# Role-Based Access Control (RBAC)

> Overview
> RBAC Concepts
> Authentication
> Role
> Authorization
> Rights Profile
> Sun Cluster RBAC Rights Profiles

> Actions
> Setting Up and Using RBAC
> Specifying a Role When You Log In to SunPlex Manager
> Changing a Role

## RBAC Concepts

### Authentication

The ability to securely identify a user, a user's name, and some form of proof of the user's identity (typically a password). The process of specifying a client's user identity to the cluster, and then demonstrating that that client really is that particular user by specifying that user's credentials.

### Role

A special identity for running privileged applications that only assigned users can assume.

### Authorization

A permission that can be assigned to a role or user (or embedded in a rights profile) for performing a class of actions that are otherwise prohibited by security policy. A privileged application can check a user's authorizations before that application grants access to specific features or functionality. The
auth_attr
(4) man page contains additional information.

### Rights Profile

A collection of authorizations, profiles, and permitted commands (referred to as security attributes), and other rights profiles that are assigned to a user or to a role identity.

You can grant permissions to a user, or role identity, that allow that user to access and modify cluster parameters. You grant these permissions by using the Rights tool in the Solaris Management Console User tool. The granting of permissions to a user is described in "Creating or Changing a Rights Profile" in System Administration Guide: Security Services. The
prof_attr
(4) man page contains additional information.

Return to top

## Sun Cluster RBAC Rights Profiles

SunPlexTM Manager and selected SunTM Cluster commands use RBAC for authentication. Several RBAC rights profiles are included in the Sun Cluster software. You can assign these rights profiles to users or to roles to give users different levels of access to Sun Cluster. Sun provides the following rights profiles with Sun Cluster software.

Rights Profile | Includes Authorizations | This Authorization Permits the Role Identity to
--- | --- | ---
Basic Solaris User | This existing Solaris rights profile contains Solaris authorizations, as well as: | Perform the same operations that the Basic Solaris User role identity can perform, as well as:
solaris.cluster.device.read | Read information about device groups
solaris.cluster.gui | Access SunPlex Manager. The authenticated user must also have read authorizations for one or more cluster objects to view cluster information through SunPlex Manager.
solaris.cluster.network.read | Read information about IP Network Multipathing Note: This authorization does not apply to SunPlex Manager.
solaris.cluster.node.read | Read information about attributes of nodes
solaris.cluster.quorum.read | Read information about quorum devices and the quorum state
solaris.cluster.resource.read | Read information about resources and resource groups
solaris.cluster.system.read | Read the status of the cluster
solaris.cluster.transport.read | Read information about transports
Cluster Operation | solaris.cluster.appinstall | Install clustered applications
solaris.cluster.device.admin | Perform administrative tasks on device group attributes
solaris.cluster.device.read | Read information about device groups
solaris.cluster.gui | Access SunPlex Manager. The authenticated user must also have read authorizations for one or more cluster objects to view cluster information through SunPlex Manager.
solaris.cluster.install | Install clustering software Note: This authorization does not apply to SunPlex Manager.
solaris.cluster.network.admin | Perform administrative tasks on IP Network Multipathing attributes Note: This authorization does not apply to SunPlex Manager.
solaris.cluster.network.read | Read information about IP Network Multipathing Note: This authorization does not apply to SunPlex Manager.
solaris.cluster.node.admin | Perform administrative tasks on node attributes
solaris.cluster.node.read | Read information about attributes of nodes
solaris.cluster.quorum.admin | Perform administrative tasks on quorum devices and quorum state attributes
solaris.cluster.quorum.read | Read information about quorum devices and the quorum state
solaris.cluster.resource.admin | Perform administrative tasks on resource attributes and resource group attributes
solaris.cluster.resource.read | Read information about resources and resource groups
solaris.cluster.system.admin | Administer the system Note: This authorization does not apply to SunPlex Manager.
solaris.cluster.system.read | Read the status of the cluster
solaris.cluster.transport.admin | Perform administrative tasks on transport attributes
solaris.cluster.transport.read | Read information about transports
System Administrator | This existing Solaris rights profile contains the same authorizations that the Cluster Management profile contains. | Perform the same operations that the Cluster Management role identity can perform, in addition to other system administration operations.
Cluster Management | This rights profile contains the same authorizations that the Cluster Operation profile contains, as well as the following authorizations: | Perform the same operations that the Cluster Operation role identity can perform, as well as:
solaris.cluster.device.modify | Modify device group attributes
solaris.cluster.network.modify | Modify IP Network Multipathing attributes Note: This authorization does not apply to SunPlex Manager.
solaris.cluster.node.modify | Modify node attributes Note: This authorization does not apply to SunPlex Manager.
solaris.cluster.quorum.modify | Modify quorum devices and quorum state attributes
solaris.cluster.resource.modify | Modify resource attributes and resource group attributes
solaris.cluster.system.modify | Modify system attributes Note: This authorization does not apply to SunPlex Manager.
| solaris.cluster.transport.modify | Modify transport attributes
Sun Cluster Commands | None, but includes a list of Sun Cluster commands that run with euid=0 | Execute selected Sun Cluster commands that you use to configure and manage a cluster, including: scgdevs (1M) scswitch (1M) (selected options) scha_control (1HA) scha_resource_get (1HA) scha_resource_setstatus (1HA) scha_resourcegroup_get (1HA) scha_resourcetype_get (1HA)

