Configure roles with RBAC 编辑

Each predefined role-based access control (RBAC) role has certain associated access and feature permissions. This article describes what each of those permissions does. For a full list of default permissions for each built-in role, download Role-Based Access Control Defaults.

When you apply permissions, you are defining the user groups the RBAC role has the permission to manage. The default administrator cannot change the applied permission settings. By default, the applied permissions apply to all user groups.

When you make an assignment, you are assigning the RBAC role to a group, so that the group of users owns the RBAC administrator rights.

Important:

Under the Settings permission, the RBAC permission gives Admin users full access, including the ability to assign their own permissions. Give this access only to users who you intend to give the ability to manipulate everything in the Endpoint Management system.

This article contains the following sections:

• Admin Role
• Support Role
• User Role
• Configure roles with RBAC

Admin Role

Users with the predefined Admin role have access or do not have access to the following features in XenMobile. By default, Authorized access (except Self-Help Portal), Console features, and Apply permissions are enabled.

Authorized access

* Remote support enables your help desk representatives to take remote control of managed Android mobile devices. Screen cast is supported on Samsung Knox devices only. Remote support isn’t available for clustered on-premises XenMobile Server deployments. Remote Support is no longer available for new customers as of January 1, 2019. Existing customers can continue to use the product, however Citrix doesn’t provide enhancements or fixes.

Console features

Administrators have unrestricted access to the XenMobile console.

Devices

Administrators access device features throughout the console by setting device restrictions, setting up and sending notifications to devices, administering apps on the devices, and so on.

Local Users and Groups

Administrators manage local users and local user groups on the Manage > Users page in XenMobile.

Enrollment

Administrators can add and delete enrollment invitations, send notifications to users, and export the enrollment table to a .csv file.

Policies

App

Administrators manage apps on the Configure > Apps page in XenMobile.

Media

Manage media obtained from a public app store or through a volume purchase license.

Action

Delivery group

Administrators manage delivery groups from the Configure > Delivery Groups page.

Enrollment profile

Manage enrollment profiles.

Settings

Administrators configure various settings on the Settings pages.

Support

Administrators can perform various support tasks.

Restrict Group Access

Admin users can apply permissions to all user groups.

Support Role

Users with the Support role have access to remote support. Their permissions apply to all users by default and they cannot edit this setting.

User Role

Users with the User role have the following limited access to XenMobile.

Authorized access

Console features

Users have the following restricted access to the XenMobile console.

Devices

Enrollment

Restrict Group Access

For all four default roles, this permission is set by default and can be applied to all user groups. You cannot edit the role.

Configure roles with RBAC

The Role-Based Access Control (RBAC) feature in XenMobile lets you assign predefined roles, or sets of permissions, to users and groups. These permissions control the level of access users have to system functions.

XenMobile implements four default user roles to logically separate access to system functions:

• Administrator: Grants full system access.
• Support: Grants access to remote support.
• User: Used by users who can enroll devices and access the Self-Help Portal.

You can also use the default roles as templates that you customize to create user roles. You can assign the roles permissions to access specific system functions beyond the functions defined by the default roles.

Roles can be assigned to local users (at the user level) or to Active Directory groups (all users in that group have the same permissions). If a user belongs to several Active Directory groups, all the permissions are merged together to define the permissions for that user. For example, suppose that ADGroupA users can locate manager devices and ADGroupB users can wipe employee devices. In that case, a user who belongs to both groups can locate and wipe devices of managers and employees.

Note:

Local users might have only one role assigned to them.

You can use the RBAC feature in XenMobile to do the following:

• Create a role.
• Add groups to a role.
• Associate local users to roles.

1. In the XenMobile console, go to Settings > Role-Based Access Control. The Role-Based Access Control page appears, which displays the four default user roles, plus any roles you have previously added.

   

   If you click the plus sign (+) next to a role, the role expands to show all the permissions for that role, as shown in the following figure.

   

2. Click Add to add a new user role. To edit the role, click the pen icon to the right of an existing role. To delete the role, click the trash can icon to the right of a role. You can’t delete the default user roles.

   • When you click Add or the pen icon, the Add Role or the Edit Role page appears.
   • When you click the trash can icon, a confirmation dialog appears. Click Delete to remove the selected role.

3. Enter the following information to create or edit a user role:

   • RBAC name: Enter a descriptive name for the new user role. You cannot change the name of an existing role.
   • RBAC template: Optionally, click a template as the starting point for the new role. You cannot select a template if you are editing an existing role.

   RBAC templates are the default user roles. They define the access to system functions that users associated with that role have. After you select an RBAC template, you can see all permissions associated with that role in the Authorized Access and Console Features fields. Using a template is optional. You can directly select the options you want to assign to a role in the Authorized Access and Console Features fields.

   

4. Click Apply near the selected RBAC template field to populate Authorized access and Console features with the pre-defined access and feature permissions.

   

5. Select and clear the check boxes in Authorized access and Console features to customize the role.

   If you click the triangle next to a Console feature, permissions specific to that feature appear that you can select and clear. Clicking the top-level check box prohibits access to that console area. Select individual options below the top level to enable those options. For example, in the following figure, the Full Wipe device and Clear Restrictions options don’t appear for users assigned to the role. The checked options do appear.

   

6. Apply permissions: Select one or more user groups to limit which groups the administrator can manage. If you click To specific user groups, a list of groups appears from which you can select one or more groups.

   For example, if an RBAC administrator has permissions to the ActiveDirectory and MSP user groups:

   • The administrator can access information only for users who are in the ActiveDirectory group, the MSP group, or both of those groups.
   • The administrator can’t view any other local or AD users. The administrator can view users who are members of child groups of either of those groups.
   • The administrator can send invitations to:
     • the permission groups and their child groups
     • the users who are members of permission groups and their child groups

   

7. Click Next. The Assignment page appears.

   

8. Enter the following information to assign the role to user groups.

   • Select domain: In the list, click a domain.
   • Include user groups: Click Search to see a list of all available groups, or type a full or partial group name to limit the list to only groups with that name.
   • In the list that appears, select the user groups to which you want to assign the role. When you select a user group, the group appears in the Selected user groups list.

   

   Note:

   To remove a user group from the Selected user groups list, click the X next to the user group name.

9. Click Save.