OneClick. Administration Guide. Document 5166

Transcription

1 OneClick Administration Guide Document 5166

2 Notice This documentation (the "Documentation") and related computer software program (the "Software") (hereinafter collectively referred to as the "Product") is for the end user's informational purposes only and is subject to change or withdrawal by CA at any time. This Product may not be copied, transferred, reproduced, disclosed, modified or duplicated, in whole or in part, without the prior written consent of CA. This Product is confidential and proprietary information of CA and protected by the copyright laws of the United States and international treaties. Notwithstanding the foregoing, licensed users may print a reasonable number of copies of the Documentation for their own internal use, and may make one copy of the Software as reasonably required for back-up and disaster recovery purposes, provided that all CA copyright notices and legends are affixed to each reproduced copy. Only authorized employees, consultants, or agents of the user who are bound by the provisions of the license for the Software are permitted to have access to such copies. The right to print copies of the Documentation and to make a copy of the Software is limited to the period during which the license for the Product remains in full force and effect. Should the license terminate for any reason, it shall be the user's responsibility to certify in writing to CA that all copies and partial copies of the Product have been returned to CA or destroyed. EXCEPT AS OTHERWISE STATED IN THE APPLICABLE LICENSE AGREEMENT, TO THE EXTENT PERMITTED BY APPLICABLE LAW, CA PROVIDES THIS PRODUCT "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT. IN NO EVENT WILL CA BE LIABLE TO THE END USER OR ANY THIRD PARTY FOR ANY LOSS OR DAMAGE, DIRECT OR INDIRECT, FROM THE USE OF THIS PRODUCT, INCLUDING WITHOUT LIMITATION, LOST PROFITS, BUSINESS INTERRUPTION, GOODWILL, OR LOST DATA, EVEN IF CA IS EXPRESSLY ADVISED OF SUCH LOSS OR DAMAGE. The use of this Product and any product referenced in the Documentation is governed by the end user's applicable license agreement. The manufacturer of this Product is CA. This Product is provided with "Restricted Rights." Use, duplication or disclosure by the United States Government is subject to the restrictions set forth in FAR Sections , , and (c)(1) - (2) and DFARS Section (c)(1)(ii), as applicable, or their successors. All trademarks, trade names, service marks, and logos referenced herein belong to their respective companies. Copyright 2007 CA. All rights reserved.

3 Contents Preface OneClick Administration Overview Chapter 1: SPECTRUM OneClick Web Server Administration Commonly Used SPECTRUM OneClick Terms Stop and Start the OneClick Web Server Configure OneClick Server to Support Over 100 Users Launch OneClick Clients with Context Configure OneClick Memory Settings OneClick Client Memory Settings OneClick Web Server Memory Settings Configure the OneClick Web Server URL Configure OneClick MySQL Server Password Chapter 2: OneClick Server Communications and Network Configuration Configure OneClick for Secure Sockets Layer Import a Certificate Authority-Signed Certificate Configure the Secure Socket on the OneClick Web Server Host Configure OneClick and Report Manager for Secure Sockets Layer Troubleshoot a Secure Sockets Layer Configuration Configure OneClick to Communicate through a Web Proxy Server Configure OneClick Web Server to Communicate with SpectroSERVER(s) in Firewalled Environments Configure OneClick Web Server in NAT Environments OneClick Server and SpectroSERVER Behind NAT Firewall OneClick Server Outside NAT, SpectroSERVERs Inside NAT OneClick Web Server and Load Balancers Chapter 3: OneClick Administration Web Pages Activation Key ARS Configuration Character Set ehealth Configuration ehealth Configuration ehealth Map Maintenance Configuration EvFormat/PCause Configuration Landscapes LDAP Configuration

4 Contents LDAP Server Settings Save LDAP Passwords to SPECTRUM Database User Name Lookup Test LDAP Configuration MySQL Password Configure OneClick MySQL Server Password NSM Configuration Service Desk Configuration SPECTRUM Configuration SPM Data Export SSL Certificates Web Server Logs Configuration Web Server Memory Chapter 4: User Administration in OneClick SPECTRUM OneClick User Administration Terminology SPECTRUM OneClick User Administration Best Practices for Creating and Managing User Accounts Who Can Perform User Administration? About Licenses and Privileges OneClick User Administration Interface Users Tab Manage an Existing User or User Group Users List Tab Access Tab View and Change User or User Group Details View and Change Privileges Implement User Administration Create User Accounts and User Groups Manage Users Within User Groups Inheritance Details for Users in User Groups Edit Existing Users and User Groups Create and Assign Roles to Users or User Groups Grant a User All Privileges by Designating it a Super User Allow Users to Login if No Corresponding LDAP User Found Change Details Displayed for a User or User Group Change Licenses Assigned to a User or Group Change the Landscapes a Selected User is Present In Change Individual Privileges for a User or User Group Move an Existing User to a User Group Remove a User from a User Group OneClick Administration Guide

5 Contents Delete a User or User Group Use Security Communities to Manage User Access to Models and Devices Manage Users From the Client Details Web Page Manage OneClick Licenses by Limiting Concurrent User Logins Chapter 5: Configuring Additional OneClick Applications Configuring Service Performance Manager (SPM) Data Export Parameters in OneClick Display Topology Tab Contents in a Web Page Chapter 6: Model Security in OneClick SPECTRUM OneClick Model Security Terminology What is Model Security in SPECTRUM OneClick? Using Security Strings to Secure Modeled Elements Scenarios for implementing model security Chapter 7: Setting Preferences for Users and Groups Introduction to Preferences About the Preferences Editor Setting and Locking Preferences Setting Alarm Filter Preferences Resetting Preferences Appendix A: Troubleshooting OneClick Web Server Issues Export Fails Due to Java Memory Resources Setting Troubleshoot OneClick in Fault Tolerant Environments Appendix B: System Customizations Server.xml Customization Parameters Web.xml Customization Parameters Index OneClick Administration Guide 5

6 Contents 6 OneClick Administration Guide

7 Preface The SPECTRUM OneClick product suite is a framework that houses and integrates SPECTRUM network management features (core and add-on management). The OneClick Administration Guide (5166) identifies server and client administration concepts and procedures. OneClick Administration Overview OneClick administration tasks fall into the following broad categories: Web server physical plant related Communications and network configuration Integrating with infrastructure, including servers and authentication systems User accounts Model security SPECTRUM application configuration OneClick customizations Some of these tasks are performed by a OneClick administrator in the OneClick user interface, such as user configuration and setting preferences. Some tasks are performed in the OneClick Administration Web pages, while others are done by editing files on the OneClick server to modify server settings or make customizations in OneClick. These administration topics are presented in the following chapters: SPECTRUM OneClick Web Server Administration. This chapter is most helpful following the installation of SPECTRUM OneClick. It discusses tasks the OneClick administrator can perform to optimize and configure OneClick server. Other server and client-related maintenance and configuration issues are also addressed. For more information see SPECTRUM OneClick Web Server Administration on page 11. OneClick Server Network Configuration. This chapter describes how to configure the OneClick server with Secure Sockets Layer, web proxy servers, and fire-walled environments. For more information see OneClick Server Communications and Network Configuration on page 19 7

8 Preface OneClick Administration Web Pages. This chapter introduces the OneClick Administration Web pages available to users with administrative privileges from the OneClick main web page. For more information see OneClick Administration Web Pages on page 29. SPECTRUM User Administration in OneClick. This chapter instructs OneClick administrators how to create and administer users in the OneClick environment. This includes a discussion of basic SPECTRUM security concepts as well as the more advanced tasks that must be performed to implement OneClick user and network security. For more information see User Administration in OneClick on page 37. SPECTRUM Security in OneClick. This chapter instructs OneClick administrators how to implement SPECTRUM model security in the OneClick environment. This includes a discussion of basic SPECTRUM security concepts as well as the more advanced tasks that must be performed to implement OneClick network security. For more information see Model Security in OneClick on page 73. Preferences Administration in OneClick. This chapter instructs OneClick administrators how to configure preference settings for one or more OneClick users. For more information see Setting Preferences for Users and Groups on page 83. Troubleshooting OneClick Web Server Issues. Appendix A identifies problems and error messages that may be generated during the operation of the OneClick web server and includes corrective action where feasible. For more information see Troubleshooting OneClick Web Server Issues on page 89. System Customizations. Appendix B discusses parameters to edit in certain XML configuration files on the OneClick web server to customize the server and client environment. For more information see System Customizations on page OneClick Administration Guide

9 Preface Text Conventions The following text conventions are used in this document: Element Convention Used Example Variables (The user supplies a value for the variable.) The directory where you installed SPECTRUM (The user supplies a value for the variable.) Courier and Italic in angle brackets (<>) <$SPECROOT> Type the following: DISPLAY=<workstation name>:0.0 export display Navigate to: <$SPECROOT>/app-defaults Linux, Solaris, and Windows directory paths Unless otherwise noted, directory paths are common to all operating systems, with the exception that slashes (/) should be used in Linux and Solaris paths, and backslashes (\) should be used in Windows paths. <$SPECROOT>/app-defaults on Linux and Solaris is equivalent to <$SPECROOT>\app-defaults on Windows. On-screen text Courier The following line displays: path= /audit User-typed text Courier Type the following path name: C:\ABC\lib\db Cross-references Underlined and hypertextblue See Document Feedback on page 9. References to SPECTRUM documents (title and number) Italic Installation Guide (5136) Document Feedback Please send feedback regarding SPECTRUM documents to the following address: Spectrum-docs@aprisma.com Thank you for helping us improve our documentation. Online Documents SPECTRUM documents are available online at: Check this site for the latest updates and additions. OneClick Administration Guide 9

10 Preface 10 OneClick Administration Guide

11 Chapter 1: SPECTRUM OneClick Web Server Administration In This Chapter Commonly Used SPECTRUM OneClick Terms on page 12 Stop and Start the OneClick Web Server on page 12 Configure OneClick Server to Support Over 100 Users on page 13 Launch OneClick Clients with Context on page 13 Configure OneClick Memory Settings on page 14 Configure the OneClick Web Server URL on page 16 Configure OneClick MySQL Server Password on page 16 11

12 Chapter 1: SPECTRUM OneClick Web Server Administration Commonly Used SPECTRUM OneClick Terms The following table identifies commonly-used SPECTRUM OneClick terms that you should be familiar with prior to reading the chapters in this guide. Table 1-1: Commonly-used SPECTRUM OneClick Terms Landscape SpectroSERVER Distributed SpectroSERVER (DSS) Environment OneClick Web server OneClick client The Landscape is the network domain managed by a single SpectroSERVER. The SpectroSERVER is the server responsible for providing network management services such as polling, trap management, notification, data collection, fault management, etc. Also referred to as the Virtual Network Machine (VNM). A Distributed SpectroSERVER (DSS) environment consists of more than one SpectroSERVER. This environment enables management of a large-scale infrastructure. The SpectroSERVERs in this environment may be located within a single physical location or multiple physical locations. The OneClick Web server is the server responsible for moving data between the SpectroSERVER(s) and OneClick clients. The OneClick client is a Java JNLP application which provides network operators with a view into the details and health of the network. Stop and Start the OneClick Web Server To stop or start the OneClick Web server, use the following procedures for Solaris, Linux, and Windows platforms. To Stop or Start the OneClick Web Server on Solaris and Linux Systems: As root, use the following commands: To stop the Web server: <$SPECROOT>/tomcat/bin/stopTomcat.sh To start the Web server: <$SPECROOT>/tomcat/bin/startTomcat.sh To restart (stops, then starts) the Web server: <$SPECROOT>/tomcat/webapps/spectrum/restart.sh 12 OneClick Administration Guide

