Users and authorizations




	NOTE: Users that have been added to the Central Management Server (CMS) cannot view or manage systems until authorizations have been configured for them.HP-UX and Linux-provided command line tools, such as ls and df, are run as root by default. For security reasons, you might want them to run as a specific user to avoid permitting unintended capabilities to a user.

HP Systems Insight Manager (HP SIM) enables you to configure authorizations for specific users or user groups. Authorizations give the user access to view and manage systems. Each authorization specifies a user or user group, a toolbox, and a system or system group. The specific set of tools that can be run against a system is specified in the assigned toolbox.

It is important that you plan which systems each user is going to manage and which specific set of tools the users are authorized to execute against the managed systems. A user with no toolbox authorizations on a system cannot view or manage that system.

Authorizations are additive. If a user is authorized on Toolbox1 on a system and is also authorized for Toolbox2 on the same system, the user is authorized for all tools in both Toolbox1 and Toolbox2 on that system. Similarly, a user authorized for the All Tools toolbox needs no other toolbox authorization on that system because the All Tools toolbox always includes all tools.

Adding users

Create a new user account to sign-in to HP Systems Insight Manager (HP SIM). The account must be valid on the operating system (including Active Directory on Windows) on the Central Management Server (CMS) and is authenticated by the CMS. You must know the operating system user account name of the user you are adding, but it is not necessary to know the password.

To create a new user:

Select OptionsSecurityUsers and AuthorizationsUsers, and then click New. The New User section appears.
(Required) In the Sign-in name [on central management server(CMS)] field, enter the operating system login account name to be used to sign-in to HP SIM. This field is required.
Note: The user cannot sign-in to HP SIM if the account is not a valid login. The account is not validated until the user attempts to sign-in to HP SIM.
(Optional) In the Domain (Windows® domain for sign-in name) field, enter the Windows domain name for the login name if the CMS is running a Windows operating system. If left blank, the CMS system name is used as the domain.
Note: If the user account was migrated from Insight Manager 7, the Domain (Windows® domain for login name) field associates a placeholder domain with the user. If the user receives pages, this field must be edited to include a valid domain on your network.
(Optional) In the Full name field, enter the user's full name.
(Optional) If you are using Windows, in the Phone field of the Pager Information section, enter the pager phone number. If the Phone number field is left blank, the paging information is not saved. This field does not apply to user groups..
(Optional) In the E-mail address field, enter the user's e-mail address.
In the Copy all authorizations of this user or [template] field, select a template (administrator-template, operator-template, or user-template) or sign-in account that already has the predefined authorizations that you want to assign to the sign-in account you are creating.
For user accounts that must be able to create, modify, or delete other accounts in the Central management server security configuration right section, select User can configure CMS security access such as creating, modifying or removing other users. If you selected an existing user with administrative rights or the administrator template in the previous step, this option is automatically selected.
Under the Sign-In IP Address Restrictions section, in the Inclusion ranges field, enter the IP addresses of the systems you want this user to be able to use as a client browsing this CMS. If you list multiple IP addresses, separate them with a semicolon (;). Each range is a single IP address or two IP addresses separated by a dash (-). The IP addresses must be entered in the standard dotted decimal notation, for example, 15.1.54.133. Any spaces surrounding the semicolons or dashes are ignored. Spaces are not allowed within a single IP address in the dotted decimal notation. Enter 0.0.0.0 to prevent a user from logging in through a remote system.
Important: If browsing from the CMS, ensure all IP addresses of the CMS are properly included. If browsing to localhost, ensure the loopback address 127.0.0.1 is also included.
In the Exclusion ranges field, enter the IP address of the systems that should be excluded from management by this user or user group. Use the same format as in the previous step for Inclusion ranges. Enter 0.0.0.0 to prevent a user from logging in through a remote system.
Note: Ensure that your inclusion and exclusion ranges do not overlap.
Under the Pager Information section, in the Phone number field, enter the pager phone number of the user associated with this user account if you are using a Windows operating system. If the Phone number field is left blank, the paging information is not saved. This field does not apply to user groups.
In the PIN number field, enter the PIN number associated with the pager phone number. This field does not apply to user groups.
In the Message length field, select how many characters can be accepted in the paging message from the dropdown list. This field does not apply to user groups.
In the Baud rate field, select the appropriate baud rate for the pager from the dropdown list. This field does not apply to user groups.
In the Data format field, select the appropriate data format for the pager from the dropdown list. This field does not apply to user groups.
To save and close the New User section, click OK. The new user account is created. To save and keep the New User section open, click Apply, or to cancel the creation of this user, click Cancel.

