Cisco CISCOWORKS COMMON SERVICES 3.0 User Manual page 87

Chapter 3 Configuring the Server
To delete a role:
Go to Cisco Secure ACS.
Step 1
Select Shared Profile Components > CiscoWorks Common Services.
Step 2
The Shared Profile Components page appears.
Select the role you need to delete.
Step 3
The Shared Profile Components page displays the Edit dialog box.
Click Delete.
Step 4
We recommend not to assign roles to DEFAULT device group. When DEFAULT
(unassigned device group) is selected, you can perform only Help Desk role,
irrespective of the roles chosen.
To assign the proper role, the network access server (NAS) should be added in the
device groups other than DEFAULT.
You should log in as a user that has been created on the ACS server. If you log in
as a user configured in Common Services, say admin, you will get authenticated.
However, if the user is not configured in the ACS server, authorization will fail.
In case of users other than Admin, even authentication will not happen.
If you add or change device information in the Network Device Group, the change
will not be immediately propagated to Common Services. For the changes to get
updated in Common Services (when in ACS mode) you have to re-login to
Common Services.
You can assign only one role to a user in ACS, to operate on the same NDG.
If a user requires privileges other than those associated with the current role, to
operate on an NDG, a custom role should be created. All necessary privileges to
enable the user operate on the NDG should be given to this role.
For example, if a user needs to have Approver and Network Operator privileges
to operate on NDG1, you can create a new role with Network Operator and
Approver privileges, and assign the role to the user so that he can operate on
NDG1.
We recommend that you have maximum 50 NDGs and 50000 devices in ACS. If
the number of NDGs or devices exceed these limits, performance may be affected.
78-16571-01
Setting the Login Module to ACS
User Guide for CiscoWorks Common Services
3-41