RSA Authentication Manager 6.1 Administrator's Guide - The Ether ...

RSA Authentication Manager 6.1 Administrator’s GuideBy combining a specific administrative scope with a specific task list, you placeprecise limits on an administrator’s control of RSA Authentication Manager data.Administrative ScopeAdministrative scope, one of the two components of an administrative role, specifieswhich sites, Agent Hosts, groups, users, and tokens can be affected by administratorsto whom the role is assigned.There are three categories of administrative scope: realm, site, and group. Eachcategory defines an administrator’s privileges on one or more levels in the system.Within categories, administrative scope can be varied by specifying the realms, sites,or groups to which it applies: a realm administrator may be given control over onerealm or several, and the same principle applies to site and group administrators.The categories of administrative scope are hierarchical, in that privileges on a higherlevel include privileges on the levels below it. For example, a realm administrator canaffect sites and groups within the realm, while the privileges of a group administratordo not extend beyond the group. However, no realm administrator has privileges oversites and groups that are not within the realm or realms specifically included in theassigned administrative scope. The RSA Authentication Manager filters the names ofsites, groups, users, Agent Hosts, and tokens that appear on any administrator’s screenaccording to this scope definition so that administrators can access only data withintheir scopes.The three basic administrative scope categories distribute administrative privileges asfollows within the specific realms, sites, or groups assigned:• Realm administrators can view and edit all sites, groups, users, Agent Hosts andtokens (assigned and unassigned) within their designated realms.• Site administrators cannot add or delete a site. They can view and edit theirdesignated sites as well as the groups, users, Agent Hosts and assigned tokensbelonging to those sites. Site administrators can also view and edit all unassignedtokens in the Authentication Manager database. They can view and edit all AgentHosts, users, and tokens not belonging to any group or site.• Group administrators cannot add or delete a group. They can view and edit theirdesignated groups as well as the users, Agent Hosts, and assigned tokensbelonging to those groups. Group administrators can also view and edit all tokensthat are assigned to users in their groups and all unassigned tokens in theAuthentication Manager database. They can view and edit all Agent Hosts, users,and tokens not belonging to any group or site.32 2: Using RSA Authentication Manager Administration Applications