13 Configure OneClick Server to Support Over 100 Users To Stop or Start the OneClick Web Server on a Windows System: From a command prompt in Windows: To stop the Web server: C:\> net stop spectrumtomcat To start the Web server: C:\> net start spectrumtomcat From the Windows Control Panel: 1. From the Windows Desktop, select Start, Control Panel. The Windows Control Panel appears. 2. In the Control Panel, double-click Administrative Tools, then double-click Services. The Services window appears. 3. Select SpectrumTomcat from the services list and determine its status. 4. Do one of the following: If the SpectrumTomcat service is running, click Stop to stop the Web server; click Restart to stop and then start the Web server. If SpectrumTomcat is stopped, click Start to start the Web server. Configure OneClick Server to Support Over 100 Users To support a large number of users on a single Solaris OneClick server, increase the hard limit on the number of file descriptors. CA recommends that you do this to ensure support for more than 100 OneClick console users. To Change /etc/system File 1. Make a backup of your /etc/system file. 2. Add this line to your /etc/system file: set rlim_fd_max=4096 Launch OneClick Clients with Context You may want to launch OneClick clients within the context of a certain topology or model. This can be done by passing contextual parameters and values with the URL that launches OneClick. The URL can include parameters in the following form: The available parameters and examples of their use are described below. Topology The value of the topology parameter can be a model handle or an IP address. Using this parameter in a URL launches a OneClick client or reuses an existing one, selects the Explorer tab if not already selected, expands the tree to show the model, selects the Topology tab if not already selected, and selects in the Topology panel the model specified by the topology parameter in the URL. OneClick Administration Guide 13

14 Chapter 1: SPECTRUM OneClick Web Server Administration Examples: Explorer The value of the explorer parameter can be a model handle or an IP address. Using this parameter in a URL launches a OneClick client or reuses an existing one, selects the Explorer tab if not already selected, and expands the tree to show the model. The currently selected tab in the Contents panel will reflect the new model. Examples: alarm The value of the alarm parameter can be either the integer alarm ID (to facilitate integration with legacy applications), the complete global alarm ID (in the form 3f983d3d b- 000bdb5a1c31), or <model handle>@<alarm ID>. Using this parameter in a URL launches a OneClick client or reuses an existing one, selects the Explorer tab if not already selected, expands the tree to show the model, selects the Alarms tab if not already selected, and selects the alarm. Examples: where 0x d@7710 is <modelhandle>@<alarm ID> and where 7710 is the integer <alarm ID>. If passing the integer alarm ID, it is best to also pass the model handle because the integer alarm ID is not guaranteed to be unique across SpectroSERVERs. The full global alarm ID is preferable as it is unique across SpectroSERVERs but it may not be available to the application launching OneClick. Note: When launching in context, a new instance of OneClick will not be launched if an instance is already running on the host machine. The context will be changed in the current instance of OneClick. Configure OneClick Memory Settings OneClick has default settings for the server and client systems. You can adjust these settings after installing OneClick. OneClick Client Memory Settings By default, the initial memory foot print of OneClick clients is 64 megabytes, with a maximum size of 256 megabytes. You can increase the initial size of the memory footprint to 128 megabytes by doing the following: Note: This change will apply to all OneClick clients. Consideration should be given to any client machines that do not have sufficient resources to fulfill the initial-heap-size value. 14 OneClick Administration Guide

15 Configure OneClick Memory Settings 1. Find the following line in the <$SPECROOT>/tomcat/webapps/spectrum/oneclick.jnlp file: <j2se version="1.5.0+" href=" autodl/j2se" initial-heap-size="64m" max-heap-size="256m" />/> 2. Change the line above to read as follows: <j2se version="1.5.0+" href=" autodl/j2se" initial-heap-size="128m" max-heap-size="256m" /> 128 and 256 megabytes are the recommended increases for minimum and maximum respectively but can be set higher if necessary. For example, to set minimum and maximum memory to 256MB and 512MB respectively, the settings are: initial-heap-size="256m" max-heap-size="512m" /> Important: Any changes to the oneclick.jnlp file will be overwritten during the next OneClick upgrade. You must save the changed oneclick.jnlp file and put back the changes after the upgrade. Restart any running OneClick clients for the changes to take effect. OneClick Web Server Memory Settings By default, the maximum memory the OneClick Web server uses is 512 megabytes. As a guideline, if the OneClick Web server is using more than 75 percent of its configured maximum memory, consider increasing the maximum memory value. To configure OneClick Web server memory settings, do the following: Verify OneClick Web Server Memory Usage 1. Navigate to the OneClick Web server home page at spectrum/index.jsp 2. On the OneClick Web server main web page, click the Administration link to open the Administration web page. 3. Click Web Server Memory from the left panel of the Administration page. The Web Server Memory utility page opens. 4. Check the OneClick Server Memory Usage field to see if memory usage is greater than 75 percent of the configured maximum. Configure Maximum OneClick Web Server Memory Usage 1. In the Maximum Memory the Server Can Use (In MB) field, enter the new value. Note: Do not set the maximum memory to a value larger than the available memory for the system. 2. Click Save. A dialog box prompts you to commit your changes and restart the OneClick Web server (the OneClick web server must be restarted for these changes to take effect). 3. Click OK in the dialog box to save your changes and restart the OneClick Web server. OneClick Administration Guide 15

16 Chapter 1: SPECTRUM OneClick Web Server Administration Configure the OneClick Web Server URL As described in the OneClick Console User Guide (5130), the OneClick home page provides a central place where users can launch the OneClick client. By default, all OneClick users must use the following URL to reach the OneClick home page: Web server>/spectrum Also by default, the URL Web server> launches a Tomcat Web server configuration page. In environments where you would prefer all users to launch the OneClick home page via Web server>, you can configure the OneClick Web server to automatically redirect from Web server> to Web server>/ spectrum. To Configure the OneClick Web Server URL Use this procedure to make changes to the OneClick Web server URL: 1. Navigate to the <$SPECROOT>\tomcat\webapps\ROOT directory. 2. In the text editor of your choice, create a new file named index.html. 3. Edit the index.html file to contain the following text: <html> <head> <meta http-equiv="refresh" content="0;url=/spectrum"> </head> <body> </body> </html> 4. Save the index.html file in the ROOT directory described in step 1. All OneClick users navigating to Web server> will now automatically be redirected to Web server>/spectrum. Configure OneClick MySQL Server Password OneClick has its own MySQL server user and password. OneClick uses this user (OC_user) and its credentials to access the MySQL reporting database on behalf of SPECTRUM applications such as Report Manager and Service Manager. For greater security, SPECTRUM includes a utility that lets you change the password of the OneClick MySQL user. To change the MySQL server user password used by OneClick, follow this procedure: Important: Do not attempt to manually change the MySQL user password using a MySQL client connection. Due to the dependency between OneClick's storage of the password and MySQL connectivity, the only safe way to change this user's password is through the OneClick utility. 1. Navigate to the OneClick Web server home page at spectrum/index.jsp 2. On the OneClick Web server main web page, click the Administration link to open the Administration web page. 16 OneClick Administration Guide

17 Configure OneClick MySQL Server Password 3. Click MySQL Password from the left panel of the Administration page. 4. The Change MySQL Password utility page opens. Use this utility to change the password for the MySQL user SPECTRUM uses to accesses the reporting database. OneClick maintains the MySQL server's user credentials so that it knows what password to use when connecting to MySQL. OneClick stores this password in an encrypted form for security purposes. 5. Enter the current password, the new password, and confirm the new password in the fields provided. The default password for this user is 0n3cl1Ck (case sensitive). Click the Change Password button to modify the MySQL server's user credentials. The password is changed immediately after clicking Change Password and does not require MySQL or Tomcat to be restarted. OneClick Administration Guide 17

18 Chapter 1: SPECTRUM OneClick Web Server Administration 18 OneClick Administration Guide

19 Chapter 2: OneClick Server Communications and Network Configuration This chapter identifies OneClick administrative tasks. Other maintenance and optional configuration issues are also addressed. In This Chapter Configure OneClick for Secure Sockets Layer on page 19 Configure OneClick to Communicate through a Web Proxy Server on page 24 Configure OneClick Web Server to Communicate with SpectroSERVER(s) in Firewalled Environments on page 26 OneClick Web Server and Load Balancers on page 28 Configure OneClick for Secure Sockets Layer OneClick supports the use of Secure Sockets Layer (SSL) to encrypt communications between the OneClick web server and OneClick clients. This enables OneClick clients to access information securely across unsecured networks such as the Internet. In addition to encryption, SSL uses certificates for authentication. Authentication protects users from downloading and running applications from suspicious or un-trusted sources. While both Certificate Authority (CA)-signed certificates and self-signed certificates provide secure connections using SSL encryption, CA-signed certificates provide an additional level of security by verifying the creator of the certificate and certifying that the product signed with the CA-signed certificate is truly from that vendor. CA-signed certificates protect host machines that have them from attackers by making it much harder to impersonate a trusted entity (that is, the certified vendor). However, self-signed certificates may be appropriate if you require the encryption that an SSL certificate affords but not necessarily proof of the certificate s source. 19

20 Chapter 2: OneClick Server Communications and Network Configuration To configure OneClick for SSL 1. On the OneClick web server host, change to the <$SPECROOT>/Java/bin directory. 2. Generate a private self-signed certificate in the <$SPECROOT>/Java/jre/lib/security/cacerts file by issuing the following command:./keytool -genkey -alias tomcatssl -keyalg RSA -keystore <$SPECROOT>/Java/jre/lib/security/cacerts The keytool prompts you with a series of questions and uses the values that you specify to do the following: Create an issuer name for your organization. (This name is an X.500 Distinguished Name that is intended to be unique across the Internet. For more information, see the discussion on the keytool utility at Generate the self-signed certificate using the issuer name. 3. Enter answers to the questions using the following guidelines: You will be prompted for a password. Note that the Tomcat web server uses a default password of changeit. If you change the password, you must specify the custom password in the <$SPECROOT>/tomcat/conf/server.xml configuration file. When you are asked, What is your first and last name? enter the common name (with the fully qualified domain name) of your web site, for example, When you are asked, What is the name of your organizational unit? enter a small organization name, that is, the name of a division, business unit, or department, such as Purchasing. When you are asked, What is the name of your organization? enter a large organization name, such as ABCSystems, Inc.. When you are asked, What is the name of your state or province? enter the full name, not an abbreviation. When you are asked, "Enter key password for <tomcatssl>", press Enter to use the same password as the keystore password. 4. If you require a Certificate Authority-signed certificate, you need to request the certificate from the Certificate Authority and then import it. Note: Before proceeding with this step (Step 4), you may want to move to Step 5 to set up SSL to ensure that all of the information provided in the previous step (Step 3) was correct. If HTTPS works, you can continue with this step. As part of this step, you generate a Certificate Signing Request (CSR) file from the system that will be running the secure OneClick web server. The Java Development Kit (JDK) that is included with OneClick provides a keytool utility that you use to generate the CSR file. When you generate the file, you use the information that you provided in the previous step (Step 3); this is achieved by using the same alias name: tomcatssl. 20 OneClick Administration Guide

21 Configure OneClick for Secure Sockets Layer Request and import the Certificate Authority-signed certificate as follows: a. On the OneClick web server host, change to the <$SPECROOT>/Java/bin directory. b. Generate the CSR file by entering the following command:./keytool -certreq -alias tomcatssl -keystore <$SPECROOT>/Java/jre/lib/security/cacerts -file <filename>.csr Note: You will be prompted for a password. Use the same password you provided in Step 3; see Step 3 for more information. The contents of the.csr file that is generated are used to request the secure certificate from the Certificate Authority, which you do next. c. Request a secure certificate from a Certificate Authority, such as one of the following: VeriSign: TrustCenter: thawte: Instructions are available at each company s web site. d. Import the Certificate Authority-signed certificate into the keystore used by the OneClick web server. For more information, see Import a Certificate Authority-Signed Certificate on page Configure the secure socket on the machine that hosts the OneClick web server. For more information, see Configure the Secure Socket on the OneClick Web Server Host on page If you are running Report Manager, configure OneClick to be launched from Report Manager using SSL. For more information, see Configure OneClick and Report Manager for Secure Sockets Layer on page 23. Import a Certificate Authority-Signed Certificate If you have obtained a Certificate Authority-signed SSL certificate, you need to import it into the keystore used by the OneClick web server. A chain (root) certificate from the Certificate Authority must also exist in the keystore used by the OneClick web server. By default, OneClick includes chain certificates from many popular vendors. You can click the List button on the SSL Certificates administration web page to view the aliases for these certificates to help you determine if you need to obtain one and import it. To import a Certificate Authority-signed SSL certificate 1. If necessary, download a chain (root) certificate from the Certificate Authority from which you obtained the signed certificate. 2. If you downloaded a chain certificate in the previous step, import it into the keystore used by the OneClick web server: a. On the OneClick web server host, change to the <$SPECROOT>/Java/bin directory. OneClick Administration Guide 21

