CNS Security Services Administration

User Administration

CNS Security Service

CNS Security Services—Standalone Application

CNS Security Service in Integrated Mode

Logging In to the CNS Security Service

Creating a New User Group

Modifying User Groups

Adding Group Members

Adding New Users

Setting User Privileges

Modify Existing User Information

Changing a User Password from CNS

CNS Security Services Administration

Cisco Voice Routing Center (VRC) user administration is managed with CNS security service.

The CNS security service provides an authentication and authorization framework based upon the Role Based Access Control (RBAC) model.

User authentication—Is the verification of the credentials of a user.
User authorization—Determines the user's privileges and provides access control to the managed resources.
User privileges—Define the scope of managed resources for which a user has the right to perform a set of operations.

An administrator can perform the following functions when using the CNS security service user interface:

Create, modify, and delete users in the user configuration view.
Create, modify, and delete user groups in the group configuration view.
Set up user roles. User roles allow you to assign a set of privileges to a user or user group.
Set up policy rules. Policy rules allow you to assign a scope for users and user groups to work with.

Note For VRC system administration operations, use the VRC console.

The CNS security service must be installed before you install VRC.

This chapter contains the following topics:

User Administration

Voice Routing Center (VRC) Version 1.1 uses CNS security services for user administration and authorization. If you are using VRC integrated with PTC, see CNS Security Service in Integrated Mode.

VRC uses a simple security model, based on the following levels of permissions:

System Administrator—Writes permissions for the whole Administrative Domain (AD) and user management permissions
Global Network Administrator—Writes permissions for the whole AD
Regional Administrator—Writes permissions for a region
User—Reads permissions for the AD

Note For VRC system administration operations, use the VRC console.

CNS Security Service

This section describes the following CNS security service functions:

CNS Security Services—Standalone Application

VRC uses CNS security services for the following user administration and authorization operations:

User login
User logout
Check user permissions
Display user privileges
Create and delete security data when the network topology changes

VRC user administration is managed through the CNS security service.

The CNS security service:

Provides an authentication and authorization framework based upon the Role Based Access Control (RBAC) model. This framework provides features as authentication, authorization, and security administration.
Processes the policy rules represented in an LDAP v3 directory to determine the entitlements and privileges granted to various roles.

CNS Security Service in Integrated Mode

VRC, when integrated with PTC, uses CNS security services for the following user administration and authorization operations:

User login
User logout
Check user permissions
Display user privileges

Logging In to the CNS Security Service

To log in to the CNS security service, follow these steps:

Step 1 Open your web browser.

Step 2 Type in the IP address of server where VRC is installed plus " :8080" added to the end of the IP address (for example, http://172.168.140.162:8080). The CNS Security Services Administration logon window appears (Figure 9-1).

Figure 9-1: CNS Security Services Administration Log On Window

Step 3 Type in your user identification and your password. See your network administrator for this information.

Step 4 Click the Logon button. The CNS Security Services Administration window appears (Figure 9-2).

Figure 9-2: CNS Security Services Administration Main Window

Use the CNS security service user interface to add users and create user groups.

The CNS Security Services Administration window displays the following menu items:

User Management
Preferences
Help
Logout

Step 5 To log out of the CNS security service, click Log Out on the top right corner of the CNS Security Services Administration window.

Creating a New User Group

This section describes how to create new user groups. User groups determine the scope of privileges for each user. To set user privileges, you must add the user to the user group with a specific set of privileges.

You can use predefined VRC user groups or create your own user group.

Note VRC Version 1.1 only recognizes predefined VRC user groups. If you create your own user group, all users in this group have read-only permissions.

Note We recommend that you operate in Normal mode to add a new user group. If there is a link in the upper right corner of your window for Expert mode, then you are in Normal mode.

To create new user groups, follow these steps:

Step 1 Log in to the CNS security services.

Step 2 Choose the User Group Configuration option from the User Management menu. The CNS User Group: New window appears.

Step 3 Enter the user group name and a description of the user group.

Step 4 Click the Insert button.

