Users and authorizations




	NOTE: Users that have been added to the Central Management Server (CMS) cannot view or manage systems until authorizations have been configured for them.HP-UX and Linux-provided command line tools, such as ls and df, are run as root by default. For security reasons, you might want them to run as a specific user to avoid permitting unintended capabilities to a user.

HP Systems Insight Manager (HP SIM) enables you to configure authorizations for specific users or user groups. Authorizations give the user access to view and manage systems. Each authorization specifies a user or user group, a toolbox, and a system or system group. The specific set of tools that can be run against a system is specified in the assigned toolbox.

It is important that you plan which systems each user is going to manage and which specific set of tools the users are authorized to execute against the managed systems. A user with no toolbox authorizations on a system cannot view or manage that system.

Authorizations are additive. If a user is authorized on Toolbox1 on a system and is also authorized for Toolbox2 on the same system, the user is authorized for all tools in both Toolbox1 and Toolbox2 on that system. Similarly, a user authorized for the All Tools toolbox needs no other toolbox authorization on that system because the All Tools toolbox always includes all tools.

Adding users

Create a new user account to sign-in to HP SIM. The account must be valid on the operating system (including Active Directory on Windows) on the Central Management Server (CMS) and is authenticated by the CMS. You must know the operating system user account name of the user you are adding, but it is not necessary to know the password.

To create a new user:

Select OptionsSecurityUsers and AuthorizationsUsers, and then click New. The New User section appears.
(Required) In the Sign-in name [on central management server(CMS)] field, enter the operating system login account name to be used to sign in to HP SIM. This field is required.
Note: The user cannot sign-in to HP SIM if the account is not a valid login. The account is not validated until the user attempts to sign-in to HP SIM.
(Optional) In the Domain (Windows® domain for sign-in name) field, enter the Windows domain name for the login name if the CMS is running a Windows operating system. If left blank, the CMS system name is used as the domain.
Note: If the user account was migrated from Insight Manager 7, the Domain (Windows® domain for login name) field associates a placeholder domain with the user. If the user receives pages, this field must be edited to include a valid domain on your network.
(Optional) In the Full name field, enter the user's full name.
(Optional) If you are using Windows, in the Phone field of the Pager Information section, enter the pager phone number. If the Phone number field is left blank, the paging information is not saved. This field does not apply to user groups..
(Optional) In the E-mail address field, enter the user's e-mail address.
In the Copy all authorizations of this user or [template] field, select a template (administrator-template, operator-template, or user-template) or sign-in account that already has the predefined authorizations that you want to assign to the sign-in account you are creating.
For user accounts that must be able to create, modify, or delete other accounts in the Central management server security configuration right section, select User can configure CMS security access such as creating, modifying or removing other users. If you selected an existing user with administrative rights or the administrator template in the previous step, this option is automatically selected.
Under the Sign-In IP Address Restrictions section, in the Inclusion ranges field, enter the IP addresses of the systems you want this user to be able to use as a client browsing this CMS. If you list multiple IP addresses, separate them with a semicolon (;). Each range is a single IP address or two IP addresses separated by a dash (-). The IP addresses must be entered in the standard dotted decimal notation, for example, 15.1.54.133. Any spaces surrounding the semicolons or dashes are ignored. Spaces are not allowed within a single IP address in the dotted decimal notation. Enter 0.0.0.0 to prevent a user from logging in through a remote system.
Important: If browsing from the CMS, ensure all IP addresses of the CMS are properly included. If browsing to localhost, ensure the loopback address 127.0.0.1 is also included.
In the Exclusion ranges field, enter the IP address of the systems that should be excluded from management by this user or user group. Use the same format as in the previous step for Inclusion ranges. Enter 0.0.0.0 to prevent a user from logging in through a remote system.
Note: Ensure that your inclusion and exclusion ranges do not overlap.
Under the Pager Information section, in the Phone number field, enter the pager phone number of the user associated with this user account if you are using a Windows operating system. If the Phone number field is left blank, the paging information is not saved. This field does not apply to user groups.
In the PIN number field, enter the PIN number associated with the pager phone number. This field does not apply to user groups.
In the Message length field, select how many characters can be accepted in the paging message from the dropdown list. This field does not apply to user groups.
In the Baud rate field, select the appropriate baud rate for the pager from the dropdown list. This field does not apply to user groups.
In the Data format field, select the appropriate data format for the pager from the dropdown list. This field does not apply to user groups.
To save and close the New User section, click OK. The new user account is created. To save and keep the New User section open, click Apply, or to cancel the creation of this user, click Cancel.

