A.0 Appendix: Legacy Roles

This Appendix lists the legacy roles.

When you create a new user group, you must assign at least one role to the group to allow the users in the group to access one or more modules and perform tasks.

Command Control Roles

The following roles can be assigned to the command control module in order to control access to the Command Control console. Select from the following roles when you are creating a group that you want to manage and test the rules in the command control database.

Module	Role	Allows users to
cmdctrl	console	View the Command Control console.
	read	View the Command Control console content and run test suites. You must use console role along with read role to view the Command Control console and its content.
	write	Modify the command control database. Users with this role cannot cancel other users’ transactions or modify audit or transaction settings. Must be used in conjunction with the cmdctrl read role.
	admin	Modify the Command Control database, including canceling other users’ transactions and modifying audit and transaction settings.
	*	Perform all roles.
auth	read	Extract user credentials, including name and e-mail address, from the auth database into the account and user group definitions. Used in conjunction with the cmdctrl write (with read) and admin roles.
prvcrdvlt	read	Configure the resources and credentials in the command control rules.
unifi	admin	View the listed agents and perform administrative actions.

Compliance Auditor Roles

The following roles can be assigned to the compliance auditing module in order to control access to the Compliance Auditor console. For a group to manage compliance auditing, the group also needs read roles to the auditing and authentication modules.

Module	Role	Allows users to
secaudit	console	View the Compliance Auditor console.
	audit	View and edit records.
	admin	Add and modify audit rules.
	*	Perform the console, audit, and admin roles.
	<audit role name >	Access the records collected by audit rules with this role defined in the Audit Role field on the Modify Audit Rule page. You can choose your own name for the role.
audit	read	View a keystroke replay.
auth	read	Extract user credentials, including name and e-mail address, from the auth database for use with reports.

Credential Vault Roles

The following roles can be assigned to the credential vault module in order to control access to the Credential Vault console. Select from the following roles when you are creating a group to manage the Credential Vault.

Module	Role	Allows users to
prvcrdvlt	console	View the Credential Vault console.
	read	View the resources and credentials in Credential Vault. You must use console role along with read role to view the Credential Vault console and its content.
	write	Add and modify the resources and credentials in Credential Vault. Must be used in conjunction with the prvcrdvlt read role.
	admin	View, add, and modify the domains and credentials in Credential Vault. Must be used in conjunction with userreqdashboard module and admin role. To add, modify, delete scripts user requires module taskmanager in conjunction with the admin role.
	*	Perform all roles. In conjunction you have to use cmdctrl and admin role. Must be used in conjunction with userreqdashboard module and admin role.

Hosts Roles

The following roles can be assigned to the host module in order to control access to the Hosts console. Select from the following roles when creating a group to manage the hosts.

Module	Role	Allows users to
unifi	console	View the Hosts console.
	info	Run the host status check by using the command line interface. You must type the word info because it is not available in the drop-down list.
	admin	View the Hosts console and perform administrative actions.

Module

Role

Allows users to

unifi

console

View the Hosts console.

info

Run the host status check by using the command line interface.

You must type the word info because it is not available in the drop-down list.

admin

View the Hosts console and perform administrative actions.

Package Manager Roles

The following role can be assigned to the package manager module in order to control access to the Package Manager console. When you are creating a group that you want to manage the distribution of updates to Privileged Account Manager, select the following:

Module	Role	Allows users to
pkgman	console	View the Package Manager console.
	admin	View, add, update, or remove packages.

Distribution Roles

The following roles can be assigned to the distribution module in order to restrict the installation and deployment of certain packages.

Module	Role	Allows users to
distrib	acl	Restricts deployment of packages to specified modules.
	Module:rexec	Install or patch the Command Control Agent (rexec).
	Module:distrib	Install or patch the Distribution Agent (distrib).
	Module:regclnt	Install or patch the Registry Agent (reglcnt).
	Module:strfwd	Install or patch the Store and Forward Agent (strfwd).
	Module:sysinfo	Install or patch the System Information Agent (sysinfo).

NOTE:Any module in the Package Distribution Permissions can be allowed by using the format Module:<desired-package-name> to configure a Module.

Reports Console Roles

The following roles can be assigned to the auditing module in order to control access to the Reports console. Select from these roles when you are setting up a group to manage the command control reports.

Module	Role	Allows users to
audit	console	View the Reports console.
	read	Read the audit database. You must use console along with read role to view the Reports console and its content.
	admin	Modify Reports settings.
	command	View Command Control reports.
	logon	View Account Logon reports.
	*	Perform all roles.
	write	Create new audit reports and adjust filter settings.
	report	Access reports with the report defined roles.
	<report defined>	Read and update the reports defined in the General tab of the Reports console. This role is only useful when used in conjunction with the report role.

You can use these Audit Report roles to create the following types of audit managers:

Administrator: To allow the group to update all aspects of the auditing module, including encryption and rollover, the group needs to be assigned the following roles for the audit module:
- admin
- write
- read
- command
- console
Manager: To allow the group to update all aspects of the auditing module, except encryption and rollover, the group needs to be assigned the following roles for the audit module:
- write
- read
- command
- console
User: To allow the group to read and update a specific report, the group needs to be assigned the following roles for the audit module:
- command
- console
- report
- <report defined read>
- <report defined update>
If you want the group to have read-only privileges to the report, do no assign the <report defined update> role. Users with read-only rights to a report can view the report from the console, view the keystroke sessions within the report, and select which audit databases to view (see the LogFiles tab). Users who also have the update right can update the report’s filter, its name, and its description.

Each report allows you to specify a read role and an update role. You need to remember those names and manually enter them here. The console does not provide any error checking, so you need to make sure to enter the correct name.

Requests Console Roles

The following roles can be assigned to control access to the Request console. Select from the following roles when you are creating a group to manage the Request console.

Role	Role	Allows users to
userreqdashboard	console	View the Request console.
	admin	View and update emergency access and credential checkout requests.
	*	Perform all roles. Also you will require read and write permissions for cmdctrl and prvcrdvlt module.

Role

Allows users to

userreqdashboard

console

View the Request console.

admin

View and update emergency access and credential checkout requests.

Perform all roles.

Also you will require read and write permissions for cmdctrl and prvcrdvlt module.

Task Manager Role

The following roles can be assigned to the task manager module in order to view and modify scripts.

Module	Role	Allows users to
taskmanager		Used for password management. See, Section 7.3, Password Management.

Module

Role

Allows users to

taskmanager

Used for password management.

See, Section 7.3, Password Management.

Framework User Manager Roles

The following roles can be assigned to the authentication module in order to control access to the User Manager console. Select from these roles when you are setting up a group to manage users and groups.

Module	Role	Allows users to
auth	console	View the Framework User Manager console.
	act_settings	Modify account settings. You must use admin role to view the Framework User Manager and its content.
	admin	Add or delete users and groups, and assign users to groups.
	read	Read the auth database. You must use console role along with read role to view the Framework User Manager and its content. This role must be used with all other auth roles.
	role_admin	Add or remove roles. You must use console role along with read and admin role to view the Framework User Manager and its content.
	super	View and modify superusers, and view and modify groups with the super role defined. This role should also be able to add or delete users and groups, and assign users to groups.
	api_token	Generate API tokens.
	*	Perform all roles.