HP UX 11i Role-based Access Control (RBAC) Software manual Hierarchical Roles, Overview

NOTE: See cmdprivadm(1M) for information on all of the cmdprivadm arguments. Most arguments are optional and are filled in with reasonable defaults if nothing is specified.

NOTE: To modify an existing entry in the /etc/rbac/cmd_priv file, you must first delete the entry and then add the updated version back in. When you use cmdprivadm to delete entries, arguments act as filters. For example, specifying the cmdprivadm delete op=foo command removes all entries where the operation is foo. As a result of this, when you use cmdprivadm to delete entries, be careful to ensure that you specify sufficient arguments to uniquely identify the entries to be removed.

Hierarchical Roles

Use the following information to configure hierarchical roles and define a relationship between roles. See authadm(1m) for additional information about hierarchical roles.

Overview

One of the primary objectives of HP-UX RBAC is to simplify user access management by grouping users into logical roles. In enterprise environments that have a large number of users it can be challenging to group users into roles because most users usually require slightly different sets of authorizations to perform their tasks. In environments such as this, the number of roles can approach the number of users, thereby negating the usefulness of roles as a way to manage users.

One way to mitigate the problem where the number of roles approaches the number of users is to define relationships between roles. Specifically, if roles are comprised of other roles, it becomes easier to define groups of access rights that can be assigned to individual users. To improve usability and help limit the total number of roles, HP-UX RBAC B.11.23.03 introduces the ability to define roles that include other roles (referred to as sub-roles). This ability is known as hierarchical roles.

Examples of Hierarchical Roles

By assigning a sub-role to a role, you assign all the authorizations of the sub-role to that role. For example, consider the following two tables that compare the same roles and corresponding authorizations. Table 3-7shows the Version B.11.23.02 model, while Table 3-8shows how the Version B.11.23.03 hierarchical roles simplifies the management of roles.

Table 3-7 Example Roles Configuration in HP-UX RBAC B.11.23.02

Role	Authorizations
Administrator	(hpux.user.*, *)
	(hpux.network.service.*, *)
	(hpux.network.device.*, *)
	(hpux.security.*, *)
UserOperator	(hpux.user.*, *)
NetworkOperator	(hpux.network.service.*, *)
	(hpux.network.device.*, *)
NetworkServiceOperator	(hpux.network.service.*, *)

40 HP-UX Role-Based Access Control