22 Chapter 2: OneClick Server Communications and Network Configuration b. Enter the following command:./keytool -import -alias root -keystore <$SPECROOT>/Java/jre/lib/security/cacerts -trustcacerts -file <root_chain_certificate_filename> Note: You will be prompted for a password; note that the Tomcat web server uses a default password of "changeit". Also note that the alias name does not need to be root; it can be a more descriptive name for the type of root certificate you are importing. The alias name needs to be one that does not already exist. 3. Import the Certificate Authority-signed SSL certificate into the keystore used by the OneClick web server: a. If necessary, on the OneClick web server host, change to the <$SPECROOT>/Java/bin directory. b. Enter the following command:./keytool -import -alias tomcatssl -keystore <$SPECROOT>/Java/jre/lib/security/cacerts -trustcacerts -file <your_certificate_filename> Note: You will be prompted for a password; note that the Tomcat web server uses a default password of "changeit". In addition, be sure to use the same alias that you did when you generated the private self-signed certificate (see Configure OneClick for Secure Sockets Layer on page 19). Configure the Secure Socket on the OneClick Web Server Host As a final step in configuring the OneClick web server for SSL, you need to configure the secure socket on the machine that hosts the OneClick web server. To configure the secure socket on the OneClick web server host 1. Shutdown the OneClick web server. See Stop and Start the OneClick Web Server on page Open <$SPECROOT>/tomcat/conf/server.xml in a text editor. 3. Locate the following section in the server.xml file: <!-- Define a SSL Coyote HTTP/1.1 Connector on port > <!-- <Connector classname="org.apache.coyote.tomcat4.coyoteconnector" port="443" minprocessors="5" maxprocessors="75" enablelookups="true" acceptcount="10" debug="0" scheme="https" secure="true" useurivalidationhack="false" disableuploadtimeout="true"> <Factory classname="org.apache.coyote.tomcat4.coyoteserversocketfactory" clientauth="false" protocol="tls" /> </Connector> --> By default, the <Connector> element in the section is commented out. 22 OneClick Administration Guide

23 Configure OneClick for Secure Sockets Layer Note: The preceding XML fragment specifies 443 as the default port on which the OneClick web server listens for SSL communication. As a result, end users can omit the port from the URL for accessing the OneClick home page: 4. Remove the comments around the Connector element by doing the following: a. Remove <!-- from the line above <Connector. b. Remove --> from the end of the section (after </Connector>). 5. Add the keystorefile attribute and keystorepass attribute to the Factory element within the Connector element as follows: <Factory classname="org.apache.coyote.tomcat4.coyoteserversocketfactory" keystorefile="<$specroot>/java/jre/lib/security/cacerts" keystorepass="changeit" clientauth="false" protocol="tls" /> When you do so, replace the <$SPECROOT> variable in the value for the keystorefile attribute with the fully qualified path to the directory in which SPECTRUM is installed. This is the same cacerts file that was used for the keytool commands to generate the certificates. The following are examples: (Windows) C:/win32app/SPECTRUM/Java/jre/lib/security/cacerts (UNIX) /usr/spectrum/java/jre/lib/security/cacerts 6. Save and close the server.xml file. 7. Start the OneClick web server. See Stop and Start the OneClick Web Server on page 12. Note: Additional details on configuring OneClick and SSL, as well as documentation for additional configuration parameters, are available on the OneClick web server at <hostname>/tomcat-docs/ssl-howto.html. Configure OneClick and Report Manager for Secure Sockets Layer If you are running Report Manager and you have configured OneClick to use Secure Sockets Layer (SSL) to encrypt communication between OneClick clients and the OneClick web server, you also need to configure OneClick to be launched from Report Manager using SSL. Note: Launching OneClick in the context of a specific report (for example, in the context of a device listed in an asset report) cannot be configured to use SSL. To configure OneClick to be launched from Report Manager using SSL 1. Enable write permissions on the following file: <$SPECROOT>\tomcat\webapps\spectrum\repmgr\js\repmgr.js 2. Open the file you modified in the previous step, and locate the launchoneclick function. OneClick Administration Guide 23

24 Chapter 2: OneClick Server Communications and Network Configuration 3. In the launchoneclick function, change the following line from: url = " to: url = " More specifically, change http to https in the line. 4. Save and close the file. Note: If you upgrade to a newer version of SPECTRUM, this file is overwritten during the process. As a result, you must repeat this modification after an upgrade. For more information on Report Manager, which allows you to create reports on the inventory, performance, change history, and fault history of the network assets managed by SPECTRUM, see the Report Manager User Guide (5158). Troubleshoot a Secure Sockets Layer Configuration If you encounter errors connecting to the secure OneClick web server from a OneClick client using SSL, verify the following: The fully qualified domain name of the host on which the OneClick web server is running was specified in the private key you generated for signing the security certificate used for authentication. When you generated the key, you should have entered the fully qualified domain name at the following prompt: What is your first and last name? Both the Certificate Authority chain (root) certificate and the security certificate were imported into the cacerts file in the <$SPECROOT>/Java/jre/lib/security directory on the secure OneClick web server. If you encounter errors launching a OneClick client from Report Manager using SSL, verify that you have completed the configuration procedure described in Configure OneClick and Report Manager for Secure Sockets Layer on page 23. Configure OneClick to Communicate through a Web Proxy Server If you use a Web proxy server that relays HTTP and HTTPS requests (such as the iplanet and Microsoft proxy servers), OneClick honors the proxy settings used by Java WebStart and supports both HTTP and HTTPS proxies as well as proxy authentication. An administrator must configure the OneClick Web server to communicate through a proxy server. Note: All clients connecting through a proxy must configure the proxy settings in the Java WebStart preference console. See the Installation Guide (5136) for details about the Java WebStart proxy settings. Setting this may be the only change required if you are connecting through an HTTP 1.1 proxy. 24 OneClick Administration Guide

25 Configure OneClick to Communicate through a Web Proxy Server Configure OneClick Server for HTTP 1.0 Proxy To configure the OneClick Web server for HTTP 1.0 proxy support, follow this procedure: Note: The following changes are not necessary to connect to a proxy that supports HTTP Open the following file for editing: <$SPECROOT>/tomcat/conf/server.xml 2. Find the attribute maxkeepaliverequests="-1" and change it to maxkeepaliverequests="1" Setting this to 1 turns off keep-alive. Note: Directions to do this also appear in the server.xml file itself. 3. Save the server.xml file changes. 4. Open the following file for edit: <$SPECROOT>/tomcat/webapps/spectrum/oneclick.jnlp 5. Find the following three lines and remove the lines containing <!-- and -->: <!-- <property name="reuseconnections" value="false"/> --> Removing <!-- and --> leaving just the <property name="reuseconnections" value="false"/> line in this file turns off the reuse of connections. 6. Stop and restart the OneClick Web server. (See Stop and Start the OneClick Web Server on page 12.) Troubleshoot Proxy Issues: A failed attempt to launch a OneClick client with a proxy results in the normal conditions described in step 1 and step 2 and the failure in step 3 (below): 1. A Web browser can access the OneClick Web server and load the main page at <hostname>:<portnumber>/spectrum/index.jsp (through the proxy). 2. Java WebStart can access the OneClick Web server and download the needed OneClick files. 3. The OneClick client cannot access the OneClick Web server and fails with a Can't connect to... error. Note: See the Installation Guide (5136) for information about disabling Web proxies if the procedures in Configure OneClick to Communicate through a Web Proxy Server on page 24 do not allow OneClick to communicate through the proxy server in your environment. OneClick Administration Guide 25

26 Chapter 2: OneClick Server Communications and Network Configuration Configure OneClick Web Server to Communicate with SpectroSERVER(s) in Firewalled Environments The OneClick web server must communicate with processes on the SpectroSERVER host system in order to gather data for display to the OneClick clients. For the most part, this communication is initiated by the OneClick web server, which establishes connections to specific TCP ports for sending requests and receiving responses. The SpectroSERVER uses bidirectional IIOP (Internet Inter-ORB protocol) to communicate with its CORBA clients. Because SpectroSERVERs use clientinitiated connections to transmit information to the OneClick web server, it is not necessary to open additional ports on the firewall of the OneClick web server for these communications. Configure OneClick Web Server in NAT Environments You may need to configure OneClick to communicate with the SpectroSERVER if you use network address translation (NAT) on your network. The following sections describe the specific NAT network configurations that require additional OneClick web server configuration in order for OneClick to communicate with the SpectroSERVER. OneClick Server and SpectroSERVER Behind NAT Firewall When both the OneClick web server and the SpectroSERVER exist behind a NAT firewall, you need to set the externalip parameter in the <$SPECROOT>/tomcat/conf/server.xml file on the OneClick web server to the public IP address of the OneClick web server host. Note: You must know the external or public IP address of the OneClick web server to configure the OneClick server for this NAT condition. To set the public IP address of the OneClick web server host 1. Using a text editor of your choice, navigate to and open the <$SPECROOT>/tomcat/conf/server.xml file. 2. Locate the externalip parameter in this file. - <parameter> <name>externalip</name> <value /> </parameter> 3. Set the value to the external IP address of the OneClick web server. - <parameter> <name>externalip</name> <value> </value> </parameter> 4. Save the changes to the <$SPECROOT>/tomcat/conf/server.xml file. 5. Restart the OneClick web server. See Stop and Start the OneClick Web Server on page 12 for details on how to do this. 26 OneClick Administration Guide

27 Configure OneClick Web Server to Communicate with SpectroSERVER(s) in Firewalled Environments OneClick Server Outside NAT, SpectroSERVERs Inside NAT When the OneClick web server is installed outside of a NAT firewall and all SpectroSERVERs are inside the NAT firewall, you need to: Install the osagent software on the OneClick web server. In the <$SPECROOT>/tomcat/conf/server.xml file on the OneClick web server, set orbagentname to the OneClick web server host name. The osagent process allows the CORBA server to register its objects and assists client applications in locating of these objects. The osagent software is installed on the SpectroSERVER, and to accommodate this specific NAT configuration, it must also be installed on the OneClick Web server. Refer to the Corba API Programmers Guide for SPECTRUM (5110) for more information about CORBA and the osagent. To install osagent software on the OneClick web server To install osagent on the OneClick web server, you need to install the SpectroGRAPH application on your OneClick web server. There is no way to install the osagent only. Follow the installation instructions in the Installation Guide (5136) to access the SPECTRUM Installation software and install only the SpectroGRAPH software. To set orbagentname in the <$SPECROOT>/tomcat/conf/server.xml file Use the following procedure to set parameter values in the <$SPECROOT>/tomcat/conf/server.xml file required for NAT firewall configurations. 1. Using a text editor of your choice, navigate to and open the <$SPECROOT>/tomcat/conf/server.xml file. 2. Locate the orbagentname parameter in the file, shown below. - <parameter> <name>orbagentname</name> <value>techwin</value> </parameter> 3. Set the value for this parameter to host name for the OneClick web server. 4. Save the changes to this file. 5. Restart the OneClick web server. OneClick Administration Guide 27

28 Chapter 2: OneClick Server Communications and Network Configuration OneClick Web Server and Load Balancers OneClick Web servers support the following configuration to achieve load balancing: Identically configured OneClick web servers that are accessed through an external load balancing device that employs host/session persistence, and any load balancing mode. Figure 2-1 illustrates a supported load balancing configuration for multiple OneClick servers. Figure 2-1: Example: Supported Load Balancing Configuration for OneClick Servers. SpectroSERVER Router IP add route /24 Load balancer Virtual IP: OneClick Web server_1 OneClick Web server_2 OneClick Web server_n IP: IP: IP: N OneClick Administration Guide

29 Chapter 3: OneClick Administration Web Pages This chapter discusses the OneClick Administration Web pages and the features available on them. The OneClick Administration Web pages are accessible from the main OneClick Web page. Only OneClick users with OneClick Web Administration privileges can access these Web pages. Figure 3-1: Administration Link on OneClick Main Web Page To access the OneClick Administration Web pages, select Administration from the OneClick main Web page (Figure 3-1). The Administration Web page (Figure 3-2) is composed of a navigation panel on the left used to select specific features to configure, and a contents panel on the right, that displays the configuration information for each feature. The administrative Web pages listed in the navigation panel reflects any OneClick add-on applications installed as part of your SPECTRUM OneClick set up. The navigation panel and the other OneClick Web page links, remain available from any OneClick server administration Web page. 29

