Table Of Contents

Access Control

User Control

Device Control

PAK Control

Rules of Control

Access Control

---

This appendix provides information about the following levels of access control in Cisco License Manager, as well as the rules of control:

•User Control

•Device Control

•PAK Control

•Rules of Control

User Control

Cisco License Manager supports the following role-based user management for granular access to resources and features:

•Administrator

•Inventory management

•PAK management

•License management

•Report management

The following table provides a matrix of operations each role can perform. If an API is not listed in this table, it is open to all users.

Operation	Administrator	Inventory Management	PAK Management	License Management	Report Management
createUser	X
deleteUser	X
addUserToDeviceAccessList	X
removeUserFromDeviceAccessList	X
removeAccessListFromDevice	X
addUserToGroupAccessList	X
removeUserFromGroupAccessList	X
removeAccessListFromGroup	X
addUserToPAKAccessList1	X	X	X
removeUserFromPAKAccessList1	X	X	X
asynDiscoverDevices	X
asynPollDeviceLicenseInfo2	X	X
createDevicesByIPAddr	X
reCreateDevicesByIPAddr	X
createDevicesByUDI	X
checkDeviceConnection 2	X	X	X	X	X
readDevices2	X	X	X	X	X
writeDevices2	X	X
deleteDevices	X
createDeviceGroup	X	X
renameDeviceGroup	X	X
deleteDeviceGroup	X	X
addDevicesToGroup	X	X
removeDeviceFromGroup	X	X
asyncDownloadPAKInfo1	X	X	X
createPAKs	X	X	X
readPAKs1,3	X	X	X	X	X
writePAKs1	X	X	X
deletePAKs1	X	X	X
asyncObtainLicense2	X	X	X	X
writeLicenses	X	X	X	X
getLicensesOnDevice2	X	X	X	X
asyncDeployLicenses2	X	X	X	X
rehostLicenses	X	X	X	X
resendLicense	X	X	X	X
reObtainLicense2	X	X	X	X
asyncAnnotateLicense	X	X	X	X
initRehostLicenses	X	X	X	X
revokeLicenseFroRehost	X	X	X	X
obtainLicenseForRehost	X	X	X	X
getRehostInfo	X	X	X	X
writeLicenseLines	X	X	X	X
getLicenseLinesOnDevice2	X	X	X	X
asyncDeployLicenseLines2	X	X	X	X
asyncAnnotateLicensesLine	X	X	X	X
listExpiredLicenseLines	X	X	X	X
createFolder	X	X	X	X
renameFolder	X	X	X	X
deleteFolder	X	X	X	X
addPAKsToFolder	X	X	X	X
removePAKsFromFolder	X	X	X	X
generateReport	X	X	X	X	X
readReport	X	X	X	X	X

1 Subject to PAK access control. 2 Subject to device and device group access control. 3 User in PAK Management or higher roles can see PAK ID in plain text. Users in License Managmeent and lower roles can only see the last few letters/digits of PAK ID.

Device Control

An access list is associated with each device and each device group. An access list contains a list of usernames that are allowed to access a particular device or device groups. If no access list exists, the device or device group is open to all users. Only users in an Administrator role can modify the access list.

PAK Control

Each PAK has a owner and also an access list associated with it. PAK owner is the creator of the PAK. Only the PAK owner or users in an Administrator role can modify PAK access list.

Rules of Control

For users in an Administrator role:

•A user in an Administrator role can perform all operations, no matter whether his/her name is in the access list or not.

For users not in an Administrator role:

•Only PAK owner and users in its access list can perform operations on PAK object.

•If both device access list and the access list of its parent group(s) are empty, users in an Inventory Management role can perform operations on this device.

•If a device access list or the access lists of the device group(s) that contain this device are not empty, only users listed in the device or group access list can operate on the device.