Adding user groups

User groups must exist in the operating system. For Windows, they must also exist in Active Directory. Members of user groups in the operating system can sign-in to HP Systems Insight Manager (HP SIM) and inherit the group's attributes for configuration rights, sign in IP address restrictions, and authorizations. When a group's configuration rights, sign in IP address restrictions, or authorizations are changed, this change is immediately reflected for all current members of the group.

To create a new user group:

Select OptionsSecurityUsers and AuthorizationsUsers, and then click New Group. The New User Group section appears.
In the Group name (on central management server) field, enter the operating system group name to be used for signing in to HP SIM. This field is required.
If the Central Management Server (CMS) is running a Windows operating system, in the Domain (Windows domain for login name) field, enter the Windows domain name for the group .
In the Full name field, enter the full name for the group. This name appears in the table under the Users tab.
In the Copy all authorizations of this user or [template] field, select a template or sign in that already has the predefined authorizations that you want to assign to the group you are creating.
For user accounts that must be able to create, modify, or delete other accounts in the Central management server security configuration right section, select User can configure CMS security access such as creating, modifying or removing other users. If you selected an existing user with administrative rights or the administrator template in the previous step, this option is automatically selected.
Under the Sign-In IP Address Restrictions section, in the Inclusion ranges field, enter the IP addresses of the systems you want this user to be able to use as a client browsing this CMS. If you list multiple IP addresses, separate them with a semicolon (;). Each range is a single IP address or two IP addresses separated by a dash (-). The IP addresses must be entered in the standard dotted decimal notation, for example, 15.1.54.133. Any spaces surrounding the semicolons or dashes are ignored. Spaces are not allowed within a single IP address in the dotted decimal notation. Enter 0.0.0.0 to prevent a user from logging in through a remote system.
Important: If browsing from the CMS, ensure all IP addresses of the CMS are properly included. If browsing to localhost, ensure the loopback address 127.0.0.1 is also included.
In the Exclusion ranges field, enter the IP address of the systems that should be excluded from management by this user or user group. Use the same format as in the previous step for Inclusion ranges. Enter 0.0.0.0 to prevent a user from logging in through a remote system.
Note: Ensure that your inclusion and exclusion ranges do not overlap.
To save and close the New User Group section, click OK. To save and keep the New User Group section open, click Apply, or to cancel to close the New User Group section without saving the new group, click Cancel .

Adding toolboxes

Create a toolbox to configure a group of tools to which a user has access.

To add a toolbox:

Select OptionsSecurityUsers and AuthorizationsToolboxes, and then click New. The New Toolbox section appears.
In the Name field, enter a name for the new toolbox. This field is required.
In the Description field, enter a description for the toolbox.
To enable the toolbox and all authorizations created with this toolbox, select Toolbox is enabled.
To display a list of tools in the available tools list, in the Show tools in category field, select a category. In the available tools list, select the tools to be assigned to this toolbox, and then click .
The selected tools appear in the Toolbox contents list. To remove a tool from the associated tools list, you can select a tool displayed in the Toolbox contents list, and then click .
Note: The HP SIM Tools category includes tools that are related to configuration rights on the HP SIM server itself. In previous versions of HP SIM, these rights were only enabled to full configuration rights users. With HP SIM 5.2, any user can be granted these rights if needed based on an authorization. These tools include: Delete Systems in HP SIM, Edit any user tasks in HP SIM, Edit HP SIM Notification Settings, Edit HP SIM Reports, Edit Shared Collections in HP SIM, Edit Systems in HP SIM, Modify HP SIM Events, Run HP SIM Discovery, and View HP SIM Audit Log.
Note: For users with operator rights and user rights to clear, delete, assign events, and add comments to events, you must select Configuration Tool from the Show tools in category dropdown list. Then, select Clear Events, Delete Events, Assign Events, and Comment Events as necessary, and then click to add them to the Toolbox contents.
To save the new toolbox and close the New Toolbox section, click OK. To save the settings without closing the New Toolbox section, click Apply, or to cancel the new toolbox creation and return to the Toolboxes section, click Cancel.

