Domains Overview

Accessing Objects In and Across Domains

Junos Space Platform allows you to access objects across domains based on the roles you are assigned and the domains you are assigned to.

The following rules apply while accessing objects across domains in Junos Space Platform:

• Objects can be assigned to only one domain.

• Objects can be moved from one domain to another.

• Objects across domains can share the same name.

• You can view objects from the parent domain only in read-only mode and only if the parent domain allows its objects to be viewed by its subdomains.

• You can view and execute tasks on objects in a subdomain if the object is provided with appropriate permissions.

• You cannot modify or delete objects in a parent domain if you have read-only access, even if you have the necessary permissions to modify those objects.

• You can view and perform actions only on the objects assigned to the domain to which you are currently logged in. You can view objects from other accessible domains if the "Manage objects from all assigned domains” flag is set as a user preference. To set this flag, click the User Settings icon on the Junos Space banner.

• If you have read/write privileges to objects in a subdomain, you can perform read/write operations on the objects in the subdomain even if the subdomain is not explicitly assigned to you.

• If you have read-only privileges to objects in a subdomain, you can perform only read operations on the objects in the subdomain.

• If you have read-only access to objects in the parent domain, you cannot perform write operations even if you have read/write privileges on these objects by virtue of the roles assigned to you.

• If you do not have read-only access to objects in the parent domain, the objects in the parent domain are not visible to you in the subdomain.

In addition to the default rules to access objects assigned to domains, you can also use the “Allow users of this domain to have read and execute access to parent domain objects” flag to provide read permissions to all users in the domain when you create a domain. This flag provides both read and execute access to the objects in the parent domain.

If you use this flag, you can access the following objects that have read and execute permissions:

• Device templates and template definitions

• CLI Configlets, configuration views, configuration filters, XPath, and regular expressions

• Images, scripts, operations, and script bundles

• Report definitions

Device Partitions

Use device partitions to share physical interfaces, logical interfaces, and physical inventory of devices among multiple subdomains. Device partitions are supported only on M Series and MX Series routers.

Consider the following restrictions when working with device partitions:

• You can assign only one partition of a device to a subdomain; you cannot assign multiple partitions of the same device to a subdomain.

• You can assign one partition each from multiple devices to a subdomain.

• You can partition a device only if the device is currently assigned to the Global domain.

• To assign a partition to a subdomain, the root device should be part of the Global domain.

For example, consider device D1 with partitions P1, P2, and P3; device D2 with partitions P1a and P2a; and Global, dom1, and dom2 to be the available domains in Junos Space. The following assignments of partitions are valid:

• P1 to dom1

• P1a to dom1

• P2 to dom2

• P2a to dom2

• P3 to Global (default)

The following assignments are invalid: P1 and P2 to dom1 or P1a and P2a to dom2.

To assign a partition to a subdomain, the root device must be part of the Global domain.

Table 1 lists the actions that you can or cannot perform on a device partition:

You can assign device partitions to a domain or move the device partition from one domain to another. To assign a device partition to a domain or move a device partition from one domain to another, right-click the device partition and select Assign Partition to Domain.

You can assign devices to a domain. To do so, right-click the device and select the Assign Device to Domain task. You cannot move devices with partitions to a subdomain. If you do so, the Assign Device to Domain job fails.

Assignment of Objects to Domains

Objects in Junos Space Platform workspaces are assigned to at least one of the available domains.

The following rules apply while managing objects in the various workspaces:

• Templates—Templates and template definitions are created in the domain that you are currently operating in. When you create a template, you can select a template definition from the same domain or a parent domain if you have access to the parent domain. You can deploy templates on devices if they are in the same domain or if devices belong to other accessible domains and the “Manage objects from all assigned domains” flag is set as a user preference. To set this flag, click the User Settings icon on the Junos Space banner. Also, you can deploy templates that are inherited from the parent domain to the devices in the accessible domains.

• CLI Configlets—CLI Configlets are assigned to the domain that you are currently operating in. You can apply CLI Configlets to devices if they belong to the same domain or if the devices belong to other accessible domains and the “Manage objects from all assigned domains” flag is set as a user preference. You can assign and deploy CLI Configlets that are inherited from the parent domain to the devices in the current domain.

• Images and Scripts—Images and scripts are assigned to the domain that you are currently operating in. You can stage, deploy, or perform any action on images and scripts for only those devices that belong to the same domain or if the devices belong to other accessible domains and the “Manage objects from all assigned domains” flag is set as a user preference. You can also inherit images and scripts from the parent domain and perform some actions such as staging on devices in the current domain and other accessible domains.

• Configuration Files—Configuration files are created in the domain to which the device is currently assigned. If a device is moved from one domain to another, configuration files are also automatically moved to the respective domain. This workspace does not display objects inherited from the parent domain if the “Manage objects from all assigned domains” flag is set as a user preference.

• Jobs—Jobs are associated with the domain from which you initiate jobs. You can view jobs from other domains that are assigned to you if the “Manage objects from all assigned domains” flag is set as a user preference.

• Audit Logs—Audit logs are generated in the domain from which the user initiated the actions. You can view audit logs from other domains that are assigned to you if the “Manage objects from all assigned domains” flag is set as a user preference.

• Role Based Access Control—The Roles page is not available in the subdomains. You can create users only when you are logged in to the Global domain. You can assign users to a domain when or after you create user accounts.

• Administration—You can access the complete Administration workspace only if you are logged in to the Global domain.

• Reports—Report definitions are assigned to the domain in which they are created. You can generate reports by using the definition in the inherited domain or the current domain.