Single Sign on from NCM to managed devices

srini.burla

It would be extremely beneficial to have single sign on from NCM to the managed devices. This will help unify the user access and can limit what users can make changes or can't on the network devices.We had an example of one use who doesn't have access to network switches with TACACS, but does have access to NCM and pushed a destructive job.

Thanks

Srini.

rschroeder

I apologize for being one to offer an alternate view.  I'm not certain how single sign-on can fix the problem of a malicious or careless NCM administrator, but perhaps others will help me understand the rationale.

Please don't take this as criticism.  Rather, a gentle and friendly suggestion and guide that offers a different path to your goal--one which will more quickly be achieved than waiting for SW to intuit the need of everyone's unique environment and parse a solution for SSO that work automatically and reliably.  It's a wonderful goal, but a practical work around might be as follows.

I believe:

• Users should not have access to a network device's configuration interface if they are not properly trained, not trustworthy, or not competent.
• A user must not be given NCM rights if they are not competent or trustworthy.
  • NCM requires full read-write permissions; if If someone gave an untrained or non-trusted person NCM administrative access, that was a mistake on the SolarWinds administrator's part.  when the user is specifically denied access to network nodes' configuration interface.
  • The trick is taking the harder path:  the SolarWinds Administrator must limit users' access to NCM if they aren't supposed to have access to the configuration interface to a node.  The SolarWinds admin specifically:
    • Allows or denies a local user account NCM access
    • Allows or denies a team member to be part of a Windows AD Group that is given access to SolarWinds.
      • You may correct this by creating a different AD Group that has no access to NCM and putting the untrusted/untrained user in that group, and removing that person from any AD group that has admin rights to Solarwinds, or
      • Remove NCM rights from that user's local Solarwinds account

1. Go to Settings > All Settings > User Accounts > Manage Accounts

2. Select the individual account in question (or the Windows or SAML Group) and Edit it.

3. Edit the individual account or Group account and set "Allow Administrator Rights" to No.  Set "Allow Node Management Rights" to No.

4.  Review all other options and allow or deny the user or group access to them.

5. Scroll down to Network Configuration Manager Settings and select the appropriate access for this user or group:

It can take some time and concentration to open every option and consider and determine the appropriate access for this user or group.  The time is well-spent.

6.  Finally, document the changes and use them as a template for similar situations in the future unless you know all future SolarWinds users will be placed in a group with appropriate rights.