A new user group is created with common name (cn) the user group name you entered, the organizational unit (ou) VRC, and the organization (o) cisco. The user group is created.

Modifying User Groups

Note We recommend that you operate in Normal Mode to modify user groups. If there is a link in the upper right corner of your window for Expert Mode, then you are in Normal Mode.

To make changes to an existing group, follow these steps:

Step 1 Log in to the CNS security services.

Step 2 From the User Management menu, choose the User Group Configuration option.

Step 3 Select a user group name from the list in the brown box on the left of this window and double-click the name. The user group window appears (Figure 9-3).

Figure 9-3: Modify User Group Information

Step 4 Enter the new information into the fields that you want to change.

a. To add a member to this user group, click the Add Members button.

b. To remove a member from this user group, check the box next to the member and click the Remove Members button.

c. To remove all members from this user group, check the box next to the Remove Members button and click Remove Members.

Step 5 Click the Update button to display the new user group information.

Adding Group Members

To add an existing member to a group, follow these steps:

Step 1 Log in to the CNS security services administration window.

Step 2 From the User Management menu, choose the User Group Configuration option.

Step 3 Select a user group name from the list in the brown box on the left of this window and double-click the name.

Step 4 Click the Add Members button. The Select Group Members window appears (Figure 9-4) and lists all defined users.

Figure 9-4: Select Group Members Window

Step 5 Locate the group member that you want to add to the user group.

Step 6 Click the small right arrow to move the member from the Available Members List to the Selected Members List or double-click the desired name.

Repeat this step for all users you want to add to this user group.

Step 7 Click Insert and Close.

The group member is added to the user group.

Adding New Users

VRC provides sample users and passwords for you to maintain. Table 9-1 lists sample user names and passwords provided by VRC.

Table 9-1: Sample User Names and Passwords

Sample User Name	Sample Password
DemoSysAdmin1	cisco
DemoNonAdminUser1	cisco
DemoGlobalNetOper1	cisco

Note We recommend that you operate in Normal Mode to add a new user account. If there is a link in the upper right corner of your window for Expert Mode, then you are in Normal Mode.

To add new user accounts, follow these steps:

Step 1 Log in to the CNS security services.

Step 2 Choose User Configuration from the User Management menu. The User: New window appears (Figure 9-5).

Figure 9-5: User: New Window

Step 3 Enter the user name and password for the new user account.

Step 4 Click the Insert button. A new user is created with common name (cn) the name you entered, the organizational unit (ou) ccnsc, and the organization (o) cisco.

Step 5 If you want to perform the following operations, follow Step 6 or Step 7.

Step 6 To make changes to this user information, enter the new information and click the Update button.

Step 7 To log out of the CNS security service user interface, click Log Out on the top right corner of the CNS window.

Setting User Privileges

You can set user privileges by adding them to user groups. User privileges are determined by the user group they belong to.

Note We recommend that you operate in Normal Mode to add a user to a user group. If there is a link in the upper right corner of your window for Expert Mode, then you are in Normal Mode.

To set user privileges, follow these steps:

Step 1 Log in to the CNS security services.

Step 2 Choose User Configuration from the User Management menu. Existing users are listed in the brown box on the left of the window.

Step 3 Double-click the user that you want to set privileges for. The current information for that user is displayed.

Step 4 Click Add to Group.

Step 5 Click the small right arrow to move the member from the Available Members List to the Selected Members List. Repeat this step for all users you want to add to this user group.

Step 6 Click Insert and Close. The group member is added to the user group.

Step 7 Click the Update button to display the new user information.

Step 8 To log out of the CNS security services, click Log Out on the top right corner of the CNS window.

Modify Existing User Information

Note We recommend that you operate in Normal Mode to modify user information. If there is a link in the upper right corner of your window for Expert Mode, then you are in Normal Mode.

To change existing user information, follow these steps:

Step 1 Log in to the CNS security services.

Step 2 Choose User Configuration from the User Management menu.

Existing users are listed in the box on the left of this window.

Step 3 Double-click a user name from the list. The next user window appears (Figure 9-6).

Figure 9-6: Modify User Information