Role creation

The roles that you need to create depend on your business requirements. However, there are a number of roles that are commonly required:

• Administrator Role — This role has unrestricted access to all accounts and all Management Console functionality. Assign the Default role to Account Managers that should have administrative privileges.

• On-Boarding role: Most Service Providers separate the business functions of creating and provisioning accounts from the day-to-day help-desk type of support functions provided to accounts. These functions typically include creating or updating accounts, adding or modifying services, and allocating inventory (tokens and capacity). If your Subscriber accounts manage their own service, this role may also be responsible for creating Operators.

  

  Note

  An Operator is an “Administrative” account in the Subscriber’s Virtual Server. With this account, the Operator can log in to the Management Console and have access to all management functionality for their server. If the account type is Virtual Service Provider, the same user will have administrative privileges to the Service Provider tabs for their account.

  This role may be combined with group management to restrict various members of the On-Boarding role to managing specific groups of Subscribers.

• Help desk role: This role is generally performed by technical support personnel who must have access to a Subscriber’s Virtual Server, from which they can perform functions such as issuing or revoking tokens, adding users, and resolving authentication issues.

  

  Note

  The management functionality available in a Subscriber’s Virtual Server is controlled by the role and scope configured for External Operators. This means that while the Help Desk role may have access to a Subscriber’s Virtual Server, the functions they can perform may vary, depending on the role/scope configured for the External Operator in each Subscriber’s Virtual Server.

  Essentially, the aim of this role is to allow access to a range of subscriber Virtual Servers based on scope, but to disallow access to most other functionality available in the Dashboard, On-Boarding, and Administration tabs, such as the ability to add, modify, or remove Account Managers. You can combine this role with group management to restrict various members of the Help Desk role to managing specific groups of Subscribers.

• Audit and reporting role: This role is essentially read-only, allowing access to view information displayed in the Dashboard and On-Boarding tabs, and certain functions on the Administration tab, including generating and running usage, audit, inventory, and billing reports. Depending upon your business requirements, you can limit this role to running a specific set of reports or may be allowed to create a range of reports. This role is generally not allowed to access any Subscriber Virtual Servers.

• Sales representative role: This role provides Sales Representatives with access to the SAS console for the purposes of demonstration and creating evaluation accounts, while denying access to production accounts. This role may be combined with group management to restrict each or various members of this role to managing specific groups of evaluation accounts.

  

  Note

  By making Sales Managers members of this role but with access to a range of Management Groups, they will have the ability to view and monitor the activity of all members of this role.

Role configuration

Account Manager role

The default Account Manager role provides unrestricted access to all Service Provider tabs, modules within tabs, and actions within modules, and allows access to all Management Groups. Access to the Virtual Servers tab means that this role is able to access the Virtual Servers for every Subscriber account.

On-Boarding role

This role is responsible for and allows access to the following functions:

• Dashboard tab: View, acknowledge, close, and remove alerts.

• On-Boarding tab: Add, modify, suspend, and remove subscriber accounts.

• Virtual Servers tab: Access to this tab is denied.

• Administration tab: Access is limited to running and viewing preconfigured reports. Access to all other modules on this tab is denied.

• Enabling, disabling, or modifying the Subscribers service, including start or stop dates and number of allowed Auth Nodes.

• Allocating and deallocating inventory, including tokens, capacity, and SMS credits.

• Adding, modifying, and deleting Subscriber accounts.

• Adding, modifying, and deleting Auth Nodes.

• Adding, modifying, and deleting additional contacts.

• Adding, modifying, and deleting Delegation Codes.

Example of On-Boarding role settings

• Clearing the Virtual Servers option hides this tab and denies access to all Virtual Servers.

• In the Administration tab section, clearing the Access options as shown hides and denies access to the Roles Management, Groups Management, Accounts Manager Management, Available Reports, Role Alert Management, External Alerts Recipients, Alert Event Thresholds, Customize References, Account Role Provisioning Rules, and Auto Remove modules and functions.

• Service Providers that manage all aspects of their clients' services and Virtual Servers may opt to remove access to the Create Operator, Auth Nodes, and Delegation Nodes functions.

  • The Create Operator function is relevant only when the subscriber manages their own Virtual Server.

  • The Auth Nodes module is used to enable or disable RADIUS clients, such as Subscriber VPNs. Often, this functionality is not part of business functions and is offloaded to the help desk or the subscriber. Auth node configuration is available within each Subscriber’s Virtual Servers and help desk, or the Subscriber can manage this functionality without having access to the On-Boarding module.

  • Delegation codes are used to add third-party Subscriber accounts, such as those created by an intermediary Service Provider (for example, a grandchild account), to the Virtual Servers tab.

Help desk role

This role is responsible for providing technical assistance to subscribers, and typically involves functions such as sorting authentication issues, configuring Auth Nodes, creating auto-provisioning and pre-authentication rules, configuring custom reports, and possibly managing users and issuing tokens.

All of the above functions are conducted from within the Subscriber’s Virtual Servers via the Virtual Servers tab. The actual functionality available to this role is determined by the role associated with the External Operator account in each Subscriber’s Virtual Servers.

In general, the help desk tasks are separate from On-Boarding tasks and administrative functions, and therefore access to the On-Boarding tab and the Administration tab is typically restricted.

Example of help desk role settings

• Clearing the Edit, Delete, and Add options for all modules on the On-Boarding tab allows the help desk to view customer information such as service start or stop, number of Auth Nodes, and all other selected modules but denies the ability to modify any settings.

• Clearing the Create Account option prevents the help desk role from adding subscriber accounts.

• Clearing the various Administration options restricts this role to running and viewing reports to which they are entitled.

• Access to the Auth Nodes and Create Operator modules are not required. Similar functionality can be accessed via the Subscriber’s Virtual Servers.

Audit role

This role provides view-only access to all tabs and modules, and allows members to run and view reports. Because customized reports can be restricted to intended recipients, it is not normally necessary to divide this role into separate audit and reporting roles.

Using intended recipients, members of the same role may be denied access to reports that do not coincide with their function, such as billing reports and the audit function.

Example of the audit role page and applicable settings

• Clearing all Edit, Delete, and Add options restricts this role to view-only access.

• Clearing the Virtual Servers tab option prevents access to Subscriber Virtual Servers.

• Enabling the View Log options allows this role to view detail related to up to the last five configuration changes applied in each module without running reports.

• This role is able to run and view reports to which they are entitled.

Audit and reporting role example

Sales representative role

The purpose of this role is to provide sales representatives with the ability to demonstrate the functionality of the SAS consoles and to onboard accounts that want to evaluate the service. The important aspect of this role is to combine it with management groups, generally by restricting each member of the role to a specific group. By doing so, all Subscriber evaluation accounts created by a member are automatically created in the specific group, effectively hiding them from any other role or member that does not have the management group in their scope.

Typically, upon converting an evaluation account to production, it is moved from the representatives management group to a production group, denying the sales representative any further access to the account. Likewise, a sales manager with all evaluation management groups in their scope is able to monitor the activity of each sales representative and each Subscriber evaluation account.

Note that alerts can be used to automatically advise members of various roles or events, such as adding or modifying a Subscriber account, changes to services, and upcoming events, such as an evaluation period expiration or service period expiration.

Example of sales representative role settings

• Only access to the Administration tab and therefore all modules and functions therein are denied.

• It is critical that scope be applied when elevating a person to the sales representative role, limiting each individual to a reduced number of management groups. In particular, they should always be denied access to the default management group and any production management groups.

Sales representative role example