DCE Local Users issue

[DCIM_Support]

Hi Team,

we have a DCE 7.5 deployment with an authentication server configured and it is working properly. We can create a new user from AD and assign rights to different locations.

But when we create a local user in DCE with the purpose to give only access to a specific location, it does not work properly. It seems that everything is configured but when you log with this new user you can see all the locations:

The user is TSB:

Without administrator's rights:

It has only view access to Brasil:

But when you log with this user you can see and edit all the locations:

(CID:138381629)

[DCIM_Support]

Hi Javier,

I've only seen this happen when the user is either:

A: Also a member of another group that has another set of rights such as server admin or any local group (User Group Membership) with differing rights 

or

B: A duplicate user where that name exists as both a local user as well as an AD user. 

Steve

(CID:138381646)

[DCIM_Support]

Hi Steven,

thank you for your answer. We have checked and this user is only in group Device Viewers:

And this group does not have special rights:

And in the remote users there is not an user with the same name:

(CID:138381653)

[DCIM_Support]

Javier,

Ok, so he's part of device viewers. That is a group that has a certain set of rights.

You then give the user specific rights to device groups. This is the conflict. If you see here:

I've created a user and added him to the device viewer group. I did not add any specific rights to any specific groups. I simply logged in and saw what you see above.

If I then remove him from that group and give him specific view access to only one device group:

Now he can only see this:

So you must either provide him specific view access to a specific device group as you did here:

OR you must add him to the device viewers group that can view ALL groups at that level. If you do both, he will get the higher level of access.

Steve

(CID:138381682)

[DCIM_Support]

Thank you Steven, I have checked and now it is work fine. But I think is not well considered. Because if at least when you insert a new user into a group you could see the inherited rights, you could disable what you do not need. I think the user should have more restrictived rights than the group, now you can not eliminate any right if the group has it.

Does it work in DCO in the same way?

Regards

(CID:138381704)

[DCIM_Support]

That's true Javier but if you want a group with specific rights, we also offer the option of creating your own user group. You can then give that group access to specific device groups as you see fit. In an case, I'm glad you know how it's working now.

Steve

(CID:138381726)

[DCIM_Support]

Yes, Thank you Steven Marchetti

(CID:138381919)

[DCIM_Support]

This question is closed for comments. You're welcome to start a new topic if you have further comments on this issue.