Adding authorizations

Authorize your users for a toolbox on a system or group of systems.

To add authorizations:

Select OptionsSecurityUsers and AuthorizationsAuthorizations, and then click New. The New Authorizations section appears.
In the Select dropdown list, select User(s) or UserGroup(s), and then select the users or groups in the box. This field is required.
In the Enter authorizations for the selected user(s) section, select one of the following options:
- Copy all authorizations of this user or [template]
  Select a user or template from the dropdown list.
- Manually assign toolbox and system/system group authorizations
  In the Select Toolbox(es) section, select the toolboxes to include.
  In the Select Systems list box, the two default system groups (All Managed Systems and CMS) are displayed. Select one of these groups, or to select systems for the authorization, click Add to display the Add Systems section.
  In the Add systems by selecting from section, select one of the following:
  Collection. Select a collection and click View contents.
  If you want to use the entire collection as your selection, select Select "collection name" itself. This option creates a system group based on the currently displayed contents of the collection.
  (Optional) To enable the authorization to automatically be updated, without user intervention when a collection is changed, select Automatically track changes. If this collection changes, so does the authorization.
  (Optional) Select Do not track changes. If this collection changes, the authorization will not change. If this option is selected, you must manually update the authorization after a collection has changed by using the Update button on the Authorizations tab.
  Note: These two selections are only available if a collection of systems is selected and the Select "collection name" itself option is selected. You must select one option or the other. The default selection is based on the DynamicAuthorizations_AutoUpdateDefaultValue property setting in the globalsettings.props file. The default is set to Yes. This is reflected in the Select Systems list box in the New Authorizations section with [Auto] appended to the entry. For example, if you selected All Systems and chose to have it automatically updated, All Systems 001 [Auto] would be displayed in the Select Systems box.
  You can continue to add systems and collections and can enable automatic updates for each selected collection. Since automatic updates for any authorization apply to all authorizations using the same selected collection, changing the setting for one affects any other authorization using the same collection. Therefore, during system selections, if you select a group already associated with an automatically updating authorization, the option Automatically track changes. If this collection changes, so does the authorization is preselected. Likewise, if an authorization that does not automatically update is associated with a collection, the option Do not track changes. If this collection changes, the authorization will not change is preselected.
  If you want to select all individual systems from the collection, select the checkbox at the top of the table view in the column heading to select all systems.
  Note: This action creates a separate authorization for each selected system.
  To save system selections, click Apply, or to return to the New Authorizations section without saving changes, click Cancel.
  After clicking Apply, a message appears based on the options selections. To return to the New Authorizations section, click OK.
  Search. Enter a system name and click Search, or select a system from the list and click Search.
  Select systems.
  Click Apply, or to return to the New Authorizations section without saving changes, click Cancel.
  After clicking Apply, a message appears based on the options selections. Click OK to return to the New Authorizations section.
A system group is a group of systems based on a system collection that is used for authorizations. Authorizations that use system groups are updated automatically when a change is made to the system collection that the system group is based upon. The option Do not track changes. If this collection changes, the authorization will not change must not be selected for the authorizations to be updated automatically.
If you selected individual systems of a collection, each selection populates the list box and is selected for inclusion in the authorization. If you selected a collection and the collection has been used previously in an authorization, a message appears stating that a system group for the collection exists and will be updated with current source collection content. This condition affects all authorizations associated with that collection. When a collection is used for the first time, no message appears. A system group with the name of the collection followed by three numbers, usually (001) is displayed in the Select Systems dropdown list and is selected.
To save the new authorization and close the New Authorizations section, click OK, or, if you do not want to create the authorization, click Cancel.

Configuring email settings

Configuring email settings enables users to send email notification of certain events.

