TACACS+ Authentication Manager Help >> Operation Guide >> Device User >> Device User Group Management

Device User Group Management

Use device user groups to implement operators' hierarchical management. Add device users of the same type to the same device user group, and assign operation privileges to operators to manage the device user group. TAM supports 1024 device user groups at five levels and displays them in a tree structure, providing a more intuitive, convenient, and flexible management interface for operators.

Features

• Add Device User Group
  
  Add a level-1 device user group. A level-1 device user group has no parent group. The parent group name of a level-1 device user group is displayed as two hyphens (--).
  Perform this task to add a device user group.

  Procedure

  1. Click the User tab, and then select Device User > Device User Groups from the navigation tree.
  2. Click Add.
  3. Enter the group name.
  4. Select an authorization policy. You can select the default policy or a policy created by operators. CLI Access Not Supported means that users in the group cannot manage devices. For information about how to create an authorization policy, see Authorization Policy Management.
  5. Enter a description.
  6. Select the operators that can manage the group on the Authorized Operators list.
  7. Click OK.
• Add Sub Group
  
  Perform this task to add a sub group for a device user group. The Authorization Policy parameter is optional for adding a sub group. If you do not select an authorization policy for a sub group, the sub group inherits the authorization policy of its parent group.

  Procedure

  1. Click the User tab, and then select Device User > Device User Groups from the navigation tree.
  2. Click the icon of a device user group.
  3. Configure the parameters as needed.
  4. Click OK.
• Modify Device User Group
  
  Perform this task to modify a device user group.

  Procedure

  1. Click the User tab, and then select Device User > Device User Groups from the navigation tree.
  2. Click the icon of a device user group.
  3. Configure the parameters as needed.
  4. Click OK.
• Delete Device User Group
  
  A device user group cannot be deleted if it has a sub group or it is used by an LDAP synchronization policy. After a device user group is deleted, all users in this group are moved the ungrouped group.
  Perform this task to delete a device user group.

  Procedure

  1. Click the User tab, and then select Device User > Device User Groups from the navigation tree.
  2. Click the icon of the device user group that you want to delete.
     A confirmation dialog box appears.
  3. Click OK.
• Operator Privileges
  
  Perform this task to modify the management privileges of an operator to device user groups.

  Procedure

  1. Click the User tab, and then select Device User > Device User Groups from the navigation tree.
  2. Click Operator Privileges.
  3. Click the icon of an operator.
  4. Select the device user groups that the operator can manage.
  5. Click OK.

Parameters

• Authorization Policy: Lists all existing authorization policies and a system predefined item CLI Access Not Supported. CLI Access Not Supported means that users in the group cannot manage devices. You must select one authorization policy for a level-1 device user group. For other device user group levels, the authorization policy parameter is optional. If you do not select an authorization policy for a group, all users in the group will use the authorization policy of its parent group. If the parent group has no authorization policy either, it looks up the upper-level device user group until a device user group with an authorization policy is found.
• Authorized Operators: The administrator can manage all device user groups. The administrator is selected by default and cannot be unselected on the device user group adding and modification pages. On the operator privilege modification page, the administrator is not listed.

Remarks

• The system predefines a group named Ungrouped. It is generated after the system is installed. You cannot delete the Ungrouped group or add sub groups for it, and its group name and description cannot be modified.
• Group Name: Name of the group. The top-level groups cannot use the same name. The subgroups of the same group cannot use the same name.