roles and user groups · roles and user groups...

Roles and User Groups

This chapter provides information about roles and user groups in Cisco Unified Communications ManagerAdministration which uses roles and user groups to provide varying levels of privilege (access). This techniquepermits granting only the required privileges for a selected group of users and limits the configurationfunctions that users in a particular user group can perform.

• Overview, page 1

• Roles, page 2

• User Groups, page 11

• Access Log, page 12

• Enterprise Parameters, page 12

• Create a Custom Help Desk Role and User Group, page 12

OverviewRoles and user groups provide multiple levels of security to Cisco Unified Communications ManagerAdministration and to other applications. The system groups the resources that are available to Cisco UnifiedCommunications Manager Administration and to other applications into roles. Each application comes withstandard, predefined roles. Each application defines its own access privilege for Cisco Unified CommunicationsManager Administration.

Administrators can configure additional roles for an application. A role contains, for a particular application,the list of resources that an application comprises. For each resource that a role comprises, the administratordefines the access privilege. For the Cisco Unified Communications Manager Administration application, theaccess privileges include read and update. Other applications specify their own access privileges.

Because Cisco Unified Communications Manager allows administrators to manage user groups, roles, andresources, no guarantee exists that a particular user group or role goes unchanged or that administrators willuse the predefined user groups or roles.

Cisco Unified Communications Manager System Guide, Release 9.0(1) 1

RolesThe system groups the resources that are available to Cisco Unified CommunicationsManager Administrationand to other applications into roles. A role includes a collection of resources for an application, such as CiscoUnified Communications Manager Administration. The following types of roles exist:

• Custom roles-Administrator-defined roles that you configure in Cisco Unified CommunicationsManagerAdministration after a Cisco Unified Communications Manager installation; for example, a help deskrole.

• Standard roles-Default roles that get created automatically with Cisco Unified CommunicationsManagerinstallation; you cannot modify or delete standard roles, but you can copy them to create custom roles,which allows you to modify them for your preferences. (See the table below for the list of standard rolesand the privileges/resources that the role provides.)

Each role contains a group of resources, with privileges assigned to each resource. For most applications withgraphical user interfaces, such as Cisco Unified Communications Manager Administration, privileges allowyou to perform tasks, such as viewing or updating data, in a specific window or a group of related windows,which are defined as resources in the Role Configuration window. For example, for the Standard CCMFeatureManagement role, you can view and configure message waiting in theMessageWaiting Configuration windowin Cisco Unified CommunicationsManager Administration. For each role that is associated with Cisco UnifiedCommunications Manager Administration, the specified privilege allows a certain level of access to each ofthe resources (windows). For example, privileges specify the following access in CiscoUnified CommunicationsManager Administration:

• Read- Allows users in a user group to view data in specific windows (defined as resources), but theuser(s) cannot modify data in the window. Buttons such as Insert, Delete, Update, and Reset do notdisplay.

• Update-Allows users in a user group to view and modify data in certain windows (defined as resourcesfor the role). Users with the update privilege can perform operations such as Insert, Delete, Update, andReset.

Other applications, such as CTI applications, specify their own access privileges and do not use the read andupdate privileges or a common list of resources (which are configuration windows in most cases); for example,the Standard CTI Allow Call Recording role allows CTI devices/CTI applications to record calls, and theStandard EM Authentication Proxy Rights manages Cisco Extension Mobility authentication rights forapplication users that interact with Cisco Extension Mobility.

The Standard CCMAdmin Users role gives the user access to the Cisco Unified CommunicationsManagerAdministration user interface. This role, the base role for all administration tasks, serves as the authenticationrole. Cisco Unified CommunicationsManager Administration defines this role as the role that is necessaryto log in to Cisco Unified Communications Manager Administration.

The Standard CCM Admin Users role includes no permissions beyond logging into Cisco UnifiedCommunicationsManager Administration. The administrator must add another authorization role to definethe parts of the Cisco Unified Communications Manager Administration that the user can administer. TheStandard CCMADMIN Administration role allows a user to access and make changes in all of CiscoUnified Communications Manager Administration.