30 Chapter 3: OneClick Administration Web Pages Figure 3-2: OneClick Administration Web Page Activation Key Use this page to validate or change a OneClick Activation Key. The Authorization Code in effect and the version of SPECTRUM and OneClick installed appear on this page. The Activation Key is editable so that you can make changes. You can test the validity of the Activation Key. Click Test, and OneClick returns information about the validity of the key. If the key is valid, the following information about the key appears: Expiration Date Number of Administrator Licenses Number of Operator Licenses Number of licenses for any OneClick and SPECTRUM add-on applications included in the key. Click Save to save any Activation Key changes you make, after validating the key. If the Activation Key is invalid, a message appears stating this. 30 OneClick Administration Guide

31 ARS Configuration ARS Configuration This page allows you to configure OneClick to connect with your Action Request System (AR System). After OneClick is configured to interface with your ARS server, OneClick users will be able to generate and view AR System trouble tickets from the OneClick alarm console. You will need to know the name of the ARS server, along with the login name and password required to access the server and generate a ticket. The default form name identifies tickets generated from SPECTRUM. You can test the configuration information you enter by clicking Test prior to saving the configuration. OneClick will let you know if it was able to connect to the server. Character Set Use this page to set the character set encoding used by OneClick server when saving and retrieving text data from the SpectroSERVER database. This enables the OneClick client to correctly display text data for language character sets that extend the standard ASCII or Latin-I character sets. The default setting is for the OneClick server to use the character set defined by the system language setting. You can choose to use a specific character set and override the system setting. The OneClick web server must be restarted for any changes to take effect. ehealth Configuration Use this page to configure OneClick for connection to an ehealth server. Any changes you make on this page are reflected in OneClick clients launched after you complete the configuration changes. ehealth Configuration You can test any ehealth configuration changes you make in this section of the page before saving them by using the Test and Save buttons. ehealth Map Maintenance Use this section to perform maintenance tasks on the Spectrum and ehealth mappings. The Spectrum and ehealth mappings attempt to match ehealth elements related to routers and systems to corresponding models in Spectrum. These are broken out into the following maintenance categories: ehealth server topology ehealth mapping utilities OneClick Administration Guide 31

32 Chapter 3: OneClick Administration Web Pages Configuration Use this web page to configure OneClick to integrate with your existing system so that operators can mail alarm-related information from OneClick to assigned troubleshooters and other individuals. The default SMTP Server Host entry for the mail server is "mailhost" which is a common DNS alias for the mail server. If your environment does not use this alias, an alternative to setting the host on this web page is to add an entry for "mailhost" to the /etc/hosts file on the OneClick web server machine. EvFormat/PCause Configuration If you make changes to any EvFormat or PCause files, you can reload them into the OneClick server using this Web page. Landscapes Use this page to view the status for all the landscapes (SpectroSERVERs) that the OneClick server is currently monitoring. You can identify information related to a Distributed SpectroSERVER set up, including any parent and child landscapes. You can perform a manual synchronization between all distributed models with their corresponding models on the master landscape using the Sync With Master button. You can manually add or remove landscapes monitored by this OneClick server. You can remove only landscapes that you have manually added. LDAP Configuration Use this Web page to configure the OneClick Web server to use an external LDAP server for user authentication. See User Administration in OneClick on page 37 for SPECTRUM and OneClick user settings related to LDAP configurations. LDAP Server Settings Settings you can configure include identifying a primary and secondary LDAP server by IP address and Port number, using SSL, adding an SSL certificate, and the connection timeout with the LDAP server. See SSL Certificates on page 35 for information about viewing and adding SSL certificates used by the OneClick Web server. Save LDAP Passwords to SPECTRUM Database This option allows you to give access to OneClick users if the LDAP server is down, based on their last known correct LDAP password. 32 OneClick Administration Guide

33 MySQL Password User Name Lookup Configure how OneClick performs a lookup of user names either as a User by Search or a User by Pattern lookup, depending on the LDAP system you are interfacing with. Test LDAP Configuration Once you have configured the OneClick interface with an external LDAP server, you can test the configuration using the Test LDAP Configuration section of this Web page. MySQL Password Use this OneClick Administration Web page to change the password for the MySQL user that accesses the reporting database used in OneClick Web applications. Configure OneClick MySQL Server Password OneClick has its own MySQL server user and password. OneClick uses this user (OC_user) and its credentials to access the MySQL reporting database on behalf of SPECTRUM applications such as Report Manager and Service Manager. For greater security, SPECTRUM includes a utility that lets you change the password of the OneClick MySQL user. To change the MySQL server user password used by OneClick, follow this procedure: Important: Do not attempt to manually change the MySQL user password using a MySQL client connection. Due to the dependency between OneClick's storage of the password and MySQL connectivity, the only safe way to change this user's password is through the OneClick utility. 1. Navigate to the OneClick Web server home page at spectrum/index.jsp 2. On the OneClick Web server main web page, click the Administration link to open the Administration web page. 3. Click MySQL Password from the left panel of the Administration page. 4. The Change MySQL Password utility page opens. Use this utility to change the password for the MySQL user SPECTRUM uses to accesses the reporting database. OneClick maintains the MySQL server's user credentials so that it knows what password to use when connecting to MySQL. OneClick stores this password in an encrypted form for security purposes. 5. Enter the current password, the new password, and confirm the new password in the fields provided. The default password for this user is 0n3cl1Ck (case sensitive). 6. Click the Change Password button to modify the MySQL server's user credentials. The password is changed immediately after clicking Change Password and does not require MySQL or Tomcat to be restarted. OneClick Administration Guide 33

34 Chapter 3: OneClick Administration Web Pages NSM Configuration This page allows you to configure OneClick for connecting to a NSM dashboard and a NSM report server. Only OneClick clients launched after any changes are saved reflect the changed settings. Service Desk Configuration You can view, configure, test, and save SPECTRUM and CA Service Desk integration settings using the Service Desk Configuration Web page. Note: Prior to configuring OneClick to connect to Service Desk using this configuration page, you must download and install the integration components on your Service Desk server. You can create and modify CA Service Desk server and admin user identifying parameters, enable and disable SPECTRUM and CA Service Desk integration, and add and remove which SPECTRUM alarms generate Service Desk tickets. SPECTRUM Configuration You can view and set the following SPECTRUM configuration parameters: Main Location Server Name Backup Location Server Name Admin User Name SpectroSERVER Polling Interval (sec) SpectroSERVER Request Timeout (sec) You can also restart the OneClick server so that any setting changes that require a server restart can take effect. SPM Data Export This page allows you to change the following settings for SPM Data Export: SPM Data Export Enabled This must be set to Yes for the following settings to be available. Log File Cycle Time (min) - This parameter (in minutes) controls when the SPM log file will be saved and closed and a new file opened for logging. Log File Directory This sets the full path to the directory where SPM log files will be stored. The directory structure specified must be created prior to saving. Select which landscapes SPM data is obtained from using the landscape selection columns. 34 OneClick Administration Guide

35 SSL Certificates SSL Certificates You can use this Web page to view and add SSL certificates used by the OneClick Web server. Use this Web page to add an SSL certificate used as part of the OneClick SSL configuration. For LDAP. see LDAP Configuration on page 32 for LDAP configuration information. For OneClick SSL configuration, see Configure OneClick for Secure Sockets Layer on page 19. Web Server Logs Configuration You can use this Web page to view and set OneClick server log file rotation settings. The OneClick Web server log files are located in: <$SPECROOT>/tomcat/logs. You can set an alarm notification when the log file directory becomes larger than a specified size in megabytes. You can view the current size of the log file directory. You can specify the age in days at which an log file is deleted from the directory. Web Server Memory You can use the Web Server Memory administration Web page to view and set the maximum amount of memory the OneClick server uses. Any changes you make require you to restart the OneClick server. You can also view the percentage of the maximum memory allocation the OneClick server is currently using. See the OneClick Web Server Memory Settings on page 15 for the procedure to set the OneClick server memory settings. OneClick Administration Guide 35

36 Chapter 3: OneClick Administration Web Pages 36 OneClick Administration Guide

37 Chapter 4: User Administration in OneClick This chapter discusses SPECTRUM user administration in OneClick from the perspective of a OneClick administrator. This includes managing SPECTRUM users and user groups. For more information about configuring SPECTRUM model security, see the chapter Model Security in OneClick on page 73. In This Chapter SPECTRUM OneClick User Administration Terminology on page 38 SPECTRUM OneClick User Administration on page 39 OneClick User Administration Interface on page 41 Implement User Administration on page 48 Manage Users Within User Groups on page 51 Edit Existing Users and User Groups on page 51 Create and Assign Roles to Users or User Groups on page 52 Grant a User All Privileges by Designating it a Super User on page 56 Use Security Communities to Manage User Access to Models and Devices on page 62 Manage OneClick Licenses by Limiting Concurrent User Logins on page 66 37

38 Chapter 4: User Administration in OneClick SPECTRUM OneClick User Administration Terminology Table 4-1 provides a list of common OneClick user administration terms. Table 4-1: User Administration Terms Term User User Group License Security Community Role Model Description A OneClick user account. Created by a OneClick administrator, this account provides a single OneClick user with access to OneClick and stores information about the user, such as password, access, and privileges in the SPECTRUM database. In OneClick, the term User can represent the account of a user who has access to OneClick and/or the actual user tied to the account. A User Group in OneClick is an organizational grouping of users together for a common purpose. Users within the same group can share the privileges granted by the group. When you specify privileges at the group level, OneClick grants each group member those privileges in addition to any privileges they have at the user level. A license determines which privileges can be granted to holders of that license. Launching a OneClick client consumes any licenses granted to that user. Grants privileges to users and members of user groups. The default OneClick security community (ADMIN) provides users and groups with read-write access to all SPECTRUM models. A reusable set of user privileges which you can assign to an access group. For example, the default role (OperatorRW) grants the set of read-write privileges typically needed by a OneClick operator. A model in SPECTRUM represents a modeled network element. 38 OneClick Administration Guide

39 SPECTRUM OneClick User Administration SPECTRUM OneClick User Administration User administration involves creating and managing OneClick user accounts. As the OneClick system administrator, you must create a user account for each new user you want to access the system. As you create new user accounts in OneClick, you can choose to add them within user groups or as standalone users. When you have multiple users with similar needs, consider creating user groups to manage their user accounts. When you have users with unique needs, you may want to create user accounts independent of user groups. Whether you create user accounts within a user group or not is up to you. Important: We recommend that you do not use the legacy SPECTRUM User Editor application for user administration. Best Practices for Creating and Managing User Accounts The best practices for creating and managing user accounts in OneClick are described below: Creating and Managing Individual User Accounts The benefits of creating and managing individual user accounts include: Simplest method. Best for environments with a small number of users. Best for users with unique SPECTRUM OneClick access requirements. Individual user accounts can be moved to a user group later if needed. Creating and Managing User Accounts Within a User Group The benefits of creating and managing user accounts within user groups include: Best for environments with a large number of users. Enables you to group multiple users by geographic area, function, department, etc. Ability to grant all users within a group the same access and privileges at one time. You can define a minimum set of privileges all users within the group should have. Then, you can customize the individual privileges of any user in the group. Consider the following example of creating a user group: Task Within OneClick, you want to grant network operators one set of minimal privileges that enable them to monitor the network. You also want to grant one of these network operators the additional privilege of modeling the network in OneClick. Solution By creating one user group you can easily satisfy this requirement. To configure this requirement in OneClick, you would: 1. Create one user group and place all the user accounts for the network operators in this user group. 2. Grant everyone in the group minimal monitoring privileges. 3. Grant only the one network operator in the group the modeling privilege. OneClick Administration Guide 39

40 Chapter 4: User Administration in OneClick For more information and instructions for creating individual OneClick users or user groups, see Create User Accounts and User Groups on page 48. Who Can Perform User Administration? The OneClick administrator must configure user administration in OneClick. Initially, this configuration must be performed by the initial user who installed SPECTRUM. During the installation, SPECTRUM provided the initial user with a user account. Using this account, the initial user has administrative access to all OneClick features including user management. If you are not the initial user but are responsible for user administration, the initial user must create an administrator account for you. Your account must include an Administrator license and the appropriate user management privileges. About Licenses and Privileges OneClick comes with a set of Administrator licenses and Operator licenses. These licenses determine which privileges a system administrator can assign to a OneClick user. The privileges available with a given license are enabled by default. As the system administrator, you can choose to leave these privileges enabled or you can individually disable them, customizing license privileges. For more information about creating user accounts and assigning licenses and privileges, see Implement User Administration on page 48. For more information about managing license use, see Manage OneClick Licenses by Limiting Concurrent User Logins on page OneClick Administration Guide