Adding user groups

User groups must exist in the operating system. For Windows, they must also exist in Active Directory. Members of user groups in the operating system can sign-in to HP SIM and inherit the group's attributes for configuration rights, sign in IP address restrictions, and authorizations. When a group's configuration rights, sign in IP address restrictions, or authorizations are changed, this change is immediately reflected for all current members of the group.

To create a new user group:

Select OptionsSecurityUsers and AuthorizationsUsers, and then click New Group. The New User Group section appears.
In the Group name (on central management server) field, enter the operating system group name to be used for signing in to HP SIM. This field is required.
If the Central Management Server (CMS) is running a Windows operating system, in the Domain (Windows domain for login name) field, enter the Windows domain name for the group .
In the Full name field, enter the full name for the group. This name appears in the table under the Users tab.
In the Copy all authorizations of this user or [template] field, select a template or sign in that already has the predefined authorizations that you want to assign to the group you are creating.
For user accounts that must be able to create, modify, or delete other accounts in the Central management server security configuration right section, select User can configure CMS security access such as creating, modifying or removing other users. If you selected an existing user with administrative rights or the administrator template in the previous step, this option is automatically selected.
Under the Sign-In IP Address Restrictions section, in the Inclusion ranges field, enter the IP addresses of the systems you want this user to be able to use as a client browsing this CMS. If you list multiple IP addresses, separate them with a semicolon (;). Each range is a single IP address or two IP addresses separated by a dash (-). The IP addresses must be entered in the standard dotted decimal notation, for example, 15.1.54.133. Any spaces surrounding the semicolons or dashes are ignored. Spaces are not allowed within a single IP address in the dotted decimal notation. Enter 0.0.0.0 to prevent a user from logging in through a remote system.
Important: If browsing from the CMS, ensure all IP addresses of the CMS are properly included. If browsing to localhost, ensure the loopback address 127.0.0.1 is also included.
In the Exclusion ranges field, enter the IP address of the systems that should be excluded from management by this user or user group. Use the same format as in the previous step for Inclusion ranges. Enter 0.0.0.0 to prevent a user from logging in through a remote system.
To save and close the New User Group section, click OK. To save and keep the New User Group section open, click Apply, or to cancel to close the New User Group section without saving the new group, click Cancel .

Adding toolboxes

Create a toolbox to configure a group of tools to which a user has access.

To add a toolbox:

Select OptionsSecurityUsers and AuthorizationsToolboxes, and then click New. The New Toolbox section appears.
In the Name field, enter a name for the new toolbox. This field is required.
In the Description field, enter a description for the toolbox.
To enable the toolbox and all authorizations created with this toolbox, select Toolbox is enabled.
To display a list of tools in the available tools list, in the Show tools in category field, select a category. In the available tools list, select the tools to be assigned to this toolbox, and then click .
The selected tools appear in the Toolbox contents list. To remove a tool from the associated tools list, you can select a tool displayed in the Toolbox contents list, and then click .
Note: The HP SIM Tools category includes tools that are related to configuration rights on the HP SIM server itself. In previous versions of HP SIM, these rights were only enabled to full configuration rights users. With HP SIM 5.2 or later, any user can be granted these rights if needed based on an authorization. These tools include: Delete Systems in HP SIM, Edit any user tasks in HP SIM, Edit HP SIM Notification Settings, Edit HP SIM Reports, Edit Shared Collections in HP SIM, Edit Systems in HP SIM, Modify HP SIM Events, Run HP SIM Discovery, and View HP SIM Audit Log.
Note: For users with operator rights and user rights to clear, delete, assign events, and add comments to events, you must select Configuration Tool from the Show tools in category dropdown list. Then, select Clear Events, Delete Events, Assign Events, and Comment Events as necessary, and then click to add them to the Toolbox contents.
To save the new toolbox and close the New Toolbox section, click OK. To save the settings without closing the New Toolbox section, click Apply, or to cancel the new toolbox creation and return to the Toolboxes section, click Cancel.

