01
PERMISSION GRANULARITYGRANULAR PERMISSION REQUIREMENTS IN
CORPORATE ENVIRONMENTS

NOC Team role

Network Administartor role

Access to Dashboards and maps

Access to Dashboards and Maps

Restrict unnecessary UI elements

Access to Configuration

Restrict API accessRestrict API accessRestrict configuration

Restrict unnecessary UI elements

Restrict closing problems

ZABBIX SUMMIT ONLINE / 2020

PERMISSIONS GRANULARITYIn multi-tenant environments granular permission play a very important role
The UI should be as intuitive as possible for different roles and tenants
Each tenant can have different monitoring requirements
Restricted access to elements per tenant
Isolation between tenants

ZABBIX SUMMIT ONLINE / 2020

ROLES AND MULTI-TENANCY

02
USER ROLES IN 5.2

IMPLEMENTING A MORE GRANULAR PERMISSION
LOGIC WITH USER ROLESStarting from 5.2 users will have a User role assigned to them. Depending on the role, acorresponding User type will also be assigned:

ZABBIX SUMMIT ONLINE / 2020

USER ROLE

User types are not being removed
A role is linked to one of the 3 user types

ZABBIX SUMMIT ONLINE / 2020

USER TYPESZABBIX SUMMIT ONLINE / 2020

USER TYPES
Frontend sections restricted by user type
Superadmin:

Admin:User:Available in Administration – User roles
By default this section contains 4 preconfigured user roles
Super admin role
Admin role
User role
Guest role

ZABBIX SUMMIT ONLINE / 2020

DEFAULT USER ROLESDefault Super admin role is static – users cannot modify this role

This is because at least a single Super admin role MUST exist in your environment
Newly created roles of type Super admin can be modified

ZABBIX SUMMIT ONLINE / 2020

SUPER ADMIN ROLE

Each of the default roles contains the maximum allowed permissions per user type:ZABBIX SUMMIT ONLINE / 2020

USER ROLES SECTION

Access to UI elements for each role can be restricted
NOC user role that has access only to Dashobards and maps

ZABBIX SUMMIT ONLINE / 2020

UI ELEMENT RESTRICTION

Access to UI elements for each role can be restricted
NOC user role that has access only to Dashobards and maps

ZABBIX SUMMIT ONLINE / 2020

UI ELEMENT RESTRICTION

Note, that User Group access to Host Group still have to be properly assigned!

ZABBIX SUMMIT ONLINE / 2020

HOST GROUP PERMISIONS

API Access can also be restricted for each role
Used when creating API specific user roles

ZABBIX SUMMIT ONLINE / 2020

ACCESS TO API

Ability to implement API method Allow or Deny lists
Useful in envrionments with many administrative roles
For example - create a user that can only use get methods

ZABBIX SUMMIT ONLINE / 2020

API METHOD RESTRICTIONIf the method execution is not permitted, «no permission to call method» error will bedisplayed:{"jsonrpc": "2.0","error": {"code": -32602,"message": "Invalid params.","data": "No permissions to call \"host.create\"."},"id": 1}ZABBIX SUMMIT ONLINE / 2020

API METHOD RESTRICTION EXAMPLEEach role can have a specific list of actions that it can perform with respect to the role

User type.
User type: User

User type: Admin

ZABBIX SUMMIT ONLINE / 2020

ACCESS TO ACTIONS

Restricting the role

Result in the frontend

ZABBIX SUMMIT ONLINE / 2020

RESTRICTING ACTIONS EXAMPLE (1)Unrestricted role

Result in the frontend

ZABBIX SUMMIT ONLINE / 2020

RESTRICTING ACTIONS EXAMPLE (2)Default access for new elements of different types can be enabled or disabled for userroles:

If enabled, whenever a new element is added, the user belonging to this role willautomatically have access to it.

ZABBIX SUMMIT ONLINE / 2020

DEFAULT ACCESSAfter migration to 5.2, the users will have the pre-created Admin/User/Super admin roles

assigned to them:

ZABBIX SUMMIT ONLINE / 2020

ROLE ASSIGNMENT POST-UPGRADE

03
EXAMPLE USE CASESHOW ROLES CAN BE USED IN DIFFERENTENVIRONMENTS

A role that has no ability to create or modify any elements
Read only access to dashboards
Read only access to problems
No access to API
No permissions to execute frontend scripts

ZABBIX SUMMIT ONLINE / 2020

READ ONLY ROLE

First off, let’s decide on User type and sections, which this role should have access toZABBIX SUMMIT ONLINE / 2020

READ ONLY ROLE

We also need to restrict access to actions, API and decide on the new UI element andmodule permission logic

ZABBIX SUMMIT ONLINE / 2020

READ ONLY ROLE

No option to create or edit a dashboard
Access to dashboards is granted and evaluated based on Dashboard sharing options
and User group – Host group relationship.

ZABBIX SUMMIT ONLINE / 2020

READ ONLY ROLE

Restricted UI elements hidden
Acknowledge button is not clickable for this RoleZABBIX SUMMIT ONLINE / 2020

READ ONLY ROLE

A Superadmin type role that has no access to User configuration and General Zabbix

settings

Ability to Create and manage proxies
Ability to define media types and frontend scripts
Access to queue section to see the Zabbix server and proxy health status

ZABBIX SUMMIT ONLINE / 2020

RESTRICT ACCESSTO ADMINISTRATION SECTIONSUser type – Super admin. General and User sections are restricted for this role

ZABBIX SUMMIT ONLINE / 2020

RESTRICT ACCESSTO ADMINISTRATION SECTIONS

Restricted Administration elements are hidden
The Monitoring Super admin user still has the ability to create new Proxies, Media Types, Scripts
and has access to the Queue section

ZABBIX SUMMIT ONLINE / 2020

RESTRICT ACCESSTO ADMINISTRATION SECTIONS

Zabbix Dashboards and maps are used by multiple tenants to provide monitoring data
Read only access to dashboards
Read only access to maps
No access to API
No access to configuration
Isolation per tenant

ZABBIX SUMMIT ONLINE / 2020

ROLES FOR MULTI-TENANT ENVIRONMENTS

We will be creating a user type role with very limited access to UIZABBIX SUMMIT ONLINE / 2020

ROLES FOR MULTI-TENANT ENVIRONMENTS

Let’s use tag-based permissions to isolate our Hosts per tenant

ZABBIX SUMMIT ONLINE / 2020

ROLES FOR MULTI-TENANT ENVIRONMENTS

Don’t forget to tag your problems! This time I’m doing the tagging on the host level:

ZABBIX SUMMIT ONLINE / 2020

ROLES FOR MULTI-TENANT ENVIRONMENTS

The UI is restricted only to the required monitoring sections
Tag-based permision ensure that we are seeing problems related to our tenant

ZABBIX SUMMIT ONLINE / 2020

ROLES FOR MULTI-TENANT ENVIRONMENTS

Implementing user roles can help you manage your Zabbix environment!
Improve auditing

Restrict API accessRestrict configuration

Remove unwanted UI elements

ZABBIX SUMMIT ONLINE / 2020

ROLES – WHAT’S NEXT?

Thank you!