Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Restricting Client Access to One Page Only

Hi,

I would like to know if there is a way to restrict a client accessing my solarwinds website to one page only. I've already made a separate account, menubar and view for the client. but through the client's account i can still access the other pages, for example the Events.asp page (if I paste the URL direclty in the browser), through which he will be able to see past events for the node and interface. what I want is to restrict his view to just one interface on one node and not give him rights to view any other page e.g. events.asp, reports.asp, etc etc.

thank you.

Regards.

Find more posts tagged with

Security

Accepted answers

All comments

radiohead23

is there anybody out there?!?!

radiohead23

anyone at all?!?!

Solarwinds People??!?!

HELLLLPPP!!!!!

mark_wiggans

To limit the view to one page just create an account and edit the menu bar to the URL you desire then limit that page.

Make sure you have defined your own custom properties with the Custom Property Editor and then use Account Limitation Builder

To set default menu bar and view options:

1. Log in to the Orion NPM Web Console as an administrator.

2. Click Admin in the top menu bar.

3. Click Account Manager from the left pane menu.

4. Select the account that you want to configure, and then click Edit.

5. Scroll down to Default Menu Bar and Views, and then select a Menu Bar from the available list.

Note: If you are editing a user account that must have administrator privileges, set the Menu Bar to Admin.

6. Select a Home Page View.

Note: If no Home Page View is specified, the default is designated to be the same as the page that is specified in the Default Summary View field below.

7. If the Home Page View that you have selected refers to a specific network device, select a Default Network Device by clicking Edit, and then select from the list of available devices on the next page.

Note: If the Home Page View that you have selected does not require a specific network device, Orion NPM will select a network device to display, automatically.

8. Select a Default Summary View for the account.

Note: This is typically the same as the Home Page View.

9. Select Default Node, Interface, and Volume Details Views.

Notes:

•	As a user drills progressively into an object, a page for Node, Interface, or Volume Details is presented. If you have developed a customized view, designated in the Type of View field as Node, Interface, or Volume Details, it will be available in the list.

•	If None is selected, the user is presented with a message stating that they do not have access to that view.

HTH

radiohead23

Thank you Mark.

But I still have a problem. I've made a separate menubar for the client (who doesnt have any admin rights), made a separate view for the client that only shows a specific interface average input/output as the user's homepage and also defined a custom URL link for the client to view the custom chart for that particular interface. Since this interface is on a node that does not belong to the client, I dont want the client to be able to see the events related to that node. What happens is, that the client logs on to the site with his username/password and doesn't see anything other than the homepage and interface links on his menubar,which is all good, BUT, if he simply pastes the URL for the Events.asp page, he is taken to that page and he can view the past events concerning the node or the interface. That is something that we dont want the client to do. What we want is an MRTG like solution, where the client can only see one page.

I'll really appreciate any help in this regard from you.

Thank you again. Hope to hear from you soon.

Regards.

bleearg13

I have this same complaint and unfortunately, there is no way around it natively in Orion. All it takes is a bit of sleuthing and the customer can have access to all sorts of pages that he/she shouldn't have access to. It is possible that you could put file-level permissions on the Events.asp page or other pages you don't want customers to see. This way, if they were to try and browse directly to the page, they would be prompted with a password.

radiohead23

ah ... i was afraid of that.

thanks for the advice bleearg, but introducing file level permissions will involve creating users on the windows machine as well. quite a bit of a headache to secure access to the machine with all those users. there should be a way for Orion to handle security for other pages as well without involving windows NTFS security.

any comments Mark?

once again thanks a lot for both of u for the help. hoping to get a solution for this soon.

take care.

bleearg13

Another way around this is to create another Orion website on your server. Just rename the original website in IIS, create a new directory, and run the Configuration Wizard to install the new site in the new directory on a different IP or port number. Then, simply delete the pages you don't want the user to have access to. This way, you can administer the Orion website from your original site, but give customers access from the newly created site without fear of them being able to enter pages like "AllMaps.asp" or "Events.asp".

Again, this is something that as Orion has grown, it should have supported. I think if more customers start asking for this, then Solarwinds will listen and rethink the security of the product. Until then, we're kind of "stuck" with what we've got.

radiohead23

Hmmmm, nice idea. Have you tried this and actually given your clients access to the secondary site? If yes then any security concerns whatsoever?

Yes I guess you are right about being stuck with this. Although I don't understand why Solarwinds is not incorporating security like this in Orion when there are highly customizable solutions like MRTG/RRD out there and especially when they are advertising "give your clients access to the website" feature or "customize views and access limitations for your clients" so emphatically.

Mark any comments on that?

Thanks again bleearg for this great workaround. I'll definitely give it a shot.