Security Groups

In the NNMi security model, user access to nodes is controlled indirectly though user groups and security groups. Each node in the NNMi topology is associated with only one security group. A security group can be associated with multiple user groups.

Each user account is mapped to the following user groups:

• One or more of the following preconfigured NNMi user groups:

  • NNMi Administrators
  • NNMi Global Operators
  • NNMi Level 2 Operators
  • NNMi Level 1 Operators
  • NNMi Guest Users

  This mapping is required for NNMi console access and determines which actions are available within the NNMi console. If a user account is mapped to more than one of these NNMi user groups, the user receives the superset of the permitted actions.

  Note The NNMi Web Services Clients user group does not grant access to the NNMi console; however, it does grant administrator-level access to all NNMi objects.

  Note The NNMi Global Operators User Group (globalops) grants access to topology objects only. A user must be assigned to one of the other User Groups (level2, level1, or guest) to access the NNMi console.

  The administrator should not map the globalops User Group to any security group because this User Group is, by default, mapped to all security groups.

• Zero or more custom user groups that are mapped to security groups.

  These mappings provide access to objects in the NNMi database. Each mapping includes an object access privilege level that applies to the nodes for a security group. The object access privilege level also applies to the related database objects, such as interfaces and incidents. For example, a user with Object Operator Level 1 access to node A containing interfaces X and Y has Object Operator Level 1 access to all of the following database objects:

  • Node A
  • Interfaces X and Y
  • Incidents whose source object is node A, interface X, or interface Y

NNMi provides the following security groups:

• Default Security Group

  In a new NNMi installation, the Default Security Group is the initial security group assignment for all nodes. By default, all users can see all objects in the Default Security Group. The NNMi administrator can configure which nodes are associated with the Default Security Group and which users can access the objects in the Default Security Group.

• Unresolved Incidents

  The Unresolved Incidents security group provides access to incidents that NNMi creates from received traps whose source node is not in the NNMi topology. By default, all users can see all incidents associated with the Unresolved Incidents security group. The NNMi administrator can configure which users can access the incidents associated with the Unresolved Incidents security group.

All sensors inherit the security group assignment of the node.