41 OneClick User Administration Interface OneClick User Administration Interface As the OneClick system administrator, you create and manage users within OneClick using options available from the Users tab in the OneClick Navigation panel as shown in Figure 4-1. Figure 4-1: Users Tab Users tab in the Navigation panel Access tab in the Contents panel Security Communities Privileges tab Privileges The following sections describe the options available from the Users tab in the OneClick Navigation panel. OneClick Administration Guide 41

42 Chapter 4: User Administration in OneClick Users Tab The Users tab displays a hierarchical list of users and user groups under the top-level Users group. Initially, after installing SPECTRUM, the Users tab lists only the top-level Users group and the initial SPECTRUM user who installed SPECTRUM (root in the example in Figure 4-1) under the Users group. From the Users tab, you can create and manage user accounts by using the create user, create user group, and delete buttons, as shown in Figure 4-2. Figure 4-2: The Users Tab Create new user Top-level Users group contains all individual users and groups. The Users group is available by default. Delete selected user or user group Create new user group Manage an Existing User or User Group To manage an existing user or user group in OneClick, select it in the Users tab of the Navigation panel. When you select a user or user group in the Users tab, the Users List and Access tabs appear in the Contents panel, as shown in Figure 4-1 on page 41. Users List Tab The User List tab displays a table of users and user groups for the current landscape along with information about each entry displayed in columns (see Figure 4-3). You can customize this table view by selecting which columns display, and the sort order of the table based on the content of a column. See the OneClick Console User Guide (5130) for more information on customizing the table view. 42 OneClick Administration Guide

43 OneClick User Administration Interface Figure 4-3: Users List Tab Users List tab Deletes the selected users or user groups Exports the Users List table Information for this selected user appears in the Details tab of Component Detail panel (shown in Figure 4-6 on page 46) When you select the User List tab, the Details, Licenses, and Landscapes tabs appear in the Component Details panel (see Figure 4-4). In addition to providing the features described in Figure 4-3, the Users List tab also enables you to: View information about the selected user or group in the Details tab of the Component Detail panel. See View and Change User or User Group Details on page 45 for more information about the Details tab. View and edit licenses for the selected user or group in the Licenses tab of the Component Detail panel View and edit landscape membership for the selected user or group in the Landscapes tab of the Component Detail panel OneClick Administration Guide 43

44 Chapter 4: User Administration in OneClick Figure 4-4: Users List View Users tab in the Navigation panel Users List tab The Operator user is selected and appears in the Users tab and Users List tab. Licenses and Landscapes tabs Details tab displays general information for the selected user Access Tab The Access tab in the Contents panel displays the list of security communities assigned to the selected user or user group. Security communities are a tool you can use to limit user access to specific sets of models and views in OneClick. The source of each assigned security community is displayed either from an individual user or a user group. When you select the Access tab, the Privileges and Roles tabs appear in the Component Details panel (Figure 4-5). Refer to View and Change Privileges on page 46 for information about privileges in OneClick. 44 OneClick Administration Guide

45 OneClick User Administration Interface Figure 4-5: Access Tab View Security Communities applied to user Privileges and Roles tabs View and Change User or User Group Details When you select a user or user group in the User List tab, the Details tab of the Component Detail panel displays general information for that user or group. Values for certain attributes such as contact information can be set in the Details tab by clicking a set link and entering a new value. An example of the Details tab for a user is shown in Figure 4-6. OneClick Administration Guide 45

46 Chapter 4: User Administration in OneClick Figure 4-6: Component Detail: User Details View and Change Privileges Access groups appear in the Access tab for a selected user as shown in Figure 4-7. After selecting an access group for a user, the available privileges appear in the Privileges tab of the Component Detail panel as shown in Figure 4-8. The example Component Detail label shows that these privileges are associated with the selected ADMIN access group at the user level (ADMIN from User). The From Role column shows that all of these enabled privileges are being granted by the OperatorRW role. Figure 4-7: Users Tab Users tab in the Navigation panel Access tab in the Contents panel Access group Clicking Add/Remove lets you enable and disable privileges for this user at the selected ADMIN access group. You cannot use Add/Remove at the user level to manage privileges for an access group that is inherited from a user group. 46 OneClick Administration Guide

47 OneClick User Administration Interface Figure 4-8: Privileges Tab Click Add/Remove to enable and disable privileges for this user for the ADMIN access group. A check mark appears in the Enabled column for each privilege granted to this user. Effects of Customizing Privileges In OneClick you can customize the privileges assigned to an individual user account and/or a user group. When you edit privileges for an individual user account, the changes only affect that user. When you edit the privileges assigned to a user group the change affects all users within that user group. Users within a group automatically inherit privileges from the group but also retain all individual-level privileges assigned. Note: You can add privileges to an access group at the user level for users that are members of a group. You can also edit privileges for an access group at the user group level. You cannot remove privileges at the user level that are granted to the user by a user group. Effects of Removing Privileges Granted by a Role for a User When you customize the privileges granted by a role for a user, the user is removed from the role. The user retains any privileges granted by the role that are not removed. The role itself does not change. If the privilege is added back for the user, the user does not regain membership in the role. Customizing the privileges granted by one of the default SPECTRUM roles (such as AdministratorRW or OperatorRW) for a user which also results in the removal of the role from the user and the direct assignment of the remaining, enabled privileges has additional consequences: If you later create a custom privilege for the default role, which is an assignment specified in the XML file that defines the privilege, the privilege is not automatically granted to the user. If you later upgrade SPECTRUM, any new privileges available in the newer version of SPECTRUM that are associated with the default role are not automatically granted to the user. In either situation, to grant the custom or new privileges to the user, you must either explicitly add them to the user or reassign the default role to the user. OneClick Administration Guide 47

48 Chapter 4: User Administration in OneClick Implement User Administration This section provides the necessary procedures and information for implementing user administration in OneClick, including: Create User Accounts and User Groups on page 48 Manage Users Within User Groups on page 51 Edit Existing Users and User Groups on page 51 Manage OneClick Licenses by Limiting Concurrent User Logins on page 66 Important: OneClick user administration requires the administrator user to have at minimum the Administrator license and user management privileges. Create User Accounts and User Groups When you create a new user or user group, OneClick, by default, assigns an Operator license and the OperatorRW privilege role to the new user or user group. When you create a new user or group you can choose to assign an Administrator license in addition to the Operator license. When you assign an Administrator license to a user or group, the user(s) automatically inherit all privileges associated with both the OperatorRW and the AdministratorRW privilege roles. To quickly get started administering user accounts in OneClick, consider creating user accounts using OneClick s default settings. When you create a user account or user group, OneClick provides an Operator license and the ADMIN access group by default. To Create a new user account or user group To create a new user account or user group using the default privileges provided by the operator or administrator license, follow this procedure: 1. In the Users tab of the Navigation panel, do one of the following: Create a stand-alone user. Select the top-level Users node and click the Create New User button. The Create User dialog appears. Create a user group. Select the top-level Users node and click the Create New User Group button. The Create Group dialog appears. Create a user within a group. Select an existing user group in which you want to create a user and click the Create New User button. The Create User dialog appears. Note: The Create Group dialog box is very similar to the Create User dialog box (Figure 4-9). The Create Group dialog box differs in that it does not have fields such as full name and password that are applicable only to individual user accounts. 48 OneClick Administration Guide

49 Implement User Administration Figure 4-9: Create User User information Licenses tab Select Licenses table 2. In the Create User or Create Group tabbed dialog box, specify the information in the following tables for the user or user group. You must specify any information listed as [required]. You may not need to change information listed as [optional] if you choose to accept the default settings. Table 4-2: User or Group Information User or Group information Name [required] Full Name (Create User only) [optional] Web Password (User only) [required] Confirm Web Password (User only) [required] Description Enter the user name for the new user account or group in the Name field. Note: For OneClick users that are present in an LDAP directory, this name must match the LDAP user logon name of the user. Enter the full name of the user. Enter a web password for this user. This password is used by OneClick to authenticate this user. Note: If LDAP is configured, this field is not shown. Confirm the web password you entered by entering it again in this field. Note: If LDAP is configured, this field is not shown. OneClick Administration Guide 49

50 Chapter 4: User Administration in OneClick Table 4-3: License and Landscape Settings Tab Description License Tab Select License(s) [optional] In the Select Licenses table in the Licenses tab, you can enable or disable the licenses you want to assign using the Member of license check box. By default, new users receive an Operator license and the OperatorRW privilege role. The following list provides an overview of the privilege categories and privileges granted by this role: Alarm Management Grants access to various alarm management tasks in OneClick. Explorer Views Grants view access to various hierarchies in OneClick Explorer tab. Export Grants access to export various views including tables and topology views. Model Management Grants access to various model management tasks in OneClick. Policy Manager Grants various Policy Manager access privileges in OneClick. Tabs Grants access to various tabbed views in OneClick. Tools Grants access to various tools available in OneClick. View Alarms Grants read access to alarms. This will grant access to the alarm totals in the Explorer tab as well as all other alarm information. View Models Grants read access to models. This determines whether or not the models will be displayed in the Explorer tab and whether or not the user can view the Information Details. Landscapes Tab Select Landscapes [optional] Configuring this tab is optional when you accept default settings during user or group creation. By default, all available landscapes are selected. In a distributed environment, you can choose additional landscapes you want this user to be present in. At least one landscape must be selected. Details Tab Various user/user group detail fields [optional] Enter user or user group details such as location and organization. Note: The Security String field (ADMIN by default) must be filled in. Access Tab Read-write and read only access configuration [optional] The Access tab enables you to edit the default model security setting for this user. By default, the user or user group receives the read write ADMIN access group. Additional access groups can be created here. Important: By default, when you create new users, OneClick assigns them the default ADMIN access group. The ADMIN access group provides access to all models including secured models. You can use the Add, Remove, and Modify buttons to edit access group settings. For more information about model security, see Model Security in OneClick on page 53. We recommend keeping the default ADMIN access group for administrator users or any users that need access to all models. Note: At least one security community (for example, the default ADMIN community) must be specified here. 50 OneClick Administration Guide

51 Implement User Administration 3. Click OK in the Create User or Create Group dialog box to create the user or user group. The new user or group appears in the Users tab of the Navigation panel. Manage Users Within User Groups An excellent way to manage multiple users in OneClick is with user groups. After you have created a user group, you can configure it to provide a minimum set of user privileges for all users within that user group. Each user account you place within this group will automatically inherit the grouplevel privileges. Inheritance Details for Users in User Groups Users within a user group inherit the following values from the user group: Security Community Legacy community string Access group(s) Privilege role(s) Special Considerations The following special considerations apply to users contained within user groups: Any changes made at the group level are automatically inherited by users within the group. Certain legacy user group attributes are inherited if common attributes have been set using the SpectroGRAPH User Editor. For more information, see the Setting Up Common Attributes section in the Security & User Maintenance Guide (2602). Membership in SPECTRUM landscapes is not inherited from the user group. This must be set at the individual user level. Edit Existing Users and User Groups This section describes common tasks and procedures for editing existing users and user groups in OneClick. Each of the following procedures assumes a selected user or user group in the Users tab: Create and Assign Roles to Users or User Groups on page 52 Grant a User All Privileges by Designating it a Super User on page 56 Allow Users to Login if No Corresponding LDAP User Found on page 57 Change Details Displayed for a User or User Group on page 58 Change Licenses Assigned to a User or Group on page 58 Change the Landscapes a Selected User is Present In on page 59 Change Individual Privileges for a User or User Group on page 60 Move an Existing User to a User Group on page 60 Remove a User from a User Group on page 61 OneClick Administration Guide 51