Adding authorizations

Authorize your users for a toolbox on a system or group of systems.

To add authorizations:

Select OptionsSecurityUsers and AuthorizationsAuthorizations, and then click New. The New Authorizations section appears.
In the Select dropdown list, select User(s) or UserGroup(s), and then select the users or groups in the box. This field is required.
In the Enter authorizations for the selected user(s) section, select one of the following options:
- Copy all authorizations of this user or [template]
  Select a user or template from the dropdown list.
- Manually assign toolbox and system/system group authorizations
  In the Select Toolbox(es) section, select the toolboxes to include.
  In the Select Systems list box, the two default system groups (All Managed Systems and CMS) appear. Select one of these groups, or to select systems for the authorization, click Add to display the Add Systems section.
  In the Add systems by selecting from section, select one of the following:
  Collection Select a collection and click View contents.
  If you want to use the entire collection as your selection, select Select "collection name" itself. This option creates a system group based on the currently displayed contents of the collection.
  (Optional) To enable the authorization to automatically be updated, without user intervention when a collection is changed, select Automatically track changes. If this collection changes, so does the authorization.
  (Optional) Select Do not track changes. If this collection changes, the authorization will not change. If this option is selected, you must manually update the authorization after a collection has changed by using the Update button on the Authorizations tab.
  Note: These two selections are only available if a collection of systems is selected and the Select "collection name" itself option is selected. You must select one option or the other. The default selection is based on the DynamicAuthorizations_AutoUpdateDefaultValue property setting in the globalsettings.props file. The default is set to Yes. This is reflected in the Select Systems list box in the New Authorizations section with [Auto] appended to the entry. For example, if you selected All Systems and chose to have it automatically updated, All Systems 001 [Auto] would be displayed in the Select Systems box.
  You can continue to add systems and collections and can enable automatic updates for each selected collection. Since automatic updates for any authorization apply to all authorizations using the same selected collection, changing the setting for one affects any other authorization using the same collection. Therefore, during system selections, if you select a group already associated with an automatically updating authorization, the option Automatically track changes. If this collection changes, so does the authorization is preselected. Likewise, if an authorization that does not automatically update is associated with a collection, the option Do not track changes. If this collection changes, the authorization will not change is preselected.
  If you want to select all individual systems from the collection, select the checkbox at the top of the table view in the column heading to select all systems.
  Note: This action creates a separate authorization for each selected system.
  To save system selections, click Apply, or to return to the New Authorizations section without saving changes, click Cancel.
  After clicking Apply, a message appears based on the options selections. To return to the New Authorizations section, click OK.
  Search Enter a system name and click Search, or select a system from the list and click Search.
  Select systems.
  Click Apply, or to return to the New Authorizations section without saving changes, click Cancel.
  After clicking Apply, a message appears based on the options selections. Click OK to return to the New Authorizations section.
A system group is a group of systems based on a system collection that is used for authorizations. Authorizations that use system groups are updated automatically when a change is made to the system collection that the system group is based upon. The option Do not track changes. If this collection changes, the authorization will not change must not be selected for the authorizations to be updated automatically.
If you selected individual systems of a collection, each selection populates the list box and is selected for inclusion in the authorization. If you selected a collection and the collection has been used previously in an authorization, a message appears stating that a system group for the collection exists and will be updated with current source collection content. This condition affects all authorizations associated with that collection. When a collection is used for the first time, no message appears. A system group with the name of the collection followed by three numbers, usually (001) appears in the Select Systems dropdown list and is selected.
To save the new authorization and close the New Authorizations section, click OK, or, if you do not want to create the authorization, click Cancel.

Configuring email settings

Configuring email settings enables users to send email notification of certain events.