Note

Cisco Unified Communications Manager System Guide, Release 9.0(1)2

Roles and User GroupsRoles

A user with only the Standard CCMAdmin Users role can access Cisco Unified CommunicationsManagerAdministration but cannot make any changes. A user with only the Standard CCMADMINAdministrationrole can make changes, but cannot authenticate entry to Cisco Unified Communications ManagerAdministration.

A user, therefore, must have the Standard CCMAdmin Users role to access Cisco Unified CommunicationsManager Administration and must have at least one other role to administer the system.

Note

The following table lists the standard roles, the application(s) that the roles support, the privileges (resources)for the roles, and the standard user groups that are automatically associated with the standard roles.

For a role, supported privileges are checked in the Role Configuration window. For standard roles, youcannot change the configuration, but if you want to do so, you can copy a standard role to configure acustom role, which you can modify to your preferences.

Caution

Table 1: Standard Roles and Privileges

Associated Standard UserGroup(s)

Privileges/Resources for the RoleSupportedApplication(s)

Standard Role

Standard CCM Super UsersAllows access to the AXL database APIAXL database APIStandard AXL APIAccess

Standard CAR Admin Users,Standard CCM Super Users

Allows an administrator to view and configureCisco Unified Communications Manager CDRAnalysis and Reporting (CAR).

Cisco UnifiedCommunicationsManager CDRAnalysisand Reporting (CAR)

Standard Admin RepTool Admin

Standard Audit UsersAllows an administrator to perform the followingtasks for the audit logging feature:

• View and configure audit logging in theAudit Log Configuration window in CiscoUnified Serviceability

• View and configure trace in Cisco UnifiedServiceability and collect traces for theaudit log feature in Real-TimeMonitoringTool

• View and start/stop the Cisco Audit Eventservice in Cisco Unified Serviceability

• View and update the associated alert inRTMT

Cisco UnifiedServiceability

Standard Audit LogAdministration





Standard Role

Standard CCM Admin Users,Standard CCM GatewayAdministration, StandardCCM Phone Administration,Standard CCM Read Only,Standard CCM ServerMonitoring, Standard CCMSuper Users, Standard CCMServerMaintenance, StandardPacket Sniffer Users

Grants log-in rights to Cisco UnifiedCommunications Manager Administration.

Cisco UnifiedCommunicationsManagerAdministration

Standard CCM AdminUsers

Standard CCM End UsersGrant an end user log-in rights to the CiscoUnified CM User Options

After you configure the user, make surethat you add the user to the StandardCCM End Users user group (UserManagement >User Group). If you donot add the user to this group, the usercannot view and update the CiscoUnified CM User Options.

Tip

Cisco Unified CMUserOptions

Standard CCM EndUsers

Standard CCM ServerMaintenance

Allows an administrator to perform the followingtasks:

• View, delete, and insert the followingitems by using the Bulk AdministrationTool:

◦Client matter codes and forcedauthorization codes

◦Call pickup groups

• View and configure the following items inCisco Unified Communications ManagerAdministration:

◦Client matter codes and forcedauthorization codes

◦Call park

◦Call pickup

◦Meet-Me numbers/patterns

◦Message Waiting

◦Cisco Unified IP Phone Services

◦Voice mail pilots, voice mail portwizard, voice mail ports, and voicemail profiles


Standard CCM FeatureManagement





Standard Role

Standard CCM GatewayAdministration


• View and configure gateway templates inthe Bulk Administration Tool

• View and configure gatekeepers, gateways,and trunks in Cisco UnifiedCommunicationsManager Administration


Standard CCMGatewayManagement

Standard CCM PhoneAdministration


• View and export phones in the BulkAdministration Tool

• View and insert user device profiles in theBulk Administration Tool


◦BLF speed dials

◦CTI route points

◦Default device profiles or defaultprofiles

◦Directory numbers and lineappearances

◦Firmware load information

◦Phone button templates or softkeytemplates

◦Phones

◦Reorder phone button informationfor a particular phone by clicking theModify Button Items button in thePhone Configuration window


Standard CCM PhoneManagement





Standard Role

Allows an administrator to perform the followingtasks in CiscoUnified CommunicationsManagerAdministration:

• View and configure application dial rules

• View and configure calling search spacesand partitions

• View and configure dial rules, includingdial rule patterns

• View and configure hunt lists, hunt pilots,and line groups

• View and configure route filters, routegroups, route hunt list, route lists, routepatterns, and route plan report

• View and configure time period and timeschedule

• View and configure translation patterns


Standard CCM RoutePlan Management




◦Annunciators, conference bridges,and transcoders

◦MOH audio sources and MOHservers

◦Media resource groups and mediaresource group lists

◦Media termination point

◦Cisco Unified CommunicationsManager Assistant wizard

• View and configure the Delete Managers,Delete Managers/Assistants, and InsertManagers/Assistants windows in the BulkAdministration Tool


Standard CCM ServiceManagement





Standard Role




◦AAR groups

◦Cisco Unified CommunicationsManagers (Cisco Unified CMs) andCisco Unified CommunicationsManager groups

◦Date and time groups

◦Device defaults

◦Device pools

◦Enterprise parameters

◦Enterprise phone configuration

◦Locations

◦NTP servers

◦Plug-ins

◦Security profiles for phones that runSCCP or SIP; security profiles forSIP trunks

◦SRST references

◦Servers

• View and configure the Job Schedulerwindows in the Bulk Administration Tool


Standard CCM SystemManagement

Allows an administrator to view and configureapplication users in Cisco UnifiedCommunications Manager Administration.


Standard CCM UserPrivilege Management

Standard CCM Super UsersAllows an administrator to view and configureall items in Cisco Unified CommunicationsManager Administration and the BulkAdministration Tool.


Standard CCMADMINAdministration

Allows an administrator to view and configureinformation in Dialed Number Analyzer.

Dialed NumberAnalyzer

Standard CCMADMINAdministration





Standard Role

Standard CCM GatewayAdministration, StandardCCM Phone Administration,Standard CCM Read Only,Standard CCM ServerMaintenance, Standard CCMServer Monitoring

Allows an administrator to view configurationin Cisco Unified Communications ManagerAdministration and the Bulk AdministrationTool.


Standard CCMADMINRead Only

Allows an administrator to analyze routingconfigurations in Dialed Number Analyzer.


Standard CCMADMINRead Only

Standard CCM End UsersAllows access to the Cisco Unified CM UserOptions.

Cisco Unified CMUserOptions

Standard CCMUSERAdministration

Standard CTI Allow CallMonitoring

Allows CTI applications/devices tomonitor callsCisco ComputerTelephone Interface(CTI)

Standard CTI AllowCallMonitoring

Standard CTI AllowCall ParkMonitoring

Allows CTI applications/devices to use call parkCisco ComputerTelephone Interface(CTI)

Standard CTI AllowCallPark Monitoring

Standard CTI Allow CallRecording

Allows CTI applications/devices to record callsCisco ComputerTelephone Interface(CTI)

Standard CTI AllowCallRecording

Standard CTI Allow CallingNumber Modification

Allows CTI applications to transform callingparty numbers during a call

Cisco ComputerTelephone Interface(CTI)

Standard CTI AllowCalling NumberModification

Standard CTI Allow Controlof All Devices

Allows control of all CTI-controllable devicesCisco ComputerTelephone Interface(CTI)

Standard CTI AllowControl of All Devices

Standard CTI Allow Controlof Phones supportingConnected Xfer and conf

Allows control of all CTI devices that supportedconnected transfer and conferencing


Standard CTI AllowControl of PhonesSupporting ConnectedXfer and conf

Standard CTI Allow Controlof Phones supporting RolloverMode

Allows control of all CTI devices that supportedRollover mode


Standard CTI AllowControl of PhonesSupporting RolloverMode

Standard CTI AllowReception of SRTP KeyMaterial

Allows CTI applications to access and distributeSRTP key material


Standard CTI AllowReception of SRTP KeyMaterial





Standard Role

Standard CTI EnabledEnables CTI application controlCisco ComputerTelephone Interface(CTI)

Standard CTI Enabled

Standard CTI SecureConnection

Enables a secure CTI connection to CiscoUnified Communications Manager


Standard CTI SecureConnection

StandardCCMAdministrationUsers, Standard CCM SuperUsers

Allows an administrator to view, download,generate, and upload reports in Cisco UnifiedReporting

