Is inheritance taken into account?

When creating a group account based on existing Active Directory group, is inheritance taken into consideration?

For example, I have two AD security groups: 'X' is a parent of 'Y'. User 'John' is a member of 'Y'-group.
So I'm creating an 'X'-group account with admin privileges in the Orion. Will John have admin rights or not?

Find more posts tagged with

orion

Accepted answers

adatole

Short answer: no inheritance.

Medium answer:

Orion user groups (whether orion-based, AD individual accounts, or AD groups) use an ACL-style structure. So when a user logs into Orion, whichever group they belong to which is highest up on the list when you go to "manage accounts" is going to be the rights they get every time.

Example:

Leon is part of the AD group "sudosandwich" and also the AD group "clevelanders"
Leon has a local (orion-based) account named "orionleon"
Leon has had his AD account added to Orion as an individual account
Both the groups "sudosandwich" and "clevelanders" have been added to Orion as AD groups

Looking at the Settings, All Settings, Manage Accounts you might see the following:

Account	Account type	My comments
Admin	Orion
orionleon	Orion	If Leon logs in with "orionleon" this is used
SOLARWINDSCORP\leon	Windows (individual)	If Leon logs in with any "leon" account, this is used
SOLARWINDSCORP\clevelanders - leon	Windows (group)	this never gets used
SOLARWINDSCORP\sudosandwich - leon	Windows (group)	nope, not this either

Because of the way SW sorts accounts, it's always local, then individual, then group. I'm honestly not sure whether SAML accounts come before or after the AD groups.

But this should give you the info you needed to get started.

All comments

adatole

Short answer: no inheritance.

Medium answer:

Example:

Leon is part of the AD group "sudosandwich" and also the AD group "clevelanders"
Leon has a local (orion-based) account named "orionleon"
Leon has had his AD account added to Orion as an individual account
Both the groups "sudosandwich" and "clevelanders" have been added to Orion as AD groups

Looking at the Settings, All Settings, Manage Accounts you might see the following:

Account	Account type	My comments
Admin	Orion
orionleon	Orion	If Leon logs in with "orionleon" this is used
SOLARWINDSCORP\leon	Windows (individual)	If Leon logs in with any "leon" account, this is used
SOLARWINDSCORP\clevelanders - leon	Windows (group)	this never gets used
SOLARWINDSCORP\sudosandwich - leon	Windows (group)	nope, not this either

Because of the way SW sorts accounts, it's always local, then individual, then group. I'm honestly not sure whether SAML accounts come before or after the AD groups.

But this should give you the info you needed to get started.

omavel

Thanks! That should be included in docs imho @tony.johnson

tony.johnson

Thanks @omavel

This is described in https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/Core-Managing-Web-Accounts-sw1724.htm

It is also seen in the UI when adding an Individual Account

"Add individual accounts to Orion. If a user has an individual account and is a member of a group, individual account permissions/settings will be applied and all group permissions/settings will be ignored."

Or A Windows Group Account

"Add Windows groups (Active Directory or local) to Orion. Any member of the group account will be able to access Orion with appropriate permissions and assigned views. If a user is a member of multiple group accounts, the group account highest in the list below will be applied. (A user will only receive permissions and views from a single group account.)"

omavel

As I see, this is not what I asked about, because my question was about AD inheritance and not about the order of AD groups in Orion account manager.