To configure email settings:

Access the Simple Mail Transfer Protocol (SMTP) host and CMS e-mail settings through the First Time Wizard or choose OptionsEventsAutomatic Event HandlingEmail Settings. The Email Settings page appears.
Enter the SMTP host name. The SMTP host is the outgoing e-mail server that the CMS uses to send e-mail notifications.
In the Sender's e-mail address box, enter the e-mail address that the management server uses when sending e-mail notifications.
To authenticate your SMTP server, select Server Requires Authentication.
Enter the account user name and password in the corresponding boxes.
Note If you did not enter a valid Simple Mail Transfer Protocol (SMTP) host, HP SIM notifies you that it cannot send e-mail notifications. If you do not want to enter e-mail settings now, click OK, or to enter a valid SMTP host, click Cancel.
If you are changing the e-mail settings from the OptionsEventsAutomatic Event HandlingEmail Settings page, click OK to save changes.

Configuring paging settings

Configuring paging settings enables users to receive pages to notify them of certain events.

To configure paging settings:

Select OptionsEventsAutomatic Event HandlingModem Settings. The Modem Settings page appears.
From the COM port field, select the appropriate COM port. See your modem documentation for details.
Click OK to save the setting.

Setting up automatic event handling

Automatic event handling enables you to define an action that HP SIM performs when an event is received.

To set up automatic event handling:

Select OptionsEventsAutomatic Event HandlingNew Task. The Automatic Event Handling - New Task page appears.
Enter a name in the Task name field, or accept the default, and then click Next. The Select event collection page appears.
Select one of the following:
1. Use this event collection
  1. Select an event collection from the dropdown list.
    Note: Select an event collection. The event collection is a collection that is defined by event attributes. The event collection might be a combination collection containing system information. If the collection contains system information, step iii will not appear. If you select an event collection that contains additional event collections, you will receive an error message.
  2. (Optional) Click View Definition to view the collection attributes that define the event collection.
    Note: This field is displayed if you selected an existing private or shared event collection. If the collection was created using the Automatic Event Handling feature that enables you to select event and system information, this will not be displayed.
  3. Click Next. The Select system collection page appears. If the event collection contains system information, the select system collection process will not be displayed. Instead, the Select actions page will appear.
2. Use event attributes that I will specify
  1. Click Next. The Select events page appears.
  2. Select event search criteria for defining the task:
    - List criteria
    - Comparison option
    - Value for the criteria or comparison options selected
    To add additional search criteria, click Add.
3. Click Next. The Select system collection page appears.
Select one of the following options:
1. Use this system collection
  1. From the dropdown list, select a system collection.
  2. Click View Definition to view the collection attributes or the members of the system collection that is selected.
  3. Click Next. The Select action page appears.
2. Use system attributes that I will specify
  1. Click Next. The Select systems page appears.
  2. Select system search criteria for defining the task:
    - List criteria
    - Comparison option
    - Value for the criteria or comparison options selected
    To add additional search criteria, click Add.
  3. Click Next. The Select actions page appears.
Select from the following options:
- Send page (Windows only)
  Add users to be paged from the dropdown list of users by clicking . Click to remove selected users from the list of users to be paged. The pager number for an HP Systems Insight Manager (HP SIM) user is set on the Users and Authorizations page. If a user name in the Users list is inactive, the pager information for the user has not been configured. You can add the user to the list of users to be paged, but pager messages are not sent to this user until the pager information is provided.
