Table of Contents
Advertisement
About scope-based security
When you create security roles, consider the following points:
To create a resource of a given resource type, the role must have read access
to the resource type. The role must have create children access to the resource
type default folder. The role must have read and write access to the data classes
and associations of the resource type.
To edit a resource, a role must have write permission on the folder of the
resource type. If the folder has never been moved, then it is the default folder).
If a new resource type is created, its default folder is set to its base resource
types default folder. For example, new license type items are created in the
license default folder.
Note: The default folders should not be restructured.
See
About role-based security"
See
About predefined security roles"
With scope-based security, you set permissions on items in the Symantec
Management Console. You can set permissions on resource types, data classes,
resource association types, item tasks, reports, folders, collections, and other
items. Permissions let you control exactly what data is accessible by users or
groups belonging to Notification Server security roles.
You might want to limit who can view or manage certain resource types for security
reasons. You can limit what resource types are viewable and manageable from
the Resources tab. You can set security for an individual resource type or a
complete folder. For example, you can limit who can see the contract resource
types. You can also limit who can change the permissions for the Computer
resource type.
When you set security for resource types, you do not determine who can add or
edit resources. You do determine who can view and manage the resource type
itself.
You can also limit who can view or edit the data about a resource. For example,
you might not need to limit which asset workers can view the list of computers.
However, you might want to limit who can view the accounting data for computers.
You might want to allow only certain people to view the accounting data for
computers. You might want to allow other people to both view and edit the
accounting data for computers.
on page 40.
on page 40.
About CMDB Security
About scope-based security
41
Advertisement
Table of Contents