Cisco UnifiedReporting

Standard CUReporting

Standard CCM Super Users,Standard EM AuthenticationProxy Rights

Manages application Cisco Extension Mobilityauthentication rights; required for all applicationusers that interact with Cisco ExtensionMobility(for example, Cisco Unified CommunicationsManager Assistant and Cisco Web Dialer)

Cisco ExtensionMobility

Standard EMAuthentication ProxyRights

Standard Packet Sniffer UsersAllows an administrator to access Cisco UnifiedCommunications Manager Administration toenable packet sniffing (capturing)


Standard Packet Sniffing

StandardRealtimeAndTraceCollection

Allows an administrator to view and use theSOAP Serviceability AXLAPIs, the SOAPCallRecord APIs, the SOAP Diagnostic Portal(AnalysisManager) Database Service; view andconfigure trace for the audit log feature, andview and configure the Real-Time MonitoringTool, including collecting traces in RTMT.

Cisco UnifiedServiceability andReal-Time MonitoringTool

StandardRealtimeAndTraceCollection





Standard Role

Standard CCM ServerMonitoring, Standard CCMSuper Users

Allows an administrator to view and configurethe following windows in Cisco UnifiedServiceability or the Real-Time MonitoringTool:

• Alarm Configuration and AlarmDefinitions (Cisco Unified Serviceability)

• Audit Trace (marked as read/view only)

• SNMP-related windows (Cisco UnifiedServiceability)

• Trace Configuration and TroubleshootingTrace Configuration (Cisco UnifiedServiceability)

• Log Partition Monitoring

• Alert Configuration (RTMT), ProfileConfiguration (RTMT), Trace Collection(RTMT)

Allows an administrator to view and use theSOAP Serviceability AXLAPIs, the SOAPCallRecord APIs, and the SOAP Diagnostic Portal(Analysis Manager) Database Service.

For the SOAP Call Record API, theRTMT Analysis Manager Call Recordpermission is controlled through thisresource.

Tip

For the SOAP Diagnostic PortalDatabase Service, the RTMT AnalysisManager Hosting Database accesscontrolled thorough this resource.

Tip


StandardSERVICEABILITY

A serviceability administrator can access thePlugin window in Cisco UnifiedCommunications Manager Administration anddownload plugins from this window.


StandardSERVICEABILITYAdministration

Allows an administrator to administer all aspectsof serviceability for Dialed Number Analyzer.



Allows an administrator to view and configureall windows in Cisco Unified Serviceability andRTMT. (Audit Trace supports viewing only.)

Allows an administrator to view and use allSOAP Serviceability AXL APIs.







Standard Role

Standard CCM Read OnlyAllows an administrator to view allserviceability-related data for components inDialed Number Analyzer.


StandardSERVICEABILITYRead Only

Allows an administrator to view configurationin Cisco Unified Serviceability and RTMT.(excluding audit configuration window, whichis represented by the Standard Audit LogAdministration role)

Allows an administrator to view all SOAPServiceabilityAXLAPIs, the SOAPCall RecordAPIs, and the SOAPDiagnostic Portal (AnalysisManager) Database Service.


StandardSERVICEABILITYRead Only

Allows an administrator to view, activate, start,and stop services in CiscoUnified Serviceability.

Cisco UnifiedServiceability

Standard System ServiceManagement

User GroupsAfter configuration of custom roles, you can configure user groups, which are a collection of Cisco UnifiedCommunicationsManager application users and end users that get grouped together for the purpose of assigninga common list of roles to the members in the user group. Like standard roles, standard user groups get createdat installation, and you cannot delete these user groups; you can only add or delete application or end usersfrom standard user groups.

Standard user groups in Cisco Unified Communications Manager Administration provide a predefined set ofroles and permissions for various functions. Administrators can manage user groups, roles, and permissionsto control the level of access (and, therefore, the level of security) for system users.

Various named user groups that are predefined have no members that are assigned to them at install time. TheCisco Unified Communications Manager super user or a user with access to user group configuration shouldadd users to these groups. The super user or a user with access to user group configuration can configureadditional named user groups as needed.

The Standard CCM Super Users user group represents a named user group that always has full accesspermission to all named roles. You cannot delete this user group. You can only make additions and deletionsof users to this group.

Note

CCMAdministrator always represents a super user.Note

Certain user groups and roles exhibit limitations that administrators need to recognize. For example, you canmodify the Standard EM Authentication Proxy Rights user group by adding both application users and end


Roles and User GroupsUser Groups

users. Because authentication by proxy is intended for use by applications, end users that get added to thisuser group cannot authenticate by proxy.

Access LogThe log contains a file report of access/change attempts. That is, Cisco Unified Communications ManagerAdministration generates a record of attempts to access or modify any directory or database component throughCisco Unified Communications Manager Administration. The change record includes the user name, date,time, window from which the change was made, and the success or failure status of the update.

Enterprise ParametersRoles and user groups use the Effective Access Privileges For Overlapping User Groups and Roles enterpriseparameter.

Effective Access Privileges for Overlapping User Groups and Roles

The Effective Access Privileges For Overlapping User Groups and Roles enterprise parameter determines thelevel of user access for users that belong to multiple user groups and have conflicting privileges.

You can set this enterprise parameter to the following values:

• Maximum-The effective privilege represents the maximum of the privileges of all the overlapping usergroups.

• Minimum-The effective privilege represents the minimum of the privileges of all the overlapping usergroups.

The Effective Access Privileges For Overlapping User Groups and Roles enterprise parameter specifies themaximum default value.

This enterprise parameter does not affect the privileges for the members of the Standard CCMSuper Usersuser group.

Note

Create a Custom Help Desk Role and User GroupSome companies want their help desk personnel to have privileges to be able to perform certain tasks, suchas adding a phone, adding an end user, or adding an end user to a user group in Cisco Unified CommunicationsManager Administration.

Performing the steps in the following example allows help desk personnel to add a phone, add an end user,and add the end user to the Standard CCM End Users user group, which allows an end user to access andupdate the Cisco Unified CM User Options.

Example-Allows Help Desk Personnel to Add Phone, Add End User, and Add End User to User Group


Roles and User GroupsAccess Log

Procedure

Step 1 In Cisco Unified Communications Manager Administration, chooseUser Management > Role.Step 2 Click Add New.Step 3 From the Application drop-down list box, choose Cisco Call Manager Administration; then, click Next.Step 4 In the Name field, enter the name of the role; for example, Help Desk.Step 5 In the Description field, enter a short description; for example, for adding phones and users.Step 6 Choose one of the following options, which depends on where you want the help desk personnel to perform

the task:a) If you want the help desk personnel to add a phone in the Phone Configuration window and then add an

end user in the End User Configuration window. check the read and update privileges check boxes for theUser web page resource and the Phone web pages resource; then, click Save.

b) If you want the help desk personnel to add both a phone and user at the same time in the User and PhoneAdd window, check the read and update privileges check boxes for the User and Phone add resource andthe User web page resource; then click Save.

Step 7 By performing the following tasks, create a custom user group for the help desk:a) In Cisco Unified Communications Manager Administration, choose User Management > User Group;

then, click Add New.b) Enter the name of the custom user group; for example, Help Desk.c) From the Related Links drop-down list box, choose Assign Roles to User Group; then, click Go.d) Click the Assign Role to Group button.e) Check the check box for the custom role that you created in Step 6; in this example, Help Desk. In addition,

check the check box for the Standard CCM Admin Users role. Then, click Add Selected.f) In the User Group Configuration window, verify that the roles display in the Role Assignment pane; then,

click Save.

What to Do Next

In Cisco Unified Communications Manager Administration, the help desk personnel can add the phone, addthe user, and add the end user to the user group.

• To add a phone in the Phone Configuration window, choose Device > Phone; then, to add an end userin the End User Configuration window, choose User Management > End User.

• To add both a phone and user at the same time in the User and Phone Add window, choose UserManagement > User and Phone Add.

• To associate the end user with the Standard CCM End Users user group, choose User Management >User Group.


Roles and User GroupsCreate a Custom Help Desk Role and User Group


Roles and User GroupsCreate a Custom Help Desk Role and User Group

roles and user groups · roles and user groups...

Documents