  Note: If you select a user that does not have pager information set, the Pager Information section expands where you can enter the information.
  Enter the paging information.
  Phone number. Enter the pager phone number of the user associated with this user account if you are using a Windows operating system. If the Phone number field is left blank, the paging information is not saved. This field does not apply to user groups.
  PIN number. Enter the PIN number associated with the pager phone number.
  Message length. Select how many characters can be accepted in the paging message from the dropdown list.
  Baud rate. Select the appropriate baud rate for the pager from the dropdown list.
  Data format. Select the appropriate data format for the pager from the dropdown list.
  Click Apply. A dialog box appears stating that the changes were successful. Click OK to close the box.
- Send e-mail
  In the To field, enter the list of e-mail addresses that should receive the notification, separating each entry with a comma.
  In the CC field, enter any e-mail address that should receive a copy of the e-mail, separating each entry with a comma.
  In the Subject field, enter a note describing the subject of the e-mail.
  In the Message Format field, select from the following formats based on the encoding preference of the recipient:
  Standard. A default message format that sends a text e-mail message to the recipients.
  Pager/SMS. An e-mail message format that sends a message to the recipients with the same information and format as a pager message.
  HTML. An e-mail message format that sends a message to the recipients that looks like the HTML Event Details page.
  In the Encoding field, select from the following formats:
  Western European (ISO-8859-1)
  Unicode (UTF-8)
  Japanese (ISO-2022-JP)
  Japanese (Shift_JIS)
  Japanese (EUC-JP)
  Chinese (GB18030)
  Chinese (Big5)
  Korean (EUC-KR)
- Run custom tool
  Select a custom tool from the Name dropdown list. Custom tools are created under the ToolsCustom ToolsNew Custom Tool option, and then select CMS tool.
- Assign
  Enter the name of the person to whom to assign the task. The event is assigned to this user when received. Setting this field allows you to do searches assigned to this person.
- Forward as SNMP trap
  Enter a system name or IP address in the Name or IP field, and then click >> to add it to the Trap recipients box.
  Click Delete if you want to delete a recipient after selecting the name in the Trap recipients box. Use the up and down arrows to scroll to the recipient to delete.
- Write to system log
  On Windows NT and Windows XP systems, the event details are written to the Application Log, and the Source column of the Event Log is listed as HP SIM for the logged event. On Linux and HP-UX systems, the event details are logged to the system log, which is usually located in the file /var/log/messages on Linux and in /var/adm/syslog/syslog.log on HP-UX.
- Clear event
  Received events are cleared based on the criteria selected when task executes.
After you have made your selections, click Next. The Select time filter page appears.
Select the Use time filter checkbox if you want to use time filters, and then select an option from the dropdown list.
1. Click Manage Filters if you want to set user-defined filters.
2. Select the View time filter checkbox. A time filter window appears, showing the times selected.
  If the Use time filter checkbox is not selected, actions are triggered whenever the events matching the selected criteria are received.
  If the Use time filter checkbox is selected, actions are triggered only when they occur during the days and times specified by the selected time filter.
3. When you have entered the information, click Next to continue with the next step. The Review summary page appears. The task name, owner, time filters, event collections, system collections, and actions information is displayed. If a paging or e-mail option was selected, the modem and e-mail settings are displayed, along with buttons to change the settings.
(Optional) Click Edit modem settings to edit the modem settings, or click Edit email Settings to edit the SMTP settings.
Note: The event and system search criteria appear at the bottom of the page. This information can be extremely complex and long. Therefore, you might need to scroll down to view all of the criteria.
Click Finish to create the new task.