To configure email settings:

Access the SMTP host and CMS e-mail settings through the First Time Wizard or choose OptionsEventsAutomatic Event HandlingEmail Settings. The Email Settings page appears.
Enter the SMTP host name. The SMTP host is the outgoing e-mail server that the CMS uses to send e-mail notifications.
In the Sender's e-mail address box, enter the e-mail address that the management server uses when sending e-mail notifications.
(Optional) Select Send test email and enter recipients e-mail address.
Click Send test email now.
To authenticate your SMTP server, select Server Requires Authentication.
Enter the account user name and password in the corresponding boxes.
Note If you did not enter a valid SMTP host, HP SIM notifies you that it cannot send e-mail notifications.
If you are changing the e-mail settings from the OptionsEventsAutomatic Event HandlingEmail Settings page, click OK to save changes.

Configuring paging settings

Configuring paging settings enables users to receive pages to notify them of certain events.

To configure paging settings:

Select OptionsEventsAutomatic Event HandlingModem Settings. The Modem Settings page appears.
From the COM port field, select the appropriate COM port. See your modem documentation for details.
Click OK to save the setting.

Setting up automatic event handling

Automatic event handling enables you to define an action that HP SIM performs when an event is received.

To set up automatic event handling:

Select OptionsEventsAutomatic Event HandlingNew Task. The Automatic Event Handling - New Task page appears.
Enter a name in the Task name field, or accept the default, and then click Next. The Select event collection page appears.
Select one of the following:
1. Use this event collection
  1. Select an event collection from the dropdown list.
    Note: Select an event collection. The event collection is a collection that is defined by event attributes. The event collection might be a combination collection containing system information. If you select an event collection that contains additional event collections, you will receive an error message.
  2. (Optional) Click View Definition to view the collection attributes that define the event collection.
    Note: This field appears if you selected an existing private or shared event collection. If the collection was created using the Automatic Event Handling feature, this not appear.
  3. Click Next. The Select system collection page appears. If the event collection contains system information, the select system collection process does not appear. Instead, the Select actions page appears.
2. Use event attributes that I will specify
  1. Click Next. The Select events page appears.
  2. Select event search criteria for defining the task.
    To add additional search criteria, click Add.
3. Click Next. The Select system collection page appears.
Select one of the following options:
- Use this system collection
  From the dropdown list, select a system collection.
  Click View Definition to view the collection attributes or the members of the system collection that is selected.
  Click Next. The Select action page appears.
- Use system attributes that I will specify
  Click Next. The Select systems page appears.
  Select system search criteria for defining the task:
  List criteria
  Comparison option
  Value for the criteria or comparison options selected
  To add additional search criteria, click Add.
  Click Next. The Select actions page appears.
Select from the following options:
- Send page (Windows only)
  Add users to be paged from the dropdown list by clicking . Click to remove selected users. The pager number for an HP SIM user is set on the Users and Authorizations page. If a user name in the Users list is inactive, the pager information for the user has not been configured. You can add the user to the list, but pager messages are not sent to this user until the pager information is provided.
  Note: If you select a user that does not have pager information set, the Pager Information section expands where you can enter the information.
  Enter the paging information.
  Phone number  Enter the pager phone number of the user associated with this user account if you are using a Windows operating system. If the Phone number field is left blank, the paging information is not saved. This field does not apply to user groups.
  PIN number  Enter the PIN number associated with the pager phone number.
  Message length  Select how many characters can be accepted in the paging message from the dropdown list.
  Baud rate  Select the appropriate baud rate for the pager from the dropdown list.
  Data format  Select the appropriate data format for the pager from the dropdown list.
  Click Apply. A dialog box appears stating that the changes were successful. Click OK to close the box.
- Send e-mail
  In the To field, enter the list of e-mail addresses that should receive the notification, separating each entry with a comma.
  In the CC field, enter any e-mail address that should receive a copy of the e-mail, separating each entry with a comma.
  In the Subject field, enter a note describing the subject of the e-mail.
  In the Message Format field, select from the following formats based on the encoding preference of the recipient:
  Standard. A default message format that sends a text e-mail message to the recipients.
  Pager/SMS. An e-mail message format that sends a message to the recipients with the same information and format as a pager message.
  Note: Many cellular service providers offer SMS facility to their customers via an email. For example, if your mobile phone number is 555-123-4567, an email sent to 5551234567@yourserviceprovider.com is sent to your mobile phone as an SMS page.
  HTML. An e-mail message format that sends a message to the recipients that looks like the HTML Event Details page.
  