52 Chapter 4: User Administration in OneClick Delete a User or User Group on page 61 Use Security Communities to Manage User Access to Models and Devices on page 62 Create and Assign Roles to Users or User Groups As described previously, you can individually disable/enable privileges for a user or user group. You can also use roles to grant a set of privileges to a user or user group. You can use the default privilege roles in OneClick or you can create your own custom privilege roles. Note that you cannot edit the default privilege roles themselves. After users are assigned a license category, they can have access privileges provided by predefined roles. There are six default roles: OperatorRW OperatorRO AdministratorRW AdministratorRO ServiceManagerRW ServiceManagerRO If these predefined roles do not meet you specific needs, you can create new roles. Although you cannot modify predefined roles, you can modify individual privileges. When you upgrade to a newer version of SPECTRUM, any new privileges available in the newer version are automatically added to the appropriate default roles. However, you need to explicitly add them to the appropriate custom roles. Editing Privileges and Roles When you edit privileges for an individual user, the changes only affect that user. When you edit the privileges granted by a user group, the changes affect all users within that user group. Users within a user group inherit privileges from the group level but they also retain all individual privileges they have. To edit privileges and roles, you modify settings in the Privileges tab and/or the Roles tab for a selected user, as shown in Figure OneClick Administration Guide

53 Implement User Administration Figure 4-10: Users Tab Users tab in the Navigation panel Add an access group The Access tab for the selected user Remove the selected access group The selected access group (ADMIN) Edit the communities of the selected access group Click Add/Remove in the Privileges tab to change which privileges are granted OneClick Administration Guide 53

54 Chapter 4: User Administration in OneClick In addition to editing individual privileges, you can also grant multiple privileges at one time by assigning a privilege role using the Roles tab as shown in Figure Figure 4-11: Roles Tab Use the New buttons to create a new privilege role. Roles tab Use Add/Remove to associate a role with a user. The default roles included with OneClick as well as custom roles that you create are reusable and can be assigned to one or more users. The OperatorRW privilege role automatically grants the privileges provided with the Operator license. The following procedure shows how to create a reusable, custom privilege role via the Roles tab. It then shows how to associate that role with a user or group. To Create a Custom Privilege Role Follow this procedure to create a custom privilege role: 1. Select a user in the Users tab of the Navigation panel. Tip: If you want to create an Administrator-licensed privilege role, you must select a user with the Administrator license in step 1. To create a privilege role based on the Operator license, select a user with the Operator license. 2. In the Contents panel for the selected user, click the Access tab. When the Access tab is selected, the Privileges and Roles tabs appear in the Component Detail panel. 3. In the Component Detail panel, select the Roles tab. 4. In the Roles tab, click the New button. The Add Privilege Role dialog box appears as shown in Figure 4-12 on page In the Name field of the Add Privilege Role dialog box, give the new role a descriptive name. 6. In the Privileges section of the Add Privilege Role dialog box, select the appropriate license from the License drop-down menu. Note: The license chosen here determines the privileges that can be enabled with this role. 7. In the Privileges section of the Add Privilege Role dialog box, select the privileges you want this role to grant by checking or clearing the Enabled check boxes as shown in Figure Click OK. The new role appears as an option in the Roles tab of the Component Detail panel. This role is now ready to be used with any user or user group that has the appropriate license. 54 OneClick Administration Guide

55 Implement User Administration Figure 4-12: Add Privilege Role Dialog Box To Assign a Privilege Role Follow this procedure to assign an existing role to a user: 1. Select the user you want to apply the role to in the Users tab of the Navigation panel. 2. In the Contents panel for the selected user, click the Access tab and select an access group. When an access group is selected in the Access tab, the Privileges and Roles tabs appear in the Component Detail panel for that access group. 3. In the Component Detail panel, select the Roles tab. 4. In the Roles tab, click the Add/Remove button. The Assign Roles dialog box appears. Note: For users in a group, step 4 must be done at the group level. Assigning a role at the group level affects all users in the group. 5. Using the arrow buttons, move the role you want to assign to the Exists in/create in column as shown in Figure Click OK. The role is automatically assigned to the access group selected in step 2. Figure 4-13: Assign Roles Dialog Box OneClick Administration Guide 55

56 Chapter 4: User Administration in OneClick Grant a User All Privileges by Designating it a Super User As the OneClick administrator, you can easily grant all possible privileges and access to a given user. To do this you can designate that user a super user. A super user in SPECTRUM is a user that has all possible SPECTRUM privileges and access in OneClick. A user that has been designated a super user is automatically granted all OneClick license roles and privileges. Because access groups and privilege roles do not apply to super users, the Access tab is disabled when a user designated as super user is selected in OneClick. When you install SPECTRUM, the initial SPECTRUM user created at that time is a super user. This initial user, once created at installation time, will remain a super user and must always exist in SPECTRUM (its existence is verified by SPECTRUM each time the SpectroSERVER starts). The value for initial_user_model_name in the <$SPECROOT>/SS/.vnmrc file stores the setting for the initial SPECTRUM super user. The default password for the initial user is spectrum. Tip: Consider creating an administrator user with user management privileges to manage users. This user is in addition to the user that installed OneClick (the initial user) and can even manage the initial user account. To ensure a OneClick administrator user has all possible privileges, set the value of issuper User for that user to true as described in To Create Super Users on page 56. To Create Super Users Users in addition to the initial SPECTRUM user can be made super users by following these steps: 1. Select the user to grant super user status to from the Users List. 2. In the Details tab for that user click the set link for Is Super User (Figure 4-14). 3. Select Yes from the drop-down menu. 4. Press the Enter key. This sets the value of Is Super User for this user to Yes. 56 OneClick Administration Guide

57 Implement User Administration Figure 4-14: Setting User to Super User Set Is Super User to Yes and press Enter to grant this user all possible access and privileges in OneClick. Allow Users to Login if No Corresponding LDAP User Found When you have configured LDAP for your environment, you can allow or restrict OneClick users to log in locally if they are not present in the LDAP directory by following this procedure. Note that super users with passwords set in OneClick can log in locally regardless of this setting. One scenario where allowing a user to login to OneClick without a corresponding LDAP user entry is when a non-employee is providing support, training, or troubleshooting that requires them to login to OneClick. To Change LDAP Local Login Permission Follow this procedure to change LDAP local login permission: 1. Select the user or user group for edit in the Users tab of the Navigation panel. 2. Navigate to the Details tab of the Component Detail panel for that user or user group. 3. Navigate to the LDAP Configuration section, 4. Set Allow User to Login if no LDAP User Found to Yes to enable this user to login to OneClick if they are not present in the configured LDAP directory. Set it to No to prevent this user from logging in without an LDAP account. OneClick Administration Guide 57

58 Chapter 4: User Administration in OneClick Change Details Displayed for a User or User Group The information displayed in the Details tab in the Component Detail panel for a selected user or group can be changed using this procedure. To Change User Information Follow this procedure to change user or group information: 1. Select the user or user group for edit in the Users tab of the Navigation panel. 2. Navigate to the Details tab of the Component Detail panel for that user/group. 3. Use the blue set link to edit attributes such as the password and security string of an existing user or group. Change Licenses Assigned to a User or Group The default settings for a new user account include an Operator license which offers operator privileges. To perform administrative tasks such as user management, discovery, and modeling in OneClick, users must have additional administrator privileges. The default Operator license assigned to a user account does not provide administrative privileges. The Administrator license provides the privileges required to perform the following OneClick administrative tasks: User Management Collection Management Discovery Topology Editing Pipe Management Create and Destroy Models Search Management If you are configuring a user account which requires administrator privileges, you must assign the account an Administrator license. You do this by clicking the Add/Remove button in the License tab of the Component Detail panel, shown in Figure Figure 4-15: Component Detail: Licenses When a user logs in, that user consumes assigned license(s) from the pool of available licenses. For example, when a user with both Operator and Administrator licenses logs in, one of each license is used. The licenses assigned to a user or group can be changed by following this procedure. 58 OneClick Administration Guide

59 Implement User Administration To Change Assigned Licenses Follow this procedure to change license assignment: 1. Select the user or user group for edit in the Users tab of the Navigation panel. 2. Click the Licenses tab of the Component Detail panel. 3. Click the Add/Remove button to select which licenses this user or group is a member of. Change the Landscapes a Selected User is Present In In a distributed SPECTRUM environment, you may need to change the landscape membership of users and groups. The following procedure provides the steps needed to change landscape membership. You can change landscape membership using the Landscapes tab of the Component Detail panel. Figure 4-16 displays the Landscapes tab for a fictitious admin-west user. This tab displays the state and name of each known SPECTRUM landscape with check marks in the Member Of column for each landscape this user is present in. You can edit a user s membership in SPECTRUM landscapes by clicking the Add/Remove button in the Landscapes tab. Figure 4-16: Component Detail: Landscapes In a distributed environment, there can be more than one SpectroSERVER each with its own SPECTRUM landscape. In order for a OneClick user to have access to an additional SPECTRUM landscape, the user must be a member of the landscape. Tips: You cannot edit membership in landscapes that are in the down state. We recommend that you make any user group landscape membership changes while no users are in the user group. Once the empty user group is a member of the desired landscapes, you can add users to the group. To Change Landscape Membership Follow this procedure to choose which landscapes a user or group exists in: 1. Click the Landscapes tab of the Component Detail panel. 2. Click the Add/Remove button. 3. Choose the landscapes you want this user or group to exist in. 4. Click OK. OneClick Administration Guide 59

60 Chapter 4: User Administration in OneClick Change Individual Privileges for a User or User Group Privileges can be added and removed individually by following this procedure. To Add or Remove Individual Privileges Follow this procedure to add or remove privileges: 1. Navigate to the Access tab of the Contents panel for the selected user. 2. Select the access group you want to modify privileges for. 3. Navigate to the Privileges tab of the Component Detail panel for the selected access group. 4. Click the Add/Remove button. 5. Enable or disable the privileges you want for this access group by checking or clearing the Enabled check box, respectively. Move an Existing User to a User Group After you review the special considerations, you can move existing users to user groups by following the procedure below. Special Considerations The following special consideration applies to all SPECTRUM environments: You cannot move the user you are currently logged in as. To Move a User to a User Group To move a user to a user group follow these steps: 1. Right-click on a user in the Users tab or the Users List tab and select Move To Group. The Select User Group dialog box appears. 2. In the Select User Group dialog box, select the destination group and click OK, as shown in Figure Figure 4-17: Select User Group 60 OneClick Administration Guide

61 Implement User Administration Remove a User from a User Group When you remove a user from a group, the user automatically appears in the Users tab of the Navigation panel as an individual user. Removing users from groups causes them to lose any privileges inherited from the user group level. To Remove User From a Group Follow this procedure to remove a user from a group: 1. In the Users tab of the Navigation panel, right-click a user you want to remove from a group. 2. Select Remove From Group from the menu, as shown in Figure Figure 4-18: Remove From Group The user is removed from the group and appears under the top-level Users group in the Users tab of the Navigation panel. Important: After removing a user from a group, verify that the user has the desired access groups and privileges assigned. Delete a User or User Group Users and groups can be deleted from OneClick as necessary using the following procedure. To Delete a User or User Group Follow this procedure to delete a user or group: Note: When you delete a user group, any users contained in that group are then organized under the top-level Users node. 1. Select the User or User Group for deletion in the Users tab. The user Administrator is selected for deletion in Figure Click the Delete button. OneClick Administration Guide 61

62 Chapter 4: User Administration in OneClick Figure 4-19: Delete User or Group Use Security Communities to Manage User Access to Models and Devices Security communities limit user access to specific sets of models and views that use the same security string. Only users with membership in a security community that matches the security string on a model can access the model. You can assign security communities to an individual user or to a user group. All users in a user group inherit the privileges of the security communities assigned to the group. Refer to Model Security in OneClick on page 73 for information about applying device and model security. ADMIN is the default security community provided, applied to all models and users. By default, ADMIN allows users to see all models. To limit user access, you can either edit the ADMIN privileges for specific users or user groups, or create a new security community with the desired privileges, and delete the ADMIN security community for the users and user groups for which you want to limit or modify access. Restricted View of Community Names The Operator Read Only privilege role by default restricts its users from viewing community names. A OneClick Administrator needs to enable this privilege for specific Operator Read Only users as needed. From the Access tab, Privileges tab, you can view, create, edit, and remove security community assignments from a user or user group. NOTE: You cannot configure security communities for super users. If you select a user who is a super user, the Access tab is disabled. To View Current Privileges for Viewing a Community Name You can view a user or groups current privileges for viewing a community name using the following procedure: 1. Select the user or group you want to view privileges to a community name for in the Users tab. 2. Selecting the community name in the Security Community list in the Access tab. 3. In the Privileges tab of Component Detail panel, select Model Management, View Attributes, Community Names. Privileges for viewing that community name are determined by whether or not Enable is selected. 62 OneClick Administration Guide

