How to configure basic role based access control

Ops Center Protector User Guide
Version
7.9.x
Audience
anonymous
Part Number
MK-99PRT002-10
ft:lastEdition
2024-12-11
You will need to have:
  • A Protector account with Default Administrator ACP authority. You will already have a <Username>@Master login with this authority if you installed Protector on the Master node. If you do not have an account with this authority then you will need to request one from your Protector administrator.
  • Knowledge of users and user groups who require access to Protector and their data protection roles and responsibilities.
  • The details of any authentication services that you intend to use to authenticate Protector users (e.g. Active Directory, LDAP, RADIUS etc.)

Refer to Access Control Concepts and Access Control UI Reference for further information.

Protector implements RBAC to control what actions users can perform on which resources. The RBAC implementation is extremely flexible and can be configured to be as open or restrictive as an organization demands.

This procedure will allow you to get up and running quickly, however to fully utilize RBAC's features you will need to setup a more advanced RBAC implementation. Refer to How to configure advanced role based access control for details on how to do this.

Protector includes the following built-in access control objects:
  • The 'default' Resource Group that all Protector nodes are a member of by default.
  • The Roles:
    • Protector Admin that can perform all activities.
    • Protector Security Manager that can perform all access control activities.
    • Protector Operator that can view all resources and perform restore activities.
  • The Access Control Profile:
    • Default Administrator that can perform all activities on all (default) resources.
  • The 'Master' Authentication Space that represents the local authentication service on the Master node's OS.
  • The following Access Control Profile Association (depending on the UserName of the account on the Master node specified when Protector was installed):
    • <UserName>@Master that represents a user that has Default Administrator privileges.

This topic explains how to implement a basic RBAC policy:

  1. Use a web browser to log on to the Protector user interface at: https://<Master>, where <Master> is the IP address or DNS name of the Master node.
    The Login Page will be displayed.
  2. Enter the username <UserName>@master and the associated password to log in with Default Administrator privileges.
  3. Click the Access Control link on the Navigation Sidebar to open the Access Control Dashboard.
  4. Create an Authentication Space that represents your organization's existing authentication service (see How to create an Authentication Space).
  5. Create ACP Associations for each user, group or entire authentication space that requires access to Protector, using one of the built-in Access Control Profiles (see How to create an Access Control Profile Association).
    You can create your own ACPs or clone an existing ACP and make changes to the clone (see How to create an access control profile and How to clone an access control profile).
  6. It is recommended that the default ACP Association <UserName>@master is replaced with your own ACP associations, using dedicated usernames created in your organization's domain.
    The default ACP Association cannot be deleted, but can be rendered unusable when the corresponding local Windows account is disabled. In the event that administrators are locked out from Protector due to access control configuration issues, this ACP Association is available as a way back in, by re-enabling the local Windows account.
    CAUTION:
    • The default ACP Association is generated automatically when Protector is installed, to enable initial configuration of access control features. This is based on the local Windows account specified during installation.
    • The default <Username>@Master ACP association should be assigned to a user with the specific responsibility as the primary Protector administrator, to ensure security is not compromised.
    • Access to the Master node should be strictly controlled to prevent malicious access to the Protector executables and associated configuration data.