin –> Audit Log) lists all actions taken by user accounts that result in changes to NetMRI or any of the data sets the account manages. Log entries include the timestamp in which the action was taken, the User name, a description of the action, and field change details when applicable.

Log entries are initially ordered by time, with the most recent at the top of the list. The table can be reordered to, for example, consolidate a particular user's actions. Alternatively, use quick searching to isolate specific log entries.

Managing User Audit Logs for SSH Connection Attempts to Devices

As an aid to track what NetMRI or its users are doing on the network, you can also view the audit logs for all events in which NetMRI or its users attempt to use SSH or Telnet sessions to network devices. The amount of data collected for such events can substantially impact the size of the collected event database, so you can switch this feature on and off when needed and change the duration of these events being held in the database. Connection events that are covered by this log category include SSH/Telnet connections for Config Collection, Credential Collection, terminal emulation, and Job Engine Run connections. Unknown connections may also be recorded, which will be events such as API calls.

To view and change these settings, go to Settings icon –> General Settings –> Advanced Settings –> Notification category –> Log All CLI Sessions. The default value is On. You can also choose the No Commands Logged option, which retains the session events but prevents any sensitive CLI data from being recorded.

An associated Advanced Setting, Prune CLI Session Duration, enables you to regularly prune the amount of CLI session data by setting the retention time for keeping that data in the Device Audit Log. The default setting is 7 days.

Advanced User Administration Settings

Several important global NetMRI user account settings are located in the Advanced Settings section. To access them, go to Settings icon –> General Settings –> Advanced Settings, and then use the Next Page button to get to the User Administration category. Advanced User Administration settings determine the following: