338 Fabric OS Administrator’s Guide
53-1001763-02
Administrative Domains overview
15

Admin Domain access levels

Admin Domains offer a hierarchy of administrative access. To manage Admin Domains, you must
be a physical fabric administrator. A physical fabric administrator is a user with the admin role and
access to all Admin Domains (AD0 through AD255). Only a physical fabric administrator can
perform Admin Domain configuration and management.
Other administrative access is determined by your defined RBAC role and AD membership. Your
role determines your access level and permission to perform an operation. Your AD membership
determines the fabric resources that you can operate on.
Table 73 lists each Admin Domain user type and describes its administrative access and
capabilities.

User-defined Administrative Domains

AD1 through AD254 are user-defined Admin Domains. These user-defined Admin Domains can be
created only by a physical fabric administrator (see “Admin Domain access levels” on page 338 for
more information).
In Figure 51 on page 336, AD1 and AD2 are user-defined Admin Domains.

System-defined Administrative Domains

AD0 and AD255 are special, system-defined Admin Domains. AD0 and AD255 always exist and
cannot be deleted or renamed. They are reserved for use in creation and management of Admin
Domains.

AD0

AD0 is a system-defined Admin Domain that contains all online devices, switch ports, and switches
that are not assigned to any user-defined Admin Domain. AD0 also contains members that you
explicitly added (similar to user-defined Admin Domains).
Unlike user-defined Admin Domains, AD0 has an implicit and an explicit membership list.
User-defined Admin Domains have only explicit members.
•The implicit membership list contains all devices, switch ports, and switches that have not
been assigned to any other Admin Domain.
TABLE 73 AD user types
User type Description
Physical fabric
administrator
User account with admin role and with access to all Admin Domains (AD0 through AD255).
Creates and manages all Admin Domains.
Assigns other administrators or users to each Admin Domain.
Only a physical fabric administrator can create other physical fabric administrators.
Administrative
Domain users
Can be assigned to one or more Admin Domains.
Manage the resources within their Admin Domains.
If their role permits, can create user accounts and assign them to Admin Domains in their list.
Cannot view other Admin Domain definitions. They can view only members of their own Admin
Domains.