63 Implement User Administration To Add or Remove Community Names from Users View Follow this procedure to change a users access to viewing a community name. 1. Select the user or group that you want to change community name viewing privileges for in the Users tab. 2. Select the community name that you want to change the users access to in Security Community list in the Access tab. 3. Click Add/Remove in the Privileges tab in the Component Detail panel. The Add/Remove window appears. 4. Select Model Management, View Attributes, Community Names in the Add/Remove window. Change the existing privilege by selecting or deselecting Enable. 5. Click OK to implement the change. Alternatively, you can create a new role that adds the community name privilege and then assign the new role to the user or group. To Create and Assign Security Communities to a User or User Group Follow this procedure to create and assign security communities to a user or user group. 1. In the Navigation panel, click the Users tab and select the user or user group you want to assign a security community to. 2. In the Contents panel, click the Access tab. 3. Click New in the Access tab. The New dialog appears (Figure 4-20). 4. Enter the name of the new security community that you want to create. Note: Do not use spaces when naming security communities. 5. Click Add. Enter any additional security communities that you want to share the same privileges in this dialog. 6. Click OK. 7. To create security communities for the selected user or user group that will not share the same privileges as the security communities you just created, click New again. Otherwise, the new security communities appear in the Access tab. Figure 4-20: Create New Security Community Dialog Box OneClick Administration Guide 63

64 Chapter 4: User Administration in OneClick This procedure needs to be done in conjunction with assigning these new security communities to specific models or model types so that they are meaningful in providing or limiting access in OneClick. You also need to assign privileges or privilege roles to the security communities you have created. To Edit a Security Community Assignment for a User or User Group Follow this procedure to edit an existing security community assignment for a user or user group. 1. In the Navigation panel, click the Users tab and select the user or user group you want to assign a security community to. 2. In the Contents panel, click the Access tab. Select the security community you want to edit. 3. Click Edit in the Access tab. The Edit dialog appears (Figure 4-21). 4. Do one of the following: To add an entry to the selected security community, enter the name of the new entry in the first field. Click Add. To remove an entry from the selected security community, select the entry from the list and click Remove. To modify an existing entry for the selected security community, select the entry from the list. Make modifications to the security community entry in the first field. Click Modify. 5. Click OK. The modifications to the selected security community appear in the Access list. Figure 4-21: Edit Security Community Dialog Box For the changes made in the preceding procedure to be meaningful, the modified security communities need to match security string attributes already applied to models, or ones that you are going to apply as part of an overall device access and security policy. To Remove a Security Community Assignment from a User or User Group Follow this procedure to remove an existing security community assignment for a user or user group. 1. In the Navigation panel, click the Users tab and select the user or user group you want to remove a security community from. 2. In the Contents panel, click the Access tab. Select the security community that you want to remove from the list in the access tab. 64 OneClick Administration Guide

65 Manage Users From the Client Details Web Page 3. Click Remove in the Access tab. Click Yes to confirm your selection or No to return to the Access tab without removing the security assignment. If you click Yes, the security community is removed from the Access tab for the selected user or user group. This user or user group no longer has access to the models that the deleted security community provided. Manage Users From the Client Details Web Page The OneClick Client Details web page enables you to perform these additional user management tasks: View OneClick license information to check license utilization. See To View the Client Details Web Page for details. Send messages to logged in client(s). See To Send a Message to Clients from the Client Details Web Page for details. Manage OneClick licenses by administratively logging off selected users. See To Administratively Log Off Clients from the Client Details Web Page for details. To View the Client Details Web Page To view the Client Details web page, follow this procedure: 1. In a web browser, navigate to This opens the main OneClick web page. 2. In the main OneClick web page, click the Client Details link. The Client Details web page opens. The OneClick Client Details web page displays License Summary and Client(s) Logged On tables as shown in Figure Notes: This web page can only be accessed by OneClick administrator users. This web page is not automatically updated with the latest client information. To ensure you have the latest information, use the Reload function of your web browser to reload the page. OneClick Administration Guide 65

66 Chapter 4: User Administration in OneClick Figure 4-22: Client Details Client Details link License Summary table displays OneClick license usage information Client(s) Logged On table displays currently logged on users and lets you send a message to or log off selected user(s) The License Summary table provides the following information: Total concurrent OneClick licenses by type Number of licenses currently in use by connected clients Which logged in users have which license(s) To Send a Message to Clients from the Client Details Web Page To send a message to logged-in client(s) from the Client Details web page, follow this procedure: 1. In the Client(s) Logged On table, select the check box(es) next to the User Name of the client(s) you want to send a message to and click Send Message (Figure 4-22). 2. Enter a message in the Enter Message dialog box and click Send. To Administratively Log Off Clients from the Client Details Web Page To log off logged-in client(s) from the Client Details web page, follow this procedure: 1. In the Client(s) Logged On table, select the check box(es) next to the User Name of the client(s) you want to log off and click Log off Clients (Figure 4-22). 2. Click OK in the dialog box. The client(s) are logged off and receive a message indicating the administrator user who logged them off. Manage OneClick Licenses by Limiting Concurrent User Logins Each time a user launches a OneClick client, that client consumes one instance of each OneClick license assigned to the user. By default, OneClick users can launch unlimited clients with a single set of login credentials. In this case, it is possible for a single user to consume all of the available OneClick licenses by launching clients again and again without exiting the previously logged-in clients. Note: Maximum logins must be set at the user level and cannot be set at the user group level. As an administrator, you can restrict the number of concurrent OneClick licenses a user can consume at one time. By using this feature, you can distribute the available OneClick licenses 66 OneClick Administration Guide

67 Manage Users From the Client Details Web Page among multiple users. Additionally, the maximum number of logins may be set to zero to effectively lock out a user without destroying the user account and information. The Details tab of the Component detail panel for a selected user in the Users tab enables you to perform these additional user management tasks: View the number of OneClick logins permitted for a user. See To View Maximum Concurrent Logins Allowed for a User for details. Restrict concurrent logins for a user. See To Restrict User to One Concurrent Login for details. Restrict a user from launching any OneClick clients. See To Restrict User from Launching OneClick for details. Allow a user to launch as many clients as there are licenses (the default setting). See To Remove all login restrictions for a user for details. To View Maximum Concurrent Logins Allowed for a User To view a user s maximum logins setting, follow this procedure, navigate to the Details tab of the Component detail panel for a given user in the Users tab (Figure 4-23). Figure 4-23: Maximum Logins Set maximum logins To Restrict User to One Concurrent Login To restrict this user to a single concurrent license: 1. Navigate to the Details tab of the Component detail panel for a given user in the Users tab (Figure 4-23). 2. Click the set link for Maximum Logins (Figure 4-23). 3. Enter 1 and click the Save link. OneClick Administration Guide 67

68 Chapter 4: User Administration in OneClick To Restrict User from Launching OneClick To restrict this user from launching any OneClick clients: 1. Navigate to the Details tab of the Component detail panel for a given user in the Users tab (Figure 4-23). 2. Click the set link for Maximum Logins. 3. Enter 0 and click the Save link. To Remove all login restrictions for a user To allow this user to launch an unlimited number of OneClick clients (the default setting): 1. Click the set link for Maximum Logins. 2. Click the Unlimited link. 68 OneClick Administration Guide

69 Chapter 5: Configuring Additional OneClick Applications This chapter discusses SPECTRUM add-on application administration and configuration in OneClick from the perspective of a OneClick administrator. This includes managing and configuring other SPECTRUM applications. In this chapter Configuring Service Performance Manager (SPM) Data Export Parameters in OneClick Display Topology Tab Contents in a Web Page Configuring Service Performance Manager (SPM) Data Export Parameters in OneClick Note: For more information about SPM, see the Service Performance Manager User Guide (5093). You can enable and disable SPM data export logging in OneClick as well as set the duration for which data is written to the output log file and the directory location of the output log file. When SPM logging is configured and enabled in OneClick, SPM creates and saves text files that contain SPM test result data. SPM data files are in SPECTRUM SSLogger format and can be used by a reporting utility. SPM export data files include model handle, time stamp, and a list of SPM testspecific result statistics on each line. These files are created and saved in the form SPMResults.<timestamp>. To configure SPM data export in OneClick, you must first enable SPM data export logging, then set the period for which data is written to each log file, and, finally create and specify the directory location of the output log file. The log files are saved in an output directory you must first create on the OneClick Web server host and then specify. At the end of the interval you specify, the file is saved and a new file is created containing the latest result data. By default, when SPM data export is enabled, 60 minutes of data is captured before the SPM log file is saved and closed and a new file opened for logging. New log files are created after an interval you specify (by default this is 60 minutes). 69

70 Chapter 5: Configuring Additional OneClick Applications Note: By default, when SPM data export is enabled, OneClick attempts to save SPM data files to the directory /tmp. You must first create the /tmp directory or create and specify an alternate directory structure for the SPM log files to be saved in. To enable SPM Data Export By default, SPM Data Export is disabled in OneClick. To configure and enable SPM Data Export on the OneClick Web server, follow this procedure: 1. Navigate to the OneClick Web server home page at spectrum/index.jsp 2. On the OneClick Web server main web page, click the Administration link to open the Administration web page. 3. Click SPM Data Export from the left panel of the Administration page. 4. The SPM Data Export Configuration page opens. 5. Set the SPM Data Export radio button to Yes. 6. Specify the elapsed time (in minutes) when the current SPM log file will be saved and closed and a new file opened for logging by setting the value of Log File Cycle Time (min). The default value is 60 minutes. 7. Specify the location of the directory where OneClick stores SPM log files. a. Create a directory structure for OneClick to save the data files in. By default OneClick attempts to save the data files in /tmp which you must create first if it does not exist. b. Set Log File Directory to the full path to an existing directory structure of your choice. 8. Specify which SPECTRUM landscapes OneClick will export data from in a distributed environment. Move the landscape(s) you want to export data from into Show Landscapes and move any landscapes you do not want to export data from into Hide Landscapes in the Landscape Filter (Figure 5-1 on page 71). By default, all available landscapes are included. 70 OneClick Administration Guide

71 Display Topology Tab Contents in a Web Page Figure 5-1: SPM Landscape Filter Enable SPM data export Specify logging interval Specify log file directory Set the landscapes to log data for 9. Click Save. A dialog box prompts you to commit your changes and restart the OneClick web server (the OneClick web server must be restarted for these changes to take effect). 10. Click OK in the dialog box to both save your changes and restart the OneClick Web server. Display Topology Tab Contents in a Web Page You can use a topology applet to make the contents of your Topology tab available from a web page. You will need to specify the container-based model handle that you want to view the topology of. Note: You can use the Attribute Editor or vnmsh to determine the model handle of the container you want to use. For more information about the Attribute Editor, see the Modeling Your IT Infrastructure Administrator Guide (5167). To display Topology tab contents in a web page, type the following URL into your web browser: handle> <model handle> Specifies the container-based model handle that you want to view the topology of. The portion of the Topology tab you specified is now accessible from this web page. From here you can drill into other containers and return to the starting point. OneClick Administration Guide 71

72 Chapter 5: Configuring Additional OneClick Applications To display Topology tab contents within an existing web page, do one of the following: Embed the topology applet into the web page using an iframe as follows: <iframe src=" handle>" width="830" height="530"/> Your browser does not support embedded objects, <a href=" <hostname>:<portnumber>/spectrum/topology.applet?mh=<model handle>">click here</ a> to go to included content. </iframe> Note: This method works best for Internet Explorer browsers. Embed the topology applet into the web page using following syntax if you would prefer not to use iframes: <div> <object data=" handle>" type="text/html" width="830" height="530"> Your browser does not support embedded objects, <a href=" <hostname>:<portnumber>/spectrum/topology.applet?mh=<model handle>"> click here</a>to go to included content. </object> </div> Note: This method works best for Firefox browsers. The portion of the Topology tab you specified is now accessible in a web portlet. From here you can drill into other containers and return to the starting point. 72 OneClick Administration Guide