  In the Encoding field, select from the following formats:
  Western European (ISO-8859-1)
  Unicode (UTF-8)
  Japanese (ISO-2022-JP)
  Japanese (Shift_JIS)
  Japanese (EUC-JP)
  Chinese (GB18030)
  Chinese (Big5)
  Korean (EUC-KR)
- Run custom tool
  Select a custom tool from the Name dropdown list. Custom tools are created under the ToolsCustom ToolsNew Custom Tool option, and then select CMS tool.
- Assign
  Enter the name of the user to whom to assign the task. The event is assigned to this user when received. Setting this field allows you to perform searches assigned to this person.
- Forward as SNMP trap
  Enter a system name or IP address in the Name or IP field, and then click >> to add it to the Trap recipients box.
  Click Delete if you want to delete a recipient after selecting the name in the Trap recipients box. Use the up and down arrows to scroll to the recipient to delete.
- Write to system log
  On Windows NT and Windows XP systems, the event details are written to the Application Log, and the Source column of the Event Log is listed as HP SIM for the logged event. On Linux and HP-UX systems, the event details are logged to the system log, which is usually located in the file /var/log/messages on Linux and in /var/adm/syslog/syslog.log on HP-UX.
- Clear event
  Received events are cleared based on the criteria selected when task executes.
After you have made your selections, click Next. The Select time filter page appears.
Select the Use time filter checkbox if you want to use time filters, and then select an option from the dropdown list.
1. Click Manage Filters if you want to set user-defined filters.
2. Select the View time filter checkbox. A time filter window appears, showing the times selected.
  If the Use time filter checkbox is not selected, actions are triggered whenever the events matching the selected criteria are received.
  If the Use time filter checkbox is selected, actions are triggered only when they occur during the days and times specified by the selected time filter.
3. When you have entered the information, click Next to continue with the next step. The Review summary page appears. The task name, owner, time filters, event collections, system collections, and actions information appears. If a paging or e-mail option was selected, the modem and e-mail settings appear, along with buttons to change the settings.
(Optional) Click Edit modem settings to edit the modem settings, or click Edit email Settings to edit the SMTP settings.
Note: The event and system search criteria appear at the bottom of the page. This information can be extremely complex and long. Therefore, you might need to scroll down to view all criteria.
Click Finish to create the new task.

Configuring and executing discovery

Discovery is the process that HP SIM uses to find and identify the systems on your network and populate the database with that information. A system must first be discovered to collect data and track system status. There are two basic ways to discover new systems:

Discovering groups of systems The process that HP SIM uses to find and identify the group of systems on your network to poplulate the database with that information. A system must first be discovered to collect data and track system status. You can also discover systems using host file.
Discovering a single system The process that enables you to discover and add systems to the database.

