Solution: Use WCC polices in EEM to grant full access to the administrators and restricted access to the schedulers.

Transcription

1 How to Filter Views in WCC Using EEM Policies 1 Scenario: You have two groups of WCC users: administrators and schedulers. You want administrators to have full access to all WCC Monitoring Views. You want schedulers to have restricted access to the WCC Monitoring Views they should only see the Monitoring Views associated with their global group. Solution: Use WCC polices in EEM to grant full access to the administrators and restricted access to the schedulers. For this tutorial, the administrator global group is called Dev_Admins. testadmin will be a user in that global group. The scheduler global group is called AE_Schedulers. testuser will be a user in that global group. You want the scheduler group to only see the Monitoring Views that BEGIN with the word Column. Objectives: (1) create a MonitorViewControl policy, (2) perform a permission check to verify policies work as expected, and (3) check the WCC GUI to see if each user sees the corrected view(s). =====================================================================================

2 How to Filter Views in WCC Using EEM Policies 2 Create a MonitorViewControl Policy with View Only Permissions 1. Click on the Manage Access Policies tab. On the left-hand side navigation panel, under Access Policies, click on the MonitorViewControl policy link. 2. Create a new MonitorViewControl policy by clicking on the icon (inside the red circle) next to the MonitorViewControl policy link. 3. Under the General Heading, give the policy a name. Leave all other fields with their default settings. Add a description of the policy, if needed. (This is helpful if you plan on creating and using multiple policies for multiple global user groups.) 4. Under Identities, add the dynamic user group(s). Under Type [red box], select Dynamic Group from the dropdown menu and click Search Identities. Select the dynamic user group(s) and click the blue arrow add them to the Selected Identities list. to

3 How to Filter Views in WCC Using EEM Policies 3 5. For Actions, check off View [pink box]. For Resources, under Add resource:, type view/.+/jobflow [brown box] and then click the plus sign. 6. Check off the Treat resource names as regular expressions checkbox [green box]. 7. Click on the Add Filter button and select/type the information below: a. In the red box, select named attribute from the dropdown menu. b. In the red box, select viewname from the dropdown menu. c. In the purple box, leave STRING set in the dropdown menu. d. In the purple box, select STARTSWITH --* from the dropdown menu. (This will filter on a view name that begins with a certain string of characters.) e. In the blue box, select value from the dropdown menu. f. In the blue box, type the string of characters associated with a view name that you want a group of users to be able to see. The string is CASE SENSITIVE.

4 How to Filter Views in WCC Using EEM Policies 4 g. In the brown box, select global user group from the dropdown menu. h. In the brown box, select Name from the dropdown menu. i. In the pink box, leave STRING set in the dropdown menu. j. In the pink box, select EQUAL == set in the dropdown menu. k. In the green box, select value from the dropdown menu. l. In the green box, type the name of the global user group that should be able to see the view specified in the filter. Summation of Filter: The global user group, AE_Schedulers, will only see Monitoring Views that start with the word Column. If a Monitoring View name does not begin with the word Column, then the global user group will not be able to see it. NOTE: Be mindful of the logic operators and parentheses placement. If you use the wrong operator or if there are too many/not enough parentheses, the logic for the filter may not be evaluated correctly. 8. Click Save this what the completed policy looks like:

5 How to Filter Views in WCC Using EEM Policies 5

6 How to Filter Views in WCC Using EEM Policies 6 Create a MonitorViewControl Policy with Full Permissions (Admin Policy) 1. Click on the Manage Access Policies tab. On the left-hand side navigation panel, under Access Policies, click on the MonitorViewControl policy link. 2. Create a new MonitorViewControl policy by clicking on the icon (inside the red circle) next to the MonitorViewControl policy link. 3. Under the General Heading, give the policy a name. Leave all other fields with their default settings. Add a description of the policy, if needed. (This is helpful if you plan on creating and using multiple policies for multiple global user groups.) 4. Under Identities, add the global user group(s). Under Type [red box], select Global Group from the dropdown box and click Search Identities. Select the global user group(s) and click the blue arrow Selected Identities list. to add them to the

7 How to Filter Views in WCC Using EEM Policies 7 NOTE: If you are using LDAP/Active Directory, type the name or partial name of the global user group in the Value field and then click the Search Button. Clicking on the Search Button without entering a name or partial name will cause latency because EEM is searching for every global user group in LDAP/Active Directory. 5. For Actions, leave [All Actions] checked off. For Resources, under Add resource:, type view/.+/jobflow and then click the plus sign. 6. Check off the Treat resource names as regular expressions checkbox [green box]. 7. Click Save this what the completed policy looks like:

8 How to Filter Views in WCC Using EEM Policies 8 NOTE: Any user(s), global user group(s), or dynamic user group(s) not specified in any of the created MonitorViewControl policies will not be able to access any of the Monitoring Views in the WCC GUI. 8. On the left-hand side navigation panel, under Access Policies, click on the MonitorViewControl policy link. 9. Click on the MonitorViewControlDefault link. 10. Check off the checkbox next to Disabled - then save the policy. 11. To confirm that the default policy is disabled, click on the MonitorViewControlDefault policy link and looked under the Options column the policy should be disabled.

9 How to Filter Views in WCC Using EEM Policies 9 Perform a Permission Check Perform a permission check to see if the policies are set up correctly. 1. Under the Manage Access Policies tab, click the Permission Check link. 2. This permission check will be on the MonitorViewControl policies: a. For the Resource Class, select MonitorViewControl from the dropdown menu. b. For Action, select View from the dropdown menu. c. For Resource, type view/.+/jobflow. d. For Identity, type the name of a user. (For testing, choose a user who should have view only permissions on Monitoring Views.) e. To the right [red box], select viewname from the dropdown menu. f. For Value, enter a string of characters for the Monitoring View name. NOTE: For the Identity field, you must enter an individual username. You cannot enter global user group or dynamic user group names. 3. Click Run Permission Check button.

10 How to Filter Views in WCC Using EEM Policies 10 The permission check results should show ALLOW. This is expected because the user specified in the Identity field has View permissions. NOTE: It s good practice to check off the Display debug information checkbox [pink box] under the Permission Check Results. If the result is DENY, you can use the debug information to determine why the check failed and make the appropriate corrections. Notice that the Permission Check shows which Policy granted the permission [blue box]. One of the main reasons a permission check would come back with a DENY is the lack of group association. That means the user chosen in the Identity field is a not a part of any global user groups or dynamic user groups. 4. Change the Action from View to Create. 5. Click the Run Permission Check button. The permission check results should show DENY. This is expected because the user specified in the Identity field has View permissions only.

11 How to Filter Views in WCC Using EEM Policies Change the user in the Identity field to a user who should have Admin or full permissions on Monitoring Views. 7. To the right [red box], click on the trash can to remove the named attribute information. 8. Click the Run Permission Check button. The permission check results should show ALLOW. This is expected because the user specified in the Identity field has full permissions. The Permission Check tells me what Policy granted the permission [blue box].

12 How to Filter Views in WCC Using EEM Policies 12 Check WCC for Filtered Views Login to the WCC GUI as a user who should only be able to see the Monitoring Views associated with the specified string of characters in the WCC MonitorViewControl View Only policy. The moment of truth....waiting for the truth..

13 How to Filter Views in WCC Using EEM Policies 13 testuser is a part of the global user group AE_Schedulers who can only see Monitoring Views that begin with the word Column. Login to the WCC GUI as a user who should only be able to see all Monitoring Views they should be associated with the WCC MonitorViewControl Full Permissions or Admin policy.