73 Chapter 6: Model Security in OneClick This chapter describes model security and how to configure it in OneClick. In This Chapter SPECTRUM OneClick Model Security Terminology on page 73 What is Model Security in SPECTRUM OneClick? on page 74 Using Security Strings to Secure Modeled Elements on page 74 SPECTRUM OneClick Model Security Terminology Table 6-1: Model Security Terms Term Security Community Security String Legacy User Community String Description A security community determines user access to secure models. SPECTRUM provides a default ADMIN security community that provides access to all models including models secured with a security string. Security strings are expressions that define security communities. This defines access to models, securing them from unauthorized users. Security strings are set at the model level for modeled elements in OneClick. The legacy Security & User Maintenance Guide (2602) contains more information about security communities and security strings. The SPECTRUM legacy user community string has been replaced in OneClick by access groups and privileges. The legacy community string can still be viewed and edited in OneClick under the Details tab for a selected user in the Users tab. The legacy community string is still used by non-oneclick SPECTRUM applications. 73

74 Chapter 6: Model Security in OneClick What is Model Security in SPECTRUM OneClick? Model security in OneClick enables you to control user access to models. You secure a model by setting the security string on that model. Process for securing models The following process identifies how to secure modeled network elements in OneClick: 1. Apply a security string to a modeled element you want to secure (for example, set the security string of a LAN container model to lan1). 2. The security string set on the model in step 1 must appear in an entry in the Access tab of a given user s account for that user to access that secured model: 3. To prevent a user from accessing secured models, remove the default ADMIN access group in the Access tab for that user. The ADMIN access group grants access to all secured models: For instructions on applying security strings to models see Using Security Strings to Secure Modeled Elements on page 74 For instructions on adding or modifying Access tab entries for users or groups see Use Security Communities to Manage User Access to Models and Devices on page 62 For detailed examples of model security implementations, see Task to accomplish: Secure a model in a remote office from local users on page 77 and To Advanced model security example on page 77. Using Security Strings to Secure Modeled Elements Model security applies to users that do not possess the default ADMIN access group. The default ADMIN access group provides access to all models. For users configured without the ADMIN access group, setting the security string on a model prevents users without a matching entry in their Access tab from accessing the model. The following procedure provides the basic steps to configure model security. Note: This procedure assumes you have already modeled elements in your OneClick environment. See the Modeling Your IT Infrastructure Administrator Guide (5167) for information about modeling network elements. To Configure Model Security This procedure: Secures a model with a security string Gives a user access to that secured model Prevents unauthorized users from accessing secured models 1. In the Topology tab of the OneClick Contents panel, select a modeled element, such as a device model, that you want to secure. An example is shown in Figure OneClick Administration Guide

75 Using Security Strings to Secure Modeled Elements Figure 6-1: Setting Model Security String Modeled entity you want to secure selected in the Topology tab Security String setting for the selected model. By default, this is blank for modeled network elements. 2. In the Information tab of the Component Detail panel, click the Security String set link, type a security string, and press Enter. This model is now inaccessible for users who do not have the ADMIN access group or an Access tab entry with this security string. 3. To give a user access to this secured model: a. Select the user in the Users tab of the Navigation panel and click the Access tab of the Contents panel. b. For model security to function for this user, you must first remove the default ADMIN access group, if it is present. To do this, select the ADMIN access group (Figure 6-2) and click Remove. Note that if you do not remove the ADMIN access group for a user, the user will still have access to all secured modeled elements in OneClick. OneClick Administration Guide 75

76 Chapter 6: Model Security in OneClick Figure 6-2: Selected Default ADMIN Access Group Selected ADMIN access group Note: When you remove an access group from a user as described in step b, any privileges assigned with that access group are also removed. c. Click the New button in the Access tab of the Contents panel. The New access group dialog box appears (Figure 6-3). Figure 6-3: Creating a New Access Group ADMIN access group has been removed 1. Enter a security community in the New access group dialog box and click Add to add a security community 2. Click OK to create the new access group d. In the New dialog box, enter the security community from step 2 and click OK. 76 OneClick Administration Guide

77 Using Security Strings to Secure Modeled Elements 4. In step b you either ensured that the default ADMIN access group is not present or removed it. Now, you should verify that this user has adequate privileges. To do this, assign the appropriate privileges to the access group you added in step d: a. Select the access group you added in step d. b. In the Privileges or Roles tab for the selected access group, assign the privileges you want this user to have for this security community. For example, in the case of an operator user, you might assign the OperatorRW privilege role using the Roles tab. See Create and Assign Roles to Users or User Groups on page 52 for more information about roles. When this user logs on, models that have a security string that matches the access group entry from step d as well as all non-secured models appear in the Topology tab for the user. This user will also see any container models that contain models that are accessible to the user. Scenarios for implementing model security The following scenarios provide examples of both simple and more complex model security use cases. Task to accomplish: Secure a model in a remote office from local users To help you understand security strings in OneClick, a simple example follows: You want to secure a single model in a remote office so that local OneClick users cannot access it. Setting the security string of the model (to remote, for example) would secure it. Users without the ADMIN access group would need to have an access group with an entry of remote to access that model. Users with only an access group entry of local (for example) would not have access to this model. Task to accomplish: Secure administrative access to a branch office network To help you understand model security in OneClick, a complete example of a security implementation in OneClick follows: Consider an East coast office and a West coast office. Network administrators in the East coast office must have read/write access to the East coast office s network in OneClick. They must also have read-only access to the West coast network. The inverse is true for the West coast administrators. To Advanced model security example The following procedure could be used to create a solution to this requirement. It can also be modified to suit your needs. 1. Create two LAN containers in OneClick representing the two networks. Name one LAN container WEST and the other EAST. 2. Populate each container with different modeled network assets. 3. Set the security string on each LAN container. In the Information tab of the Component Detail panel for a selected LAN container, set the security string: a. Set the EAST LAN container s security string to EAST (see Figure 6-4). This effectively creates a security community named EAST. OneClick Administration Guide 77

78 Chapter 6: Model Security in OneClick Figure 6-4: Setting Security String Click the set link and set the security string to EAST for the EAST LAN container. b. Set the WEST LAN container s security string to WEST. This effectively creates a security community named WEST. These security strings roll down from the LAN container level to its contained models. A security string set at the container level is automatically set for all its contained models. When this is complete, the Explorer tab of the Navigation panel should look (to the OneClick Administrator user) like Figure 6-5: Figure 6-5: WEST/EAST LAN Containers The WEST and EAST LAN containers are members of the WEST and EAST security communities, respectively. The WEST LAN container contains a model of a router at The EAST LAN container contains a model of a router at OneClick Administration Guide

79 Using Security Strings to Secure Modeled Elements 4. Create user groups to correspond with the EAST and WEST network containers: a. Create an EAST user group. In the Create Group dialog box, create an access group with read/write privileges for the EAST security community (Figure 6-6): Figure 6-6: Setting Up Access during Create Group Read/write access to the security community EAST has been added to this user group To add read only access to the WEST security community, enter WEST in this field and click Add. b. Create a WEST user group. In the Create Group dialog box, create an access group with read-only privileges for the EAST security community. 5. Create a user inside the EAST user group and another user inside the WEST user group. Notice in the Access tab that the access groups (security community) are filled in from the User Group level (not editable here at the User level). 6. To test, log in to OneClick as the user you created inside the WEST user group in step 5 and navigate to the EAST LAN container (shown in Figure 6-5). 7. When viewing models inside the EAST LAN container, users in the WEST user group have Administrator read only rights as shown in Figure 6-7. For example, Figure 6-7 illustrates the fact that values in SPECTRUM Modeling Information cannot be edited by this user at this model. OneClick Administration Guide 79

80 Chapter 6: Model Security in OneClick Figure 6-7: View of a Model in the EAST LAN for a User in the WEST User Group This user in the WEST user group has administrator read only access to this model in the EAST LAN container and cannot edit its values. 8. Now navigate to the WEST LAN container. Notice that this user in the WEST user group has Administrator read/write privileges for models inside the WEST LAN (shown in Figure 6-8). For example, Figure 6-8 shows that values in SPECTRUM Modeling Information can be edited by this user at this model. 80 OneClick Administration Guide

81 Using Security Strings to Secure Modeled Elements Figure 6-8: View of a Model in the WEST LAN for a User in the WEST User Group This user in the WEST user group has administrator read/write access to this model in the WEST LAN container and can edit values here. If you log in to OneClick as the user you created inside the EAST user group in step 5 and navigate to the WEST LAN container, the inverse of step 7 will be true (i.e. users in the EAST user group have Administrator read only rights to the models inside the WEST LAN container, and read/write rights to the models in the EAST LAN). OneClick Administration Guide 81

82 Chapter 6: Model Security in OneClick 82 OneClick Administration Guide

83 Chapter 7: Setting Preferences for Users and Groups This chapter describes preferences in OneClick and how to use the OneClick Preferences Editor to set preferences for users and groups. In This Chapter Introduction to Preferences on page 83 Accessing the Preferences Editor on page 84 About the Preferences Editor on page 84 Setting and Locking Preferences on page 84 Importing and Exporting Preferences on page 86 Setting Alarm Filter Preferences on page 86 Resetting Preferences on page 86 Introduction to Preferences Preferences in OneClick control the appearance of the OneClick Console (for example, the fonts used in tables and the sort order of columns) as well as the behavior of certain aspects of the user interface. Not only can you configure privileges for users and user groups in OneClick as described in User Administration in OneClick on page 37, but you can also administratively set preferences for users and groups. The OneClick Preferences Editor lets administrators set, lock, and save preferences for multiple users and groups. Important: Selecting View, Preferences from the main OneClick menu opens user-level preference editing for the currently logged-on user. The Alarm Filter dialog box once accessed from this menu item can now be launched from a button on the Alarms toolbar. 83

84 Chapter 7: Setting Preferences for Users and Groups Accessing the Preferences Editor To access the Preferences Editor to set preferences for a user or user group: 1. In the Users tab, right-click a user or user group for which you want to set preferences. 2. Choose Set Preferences from the menu to open the Preferences Editor. To access the preferences editor to set preferences for all users (globally): 1. Right-click the top-level user group (Users) in the Users tab. 2. Choose Set Preferences from the menu to open the Preferences Editor. About the Preferences Editor The Preferences Editor organizes OneClick preference settings into the following groups of tasks: Alarms Events Explorer Tab General Interfaces List Tab Locater Tab Topology Tab VPN Manager When the top-level Preferences group is selected in the navigation panel, all available preferences and the tools to edit them are shown in the content panel. Selecting a preference or preference group in navigation panel displays the preference or preference group in the content panel. The left panel of the Preferences Editor also lets you lock preferences for the selected user or user group. See Setting and Locking Preferences on page 84. When you launch the Preference Editor in the context of setting preferences for users and groups (as described in Accessing the Preferences Editor on page 84), the Preference Editor displays the name of the user or group being edited at the base of the navigation panel. Setting and Locking Preferences User preferences can be set and/or locked by the OneClick administrator at the global (all users), user group, or user level. Users cannot lock their own preferences. If a preference is set and locked for a user or group, the preference cannot be changed by the user or members of the user group, respectively. Important: A locked preference can only be unlocked and edited at the level it was locked. If a preference is locked at the global or user group level, the preference cannot be unlocked or edited at the user level. If the Preference Editor is launched in the context of a given user and a 84 OneClick Administration Guide

85 Introduction to Preferences preference is locked at the global or group level for that user, the administrator will not be able to change the preference. The lock check box will be grayed out in this case. Setting user and group preferences is controlled by OneClick administrator privileges: The Set User Preferences privilege grants access to set preferences for particular users and groups. This is controlled by the user/group model's security string. The Set Global Preferences privilege grants access to set preferences at the global level. To Set or Lock User Preferences To set or lock user preferences, follow this procedure: 1. In the Preferences Editor for a selected user or user group (see Accessing the Preferences Editor on page 84), navigate to the preference(s) you want to set and lock in the hierarchy in the navigation panel. 2. Make any changes necessary to the preference(s) in the right panel. 3. Select the check box(es) in the Locked column to lock any corresponding preferences. Locking a preference group also locks all preferences contained by the preference group. The Locked At column shows the level at which the preference is locked (user, user group, or all users). The Locked By column displays the administrator user who locked it. Note: The Locked, Locked At, and Locked By columns only appear in the Preferences Editor when launched by an administrator in the context of another user or user group. Figure 7-1 shows the preferences for the alarm count columns in the Explorer tab have been edited to display all alarms for the user group Administration. No user in this group can change this preference because it is locked at the user group level. Locked preferences display a small padlock icon. Figure 7-1: Setting and Locking Preferences: User Group OneClick Administration Guide 85