New post
Question
· May 26, 2021

Control Production Start / Stop to specific roles, affecting Ensemble Hosts restarting

#Access control #Security #Ensemble

Hi Team,
I have a requirement to disable the Production Start/Stop buttons for specific support users. But they should be able to stat/stop Ensemble Hosts.
For that new Role, As per documentation along with other Ens resources, I have added %Ens_ConfigItemRun with RWU access and didnt add %Ens_ProductionRun resource.

This makes the Start/Stop buttons disappear from Production Configuration page ( meeting my requirement). But those users are Unable Start/Stop/Restart Ensemble Business Hosts.

When they try to Start , it's not showing any Production Update progress popup page and also no Jobs are showing in the Jobs tab and no logs in the Logs tab, but only Green color appears before the Host (after clicking refresh button) which is giving false hope.

But, if I add %Ens_ProductionRun to that Role, Ensemble Host Restarting working fine, but , that also enables Start/Stop of Production, which is not meeting my requirement.

Does both these resources are related and cause of my issue ? (%Ens_ProductionRun , %Ens_ConfigItemRun) 

Please suggest, How do I achieve my requirement ?
"Disable the Production Start/Stop buttons for specific support users/roles. But they should be able to stat/stop Ensemble Hosts."

Discussion (3)2
Log in or sign up to continue
Kevin Kindschuh · May 27, 2021

Try creating a new role that is a full copy of %EnsRole_Operator, except removing the %Ens_ProductionRun resource.

Then create a new user with the new role plus roles for %DB_%DEFAULT or whatever databases contain productions they will manage.

This new user should allow normal access to start and stop hosts, but without the production start/stop buttons. I verified that worked for me.

If you want to further restrict such a user, peel off resources from your custom role, testing each time to make sure you are getting the desired result.

In general, start by using standard roles that work, and then remove resources you don't want, testing as you go, rather than trying to build them up.That way you won't be struggling with obscure behavior due to dependencies.

Good luck!

0 0