Page tree

Contents

By default, the Grid Master denies access to Grid members when a limited-access admin group does not have defined permissions. You can grant an admin group read-only or read/write permission, or deny access to all Grid members or you can grant permission to specific Grid members, as described in Applying Permissions and Managing Overlaps.

Note

Only superusers can modify DNS and DHCP Grid properties.


The following sections describe the types of permissions that you can set with Grid permissions:

Administrative Permissions for Grid Members

Table 4.8 lists the tasks admins can perform and the required permissions for Grid members.

Table 4.8 Grid Member Permissions







Tasks

Grid Member(s)

Member DNS Properties

Member DHCP Properties

Restart Member DNS

Restart Member DHCP

DNS Views

DNS Zones

Networks

DHCP Ranges

Assign member to DNS zones




RW



RW



Assign member to networks





RW



RW


Assign member to DHCP ranges









RW

Configure member properties

RW









Add a member to a Match Members list of a DNS view

RW









Delete a view with members in a Match Members list






RO




View DNS and DHCP member properties


RO

RO







View and download syslog

RO









View DNS and DHCP configuration file


RO

RO







View network statistics

RO









Restart DNS service on the member




RW






Restart DHCP service on the member





RW





Administrative Permissions for Network Discovery

Limited-access admin groups can initiate a discovery and manage discovered data based on their administrative permissions.
You can set global permissions for network discovery as described in Defining Global Permissions. The following table lists the tasks admins can perform and the required permissions for network discovery.
Table 4.9 Permissions for Network Discovery






Tasks

Network Discovery

DNS Zones

Networks Selected for Discovery


Port Control

Initiate and control a discovery on selected networks

RW


RW


View discovered data



RO


Add unmanaged data to existing hosts, and resolve conflicting IP addresses



RW


Convert unmanaged data to a host, fixed address, reservation, A record, or PTR record


RW

RW


Configure device interfaces, provision networks on interfaces, de-provision networks

RW



RW

Administrative Permissions for Scheduling Tasks

You can schedule tasks, such as adding hosts or modifying fixed addresses, for a future date and time. To schedule tasks, you must first enable the scheduling feature at the Grid level, and then define administrative permissions for admin groups and admin roles. For information, see Scheduling Tasks. Only superusers can enable and disable this feature and grant scheduling permissions to admin groups. Limited-access admin groups can schedule tasks only when they have scheduling permissions.
Superusers can do the following:

  • Enable and disable task scheduling at the Grid level
  • Grant and deny scheduling permissions to admin groups and admin roles
  • Schedule tasks for all supported object types
  • Reschedule and delete any scheduled task

You can set global permissions to schedule tasks as described in Defining Global Permissions. The following table lists the tasks admins can perform and the required permissions. Users with read/write permission to scheduling can view, reschedule, and delete their own scheduled tasks.
Table 4.10 Scheduling Task Permissions





Tasks

Scheduling Task

All Networks

All DNS Views


All Shared Record Groups

Schedule the addition, modification, and deletion of all supported object types

RW

RW

RW

RW

View, reschedule, and delete scheduled tasks

RW

RW

RW

RW

Convert unmanaged data to a host, fixed address, reservation, A record, or PTR record

RW

RW

RW


To schedule tasks for specific resources, admins must have Read/Write permission to scheduling tasks, plus the required permissions to the supported resources. For information about permissions for specific resources, see the following:

Note that the appliance deletes all pending scheduled tasks when superusers disable task scheduling at the Grid level. The appliance deletes an admin's scheduled tasks when superusers do the following:

  • Set the scheduling permission of admin groups and roles to "Deny"
  • Delete or disable an admin group or an admin role
  • Delete or disable local admins
  • Delete the scheduling permission from any admin group or admin role that contains users with pending scheduled tasks
  • Change the admin group of a limited-access admin

Administrative Permissions for Microsoft Servers

By default, only superusers can add Microsoft servers as managed servers to the Grid. Limited-access admins can add and manage Microsoft servers from the Grid based on their administrative permissions.
The following table lists the tasks admins can perform and the required permissions. Note that only superusers can add a Microsoft server to a name server group.

Table 4.11 Microsoft Server Permissions






Tasks

Microsoft Server(s)

Grid Member(s)

Network Views

DNS Views

DNS Zones

Resource Records

Networks

DHCP Ranges

Superscopes

Assign Microsoft server to member

RW

RW








Assign a network view to the Microsoft server

RW

RW

RW







Assign a DNS view to the Microsoft server

RW

RW


RW






Assign Microsoft server as primary or secondary to DNS zones

RW



RW

RW





Remove a Microsoft server as the primary or secondary server of a zone





RW





Remove a zone from a Microsoft server





RW





Edit zones and resource records of Microsoft servers





RW

RW




Assign a Microsoft server to a network

RW






RW



Assign a Microsoft server to a DHCP range

RW







RW


Remove a network served by a Microsoft server

RW






RW



Remove a DHCP range (scope) from a Microsoft server







RW

RW


Add, modify and remove Microsoft superscopes

RW







RW

RW

Clear leases from Microsoft server

RW







RW


Edit Microsoft server properties

RW









View Microsoft server properties

RO









View and download Microsoft logs

RO









Start/Stop DNS or DHCP on the Microsoft server

RW









Remove a Microsoft server from the Grid

RW