Configuring and executing automatic discovery

Select OptionsDiscovery. The Discovery page appears.
In the For all automatic discoveries section, select Configure general settings. The General Settings for All Discoveries section appears.
Select from the following options:
- Automatically discover a system when an event is received from it. This option enables systems to be discovered when a trap or some other supported event is received by HP SIM. It uses the discovery filters and IP address exclusion ranges for additional filtering of these events. This option is not selected by default.
- Automatically discover a server when its Integrated Lights Out management processor is identified. This option adds servers indirectly discovered through the server's management processor, which are discovered when the server's iLO is discovered. The discovered servers are identified as Disabled on the system table view page. The only information displayed is the system serial number and the association to iLO and the enclosure. If the iLO is in a c-Class enclosure, the option, Discover systems in an enclosure when Onboard Administrator is discovered must be enabled.
- Discover systems in an enclosure when Onboard Administrator is discovered. This option adds systems identified by the Onboard Administrator even if the systems are not in the configured discovery range. This option is selected by default.
- Automatically discover VM guest(s) when the host is identified. This option adds all VM guest systems to the HP SIM database when the a VM host (HPVM VMWare ESX or Microsoft Hyper-V) system is discovered and identified. This option is selected by default.
  If this option is not selected when a VMWare ESX or Microsoft Hyper-V host is discovered, then guests are not discovered automatically. However, if one of its guests is moved to another before being discovered in HP SIM and if that guest is discovered later, it is associated with the old host. To avoid this, either the old host or new host must be identified before guest is discovered
  Note: For automatic identification of virtual machine guests running on a virtual machine host, the IP address of the guest is required. To acquire the IP address from WBEM Providers, VMWare tools must be installed on the virtual machine guests.
- Automatically discover other virtual partitions within the same vPar Monitor when one of the virtual partitions is identified. This option is selected by default.
- Automatically discover all nPars within the same complex when one of the nPars is identified. This option is selected by default.
In the Ping exclusion ranges, templates and/or hosts files field, specify the IP addresses, templates, or hosts files containing IP addresses to exclude from the automatic discovery process. You can also enter Simple or FQDN host names. However, you cannot enter a range of host names. This field applies to both range-pinging and event-based automatic discovery.
Important: When discovering clusters, the ping inclusion range must include the IP addresses of the cluster and the cluster members.
To select the types of systems HP SIM discovers, select Enable discovery filters.
In the section, Discover the following system types, select the type of systems to be discovered.
Important: When discovering clusters, you must include the server system type, so that the cluster members are not filtered out.
Note: This option is available only when you select Enable discovery filters.
In the Limit discovery to systems that meet the following criteria section, select from the following:
- Any system that matches the above filter
- All manageable systems (WBEM, SNMP, DMI, WMI, or HTTP support)
- Manageable systems with HP agents only
Note: The option, Limit discovery to systems which meet the following criteria is available only when you select Enable discovery filters.
To save settings, click OK, or to close the General Settings for All Discoveries section without saving changes, click Cancel.
If you click OK when discovery filters are enabled but have not selected any system types, the following error message appears:
You must make at least one system type selection when enabling filters.
Select System Automatic Discovery. Click one of the following options to schedule it for ongoing operations or to make other changes: Edit, Enable, View Task Results, or Run Now. If you would like to create other discovery tasks, click New.

Configuring a discovery task

To configure and execute a discovery, you must create a Discovery task. HP SIM ships includes one default discovery task (System Automatic Discovery). However, you can create a new discovery task to discover specific systems. For example, if you want to discover systems in a specific IP address range. You can set the task to run at scheduled times using specific ping inclusion ranges, templates, or hosts files.

To create a discovery task:

Select OptionsDiscovery. The Discovery page appears with the Automatic tab selected.
To create a new discovery task, click New. The New Discovery section appears.
Select from the following:
- Discover a group of systems (Default) Select this option to discover more than one system.
  (Required) In the Name field, enter a name for the task.
  In the Schedule section, select Automatically execute discovery every, and then enter how often the task runs. The default frequency is once per day. If you clear the Automatically execute discovery every option, the task is disabled after you create it.
  In the Ping inclusion ranges, system (hosts) names, templates, and/or hosts files field, specify the IP addresses. If you want to use this task to discover SMI-S storage systems, include the IP address of each SMI CIMOM. You can also enter Simple or FQDN host names. However, you cannot enter a range of host names. To use an existing hosts file, enter the hosts file name in the following format: $HostsFileName .
  If a hosts file is used, only systems that are accessible and match the discovery filter criteria are added to the database.
  Enter comments in the Comments field. Comments entered here are displayed in the discovery table on the Discovery page.
- Discover a single system Select this option to discover one system. Single system discovery address the system to the HP SIM database regardless of network reachability, unless it is not DNS resolvable.
  (Required) In the Name field, enter a name for the task.
  In the Schedule section, select Automatically execute discovery every, and then enter how often the task runs. The default frequency is once per day. If you clear the Automatically execute discovery every option, the task is disabled after you create it.
  Enter the system name or IP address in the Enter the system's name or IP address.
  Enter comments in the Comments field. Comments entered here are displayed in the discovery table on the Discovery page.
To set system credentials, click Credentials.
To create an associated Configure or Repair Agents task, click Configure/Repair.
To configure system types, click System Types.
NOTE: System Types is only available when you discover a single system.
To save the task, click Save, to run the task immediately, click Run Now, or to close the New Discovery section and not save any settings, click Cancel.
Note: If you have selected many systems, the following message appears, stating The automatic discovery task is configured with a large number of addresses: [NUM]. Click OK to continue, or click Cancel to change the IP address range.