NPM Access Management

Hey guys, I’ve always had issues with limitation based accounts. So wondering, how do you guys maintain permissions forOrion users ? We have approximately 300 users and they only have access to their devices. We have an average of 100 simultaneous users and we use groups to implement limitations. I would like to see what other admins are using to effectively manage permissions without having to obtain sw licensing.

Thanks David

Find more posts tagged with

npm

Accepted answers

All comments

bluefunelemental

‌No idea what without licensing means?

As for limitations- always found group membership to be the slowest limitation filter to use.

Have you tried to create groups through dynamic query filter based on node custom property? I use this to group and for account limitations and it's fast as could be.

ctlswadmin

We had everything working fine with 10.7 and hotfix 3 (I think) installed, then we were asked to upgrade to 11.0 to fix issues with UDT. When that broke our env we were asked to upgrade to 11.5. The upgrade did help a bit, however we still have about 10 second load times upon login.

I have tried dynamic queries, however these groups are then added to a larger parent group. Our parent groups have around 90 nested groups and individual devices as well. Last time I used dynamic groups was when we were on 10.5, will definately give them a second chance.

Licensing meaning additional sw products like the web server, or additional npm licenses.

Thanks!

bluefunelemental

As an example- I used to limit accounts by groups and found the page time to be too slow.

Now we have several custom properties - loc_region and loc_sitecode which both can be used to populate groups (both parent and child) or account limitations.

RichardLetts

agree with the others -- don't use groups for account limitations. When people say they are slow, they mean they are this slow:

Faster than group evaluation for account limitation

we use the same custom properties we use to build groups to do account limitations, and that is many orders of magnitude faster.

ctlswadmin

Hey guys, I tried dynamic query groups but that didn’t work out. This is the way I configured my group, I created the parent group and then created other groups and implemented dynamic queries. Then I placed all of my dynamic query groups within the parent group. As I started adding more groups performance went down. To clarify, this only happens when I implement account limitations; as soon as I remove the limitation everything is fairly quick. I also implemented limitations based on custom properties, the issue with this is that the account can still see other devices in Orion and this unfortunately will not work.