Configuring and executing discovery

Discovery is the process that HP SIM uses to find and identify the systems on your network and populate the database with that information. A system must first be discovered to collect data and track system status. There are two basic ways to discover new systems:

Automatic discovery. The process that HP SIM uses to find and identify the systems on your network to populate the database with that information. A system must first be discovered to collect data and track system status.
Manual discovery. The process that enables you to bypass a full automatic discovery and add single and multiple systems to the database, create or import the HP SIM database Hosts file, and create or import a generic Hosts file.

Configuring and executing automatic discovery

Select OptionsDiscovery. The Discovery page appears with the Automatic tab selected.
In the For all automatic discoveries section, select Configure general settings. The General Settings for All Discoveries section appears.
Select from the following options:
- Automatically discover a system when an event is received from it. This option enables systems to be discovered when a trap or some other supported event is received by HP Systems Insight Manager (HP SIM). It uses the discovery filters and IP address exclusion ranges for additional filtering of these events. This option is not selected by default.
- Automatically discover a server blade when its Integrated Lights Out management processor is identified. This option adds servers indirectly discovered through the server's management processor, which are discovered when the server's iLO is discovered. The discovered servers are identified as Disabled on the system table view page. The only information displayed is the system serial number and the association to iLO and the enclosure. If the iLO is in a c-Class enclosure, the option ,Discover systems in an enclosure when Onboard Administrator is discovered should also be enabled.
- Select Discover systems in an enclosure when Onboard Administrator is discovered. This option adds systems identified by the Onboard Administrator even if the systems are not in the configured discovery range. This option is selected by default.
- Select Automatically discover VM guest(s) when the host is identified. This option adds all HP Integrity Virtual Machine (HPVM) guest systems to the HP SIM database when the HPVM host system is discovered and identified. This option is selected by default.
  Note: For automatic identification of virtual machine guests running on a virtual machine host, the IP address of the guest is required. To acquire the IP address from Web-Based Enterprise Management (WBEM) Providers, VMWare tools must be installed on the virtual machine guests.
- Automatically discover other virtual partitions within the same vPar Monitor when one of the virtual partitions is identified. This option is selected by default.
- Automatically discover all nPars within the same complex when one of the nPars is identified. This option is selected by default.
In the Ping exclusion ranges, templates and/or hosts files field, specify the IP addresses, templates, or hosts files containing IP addresses to exclude from the automatic discovery process. You can also enter Simple or Fully Qualified Domain Names (FQDN) host names. However, you cannot enter a range of host names. This field applies to both range-pinging and event-based automatic discovery.
Important: When discovering clusters, the ping inclusion range must include the IP addresses of the cluster and the cluster members.
Select Enable discovery filters.
In the section, Discover the following system types, select the type of systems to be discovered.
Important: When discovering clusters, you must include the server system type, so that the cluster members are not filtered out.
Note: This option is available only when you select Enable discovery filters.
In the Limit discovery to systems that meet the following criteria section, select from the following:
- Any system that matches the above filter
- All manageable systems (WBEM, SNMP, DMI, WMI, or HTTP support)
- Manageable systems with HP agents only
Note: The option, Limit discovery to systems which meet the following criteria is available only when you select Enable discovery filters.
To save settings, click OK, or to close the General Settings for All Discoveries section without saving changes, click Cancel.
If you click OK when discovery filters are enabled but have not selected any system types, the following error message appears:
You must make at least one system type selection when enabling filters.
Select System Automatic Discovery. Click one of the following options to schedule it for ongoing operations or to make other changes: Edit, Enable or Run Now. If you would like to create other discovery tasks, click New.

Configuring and executing manual discovery

Select OptionsDiscovery, and then click the Manual tab. The System Information section appears.
Enter the system name or IP address. Simple or Fully Qualified Domain Name (FQDN) host names can be entered. However, ranges of host names are not allowed.
Click Add System to add the system to the database. If you have not entered the SNMP or Web-Based Enterprise Management (WBEM) credentials for this system previously, click More Settings. Enter the credentials, then click Add System, or click More Settingsand enter the following information:
- Specify additional system properties to use only if Identification fails on this system. Includes:
  System type. Click the down arrow and select the appropriate System type.
  System subtype. Click the down arrow and select the appropriate System subtype. You can input up to eight different system subtypes.
  Product model. Enter the system model number here. This field is free form.
- WBEM Settings.
  User name.
  Password. If you do not want to use the default global values for the WBEM user name and password, select Use Custom , and then enter custom values.
  If you are manually discovering a storage system, ensure that the user name and password of the SMI CIMOM are present in the global protocol settings, or enter them here as custom values. To view the global settings, select OptionsGlobal Protocol SettingsProtocol Settings.
  For Windows-based systems, the user name should include the domain name. For example, domainname\username.
  Note: OpenWBEM is not supported.
  SNMP Settings. If you do not want to use the default global values for the SNMP settings, select Use Custom, and enter custom values.
  Timeout (in seconds). The amount of time HP SIM waits for an SNMP response when it sends a request to the system. If a response is not received within this time interval, HP SIM might determine that the system does not support SNMP. Decreasing this value can case increased network traffic because the rate of retry attempts is increased. Use caution when changing this value. A value of three seconds usually works for a LAN. However, if systems are connected through a WAN, try a higher value, for example, 10 seconds.
  Retries.
  The number of additional times after the first attempt is made to communicate with a system before the attempts stop.
  Read-only community string and Write community string.
  Note: The Write community string is optional and is required only for firmware updates on a GbE switch. If you must update the GbE switch firmware, you must first set the write community string from this page and then run the existing switch update task. Do not set this feature if the network is not trusted.
  A community string sets up authentication that enables or prohibits communication between the managed system and the Central Management Server (CMS). The community string of the CMS must match the community string of the managed system. Use the read-only community string to read variables. Use the write community string to modify variables. Although only one community is valid for a communication attempt, a system can belong to multiple communities. However, HP SIM only uses one community string when communicating with a system.