Return to top

## Setting Up and Using RBAC

Use the following table to determine the documentation to consult about setting up and using RBAC.

To | Refer to
--- | ---
Learn more about RBAC | "Role-Based Access Control (Overview)" in Solaris System Administration Guide: Security Services
Set up, manage elements of, and use RBAC with Sun Cluster | "Role-Based Access Control (Tasks)" in Solaris System Administration Guide: Security Services "Sun Cluster and RBAC" in Sun Cluster System Administration Guide
Learn more about RBAC elements and tools | "Role-Based Access Control (Reference)" in Solaris System Administration Guide: Security Services

Return to top

## Specifying a Role When You Log In to SunPlex Manager

To specify a role or no role when you log in to SunPlex Manager, complete the following steps.

1. Ensure that you possess the
   solaris.cluster.gui
   authorization.

   If you do not possess this authorization, you are not allowed to log in to SunPlex Manager.

2. On the SunPlex Manager Log In page, in the User Name and Password fields, type your user name and password.

3. Click Log In.

   If a role is assigned to your user account, the Log In With Roles page appears.

   Otherwise, the SunPlex Manager workspace appears.

4. Do you want to log in under a role or as yourself?

   - To log in as a role, choose the role that you want from the Role Name pull down menu, type the password for that role in the Role Password field, and click Log In.

   - To log in as yourself, choose No role from the Role Name pull down menu and click Log In.

   If you selected a role name and that role name or its associated role password is not successfully authenticated, the Role Authentication Failed warning appears on the Log In With Roles page.

   If this warning appears, specify another role name or role password.

   If you selected a role name, and the role name and role password are successfully authenticated, SunPlex Manager logs you in under that role. SunPlex Manager logs you in with the privileges that are associated with that role. The privileges that are associated with your user account are no longer available.

   If you selected No role, SunPlex Manager logs you in under your user name with the privileges that are associated with your user account.

   After you log in successfully, the SunPlex Manager workspace appears.

   The view of the cluster that you see is based on your authorized access.

## Changing a Role

To change a role while you are using SunPlex Manager, complete the following steps.

1. In the upper right corner of the SunPlex Manager workspace, click Log Out.

   SunPlex Manager exits.

2. Restart SunPlex Manager.

3. Follow the steps in Specifying a Role When You Log In to SunPlex Manager to log in to SunPlex Manager under the new role.

Return to top