Role-based access example - Micetro - 26.1.0

Micetro Reference Articles
ft:locale
en-US
Product name
Micetro
Version
26.1.0

This article aims to provide practical information on roles and detailed, step-by-step breakdowns for two scenarios:

  • Creating a new, read-only role for DHCP scopes
  • Using the build-in DNS viewers role to set up a DNS read-write role

The following information and instructions in this article provide a blueprint for customizing Micetro to your requirements.

Built-in roles

The seven built-in roles have been designed to cover most use cases for access control in Micetro. The access settings for the built-in roles canot be modified.

Note: Built-in roles are all General roles and are applied to all objects in Micetro, existing or future.

Example: When you add a user or group to the Administrators (built-in) role, the user (or group members) automatically gain administrative access to all objects in Micetro.

User-defined roles

As all DDI environments are different, Micetro allows you to create flexible user-defined roles.

Tip: The Administer users/groups permission is required to create new roles.

There are two ways to create new roles in Micetro:

  1. (Preferred) Duplicate an existing role and edit the permissions.
  2. Create a completely new role.
Tip: We recommend using the built-in roles as templates and modifying the permission set for the duplicate roles.

Example role configuration: DNS zone read-write

The following steps provide a guide on how to use a built-in role as a template for creating a read-write role for DNS zones in Micetro.

Tip: Using existing roles as templates makes it easier to refine access controls, because you can copy over both permissions and users/groups.
  1. Log into the Web Application.
  2. Navigate to Admin > Configuration > Access management and select Roles.
    The Roles list in the Access management section of the Configuration tab on the Admin page.
  3. Select Create and then use the dropdown to select From existing role.
    The From existing role option in the Create dropdown.
  4. In the Select an existing role dropdown, select DNS Viewers (built-in).
    Tip: If you selected the role in the data grid, From existing role will automatically populate this value.

    The Create from existing role dialog. DNS Viewers (built-in) is selected in the Select an existing role dropdown.
  5. Edit the Role name.
    Note: When duplicating a role, it is not possible to edit the Description until the new role is created.
  6. Select what you want to copy from the existing role: Permissions (default), Groups, and/or Users.
    Note: When you duplicate a role, the role type will automatically be set to General.
  7. Select Create to save the new role.

    After saving the new role, Micetro automatically displays the Edit role properties dialog.


    The Edit properties dialog for the role.
  8. Open the Access tab and enable the following permissions:
    Group Permission
    DNS services Add primary zones
    DNS services Add non-primary zones
    DNS zones Edit zone access
    DNS zones List (or view) zone
    DNS zones View zone history
    DNS zones Enable/disable zone
    DNS zones Edit zone options
    DNS zones Delete zone
    DNS zones Enable/disable apex records
    DNS zones Edit apex records
    DNS zones Enable/disable wildcard records
    DNS zones Edit wildcard records
    DNS zones Enable/disable other records
    DNS zones Edit other records
    DNS zones Edit zone properties
    Tip: Selecting the checkbox next to the DNS zones group will automatically select all permissions within the group.

    The Access tab of the Edit role properties dialog. Several permissions in the DNS services section and the entire DNS zones section are selected.

    For a reference of available permissions, refer to Permissions reference.

  9. (Optional) Open the Groups tab and select the group(s) you’d like to assign to the role.
  10. (Optional) Open the Users tab and select the user(s) you’d like to assign to the role.
    Tip: Users and groups can be assigned to and removed from roles at any time.

  11. Select Save to update the role settings.

Example role configuration: DHCP read-only

The following steps provide a guide on how to create a new, read-only role for DHCP scopes in Micetro, without using the built-in role templates.

  1. Log into the Web Application.
  2. Navigate to Admin > Configuration > Access management and select Roles.
    The Roles list in the Access management section of the Configuration tab on the Admin page.
  3. Select Create and then use the dropdown to select New role.
    The New role option in the Create dropdown.

  4. Enter a Role name, such as DHCP Read-Only, and add a Description.


    The Create new role dialog with DHCP read-only entered in the Role name field.
    Tip: Using descriptive names and clear text for the description can help reduce error or confusion when managing access.
  5. Select either General or Specific in the Role type dropdown.
    Note: The preferred role type in Micetro is General. Specific roles exist to preserve backwards compatibility and added flexibility to edge use cases.
  6. Open the Access tab and enable the following permission:
    Group Permission
    Ranges and DHCP scopes Read scope options

    On the Access tab of the Create new role dialog, the Read scope options permission is selected.
    Note: If you focus on the (i) indicator in the top right corner of the dialog, it will display any dependent permissions Micetro needs to add in order for your selections to take effect and to avoid potential access issues. Micetro automatically adds these permissions when you save the new role. You can check the permissions granted to the role by selecting View defined on the Access tab.
    Group Permission
    Micetro Access to the web interface
    Micetro Access IPAM module
    Micetro Access to IPAM view in web interface
    DHCP servers List (or view) DHCP server
    Ranges and DHCP scopes List (or view) range
    Address spaces List (or view) address space

    A tooltip in the Create new role dialog displays the dependent permissions Micetro has added to the role to prevent potential access issues.
  7. (Optional) Open the Groups tab and select the group(s) you’d like to assign to the role.
  8. (Optional) Open the Users tab and select the user(s) you’d like to assign to the role.
    Tip: Users and groups can be assigned to and removed from roles any time.
  9. Select Create.