Roles Overview
A role is a function assigned to a user that defines the tasks that the user can perform within CSO. Each user can be assigned one or more roles depending on the tasks that the user is expected to perform.
User roles enable you to classify users based on the privileges to perform tasks on CSO objects. Roles assigned to a user determine the tasks and actions that the user can perform.
This topic contains the following sections:
Types of Roles
There are two types of roles: predefined roles and custom roles.
Predefined roles—System-defined roles with a set of predefined access privileges assigned to a user to perform tasks within the CSO application. Predefined roles are created in the system during CSO installation. For more information about predefined roles, see Role-Based Access Control Overview.
Custom roles—Object-based user-defined roles with a set of access privileges assigned to a user to perform tasks within the CSO application. Objects include menu and submenu items (for example, Resources, Devices, Images, and POPs) in the CSO application, from which you can create, edit, clone, and delete objects.
Custom roles can be created by:
An OpCo Administrator, or a Tenant Administrator.
A tenant user with the Create Role privilege. This user can create custom roles for tenant users.
An OpCo user with the Create Role privilege. This user can create custom roles for both OpCo and tenant users.
You can create custom roles and assign access privileges to each role by using the Roles page (Administration > Roles).
You can assign one or more roles to a user when you create or edit a user account. Each role can have one or more access privileges.
Role Scopes
A role scope defines the specific scope, which is assigned to the role, such as service provider, OpCo, or tenant. An OpCo Administrator can assign OpCo, and tenant roles to OpCo users and tenant roles to tenant users. A Tenant Administrator can assign tenant roles only to tenant users. A role can have the following scopes:
Tenant—Represents a customer that can view, configure, and manage its sites through Customer Portal.
Operating Company (OpCo)—Similar to a service provider that can manage its own tenants. Tenants managed by one OpCo are isolated from tenants of another OpCo. An OpCo can manage all activities related to its own tenants.
Access Privileges
The following access privileges and actions can be assigned to a user role:
Read
Create
Update
Delete
Other actions (Example: For device templates object, the following other actions are supported: Clone and Edit Device Template) .
Relationship Between User, Roles, and Access Privileges
Figure 1 shows the relationship between a user, user roles, and access privileges. A user can have one or more roles and each role can have one or more access privileges.
Benefits of role-based access control (RBAC)
CSO provides pre-defined and user-defined set of roles for day-to-day system operations on the unified Administration and Customer portal.
Controls which system users can view, read, write, and execute objects based on certain business and operation needs.
Provides granular level access control on CSO objects within each navigation menu.
Helps service providers in upselling advanced features to their tenants as a power user.
CSO supports RBAC and authenticate users using local authentication and the external Single Sign On (SSO) server.