Feature Req: Management:: User Authorisations

Question

Hi,

Would it be possible in the upcoming releases to include an option to restrict various users to only be able to perform various tasks.

Tasks Include: Manage/Unmanage/(Add/delete/change) Nodes/ Add comments to nodes/ Update specific custom properties etc.

For example server admins able to view all devices, however only able to unmanage or delete nodes devices that they control. An inbuilt property or custom

property may be used to to assign nodes into admin groups.

I think the next point has been requested but it would then be great to have accounting of users activities.

Kind Regards

Miron

sturdyerde · Answer

Orion is definitely closer, but some of these are still not yet features, more than 10 years later. Bumping, with links to feature requests:

cnorborg · Answer

And of course, all this should be tied into AD better.   I for one would like to be able to assign functionality based on AD groups rather than individual users.   ie: users in one AD group can sign in and see this group of nodes, while another group would allow users to see and administer another group of nodes...

Right now the only thing I ever got working was allowing all users access to all nodes I think, but that was a few revs ago...

One big thing I've always thought Orion was missing was the required feature set in terms of User roles, permissions and accountability that is required by many Enterprise operations.   Yes, you can lock down an individual user well, but its not simple and it takes time.   At the very least there should be "group roles/permissions" that you then assign users to.  But I'd rather see an AD integration that would allow you to assign roles/permissions without having a specific user in mind, that way if a user switched jobs, when he/she was taken out of the group that gave them permissions and the person taking their place was put into the group, the group that administers Orion would have zero work to do.   Heck, I'd even be happy with a TACACs integration using RBAC for that matter.

I think doing this would really put Orion on the map for Enterprises, would fit in with their "Ease of Use" philosophy also.  Right now the need to add each user into the software individually to give them any granularity as far as permissions goes is not easy to work with.

njoylif · Answer

Third!  Granularity would be awesome, like previously mentioned - based on value of custom field (maybe regex matching)...
Or, tied into LDAP/AD.  Thanks