system manager administering user profiles

Avaya Aura System Manager Administering User Profiles

2011. All rights reserved. 2

Course Outline

SMGRs place in the enterprise network

SMGRs permissions model

Creating new SMGR administrators

SMGR Roles

SMGR Groups

2011. All rights reserved.

By the end of this lesson, you should

3

Course Objectives

Know how to:

Create SMGR administrators

Apply existing roles to new users

Create new groups & add users to them

Create new roles and define privileges

Avaya Aura System Manager

Setting the Scene

Focus on the Enterprise

What part does SMGR play in

???


SMGR in Avaya Aura

Central Product Management

Administration

Configuration

Licensing

User Profile Management

Admins / communication users

Central User Profile

User info shared

RBAC Role Based Access Control


Unified

Communications

Avaya Aura user

Login

Name, Address, Contact

Service Profile

App Sequencing

CM / SM associations


Managing the Network

Avaya Aura User Profile

Unified information shared across multiple services

Application profile

Presence

CM Phone stations

9

Enterprise Administration

Toolwire Student Information

135.122.80.71 135.122.80.55

135.122.80.72 135.122.80.57

135.122.80.73 135.122.80.157

135.122.80.74 135.122.80.177

Student01

Student02

Student03

Student04

Training lab

Avaya Aura System Manager Using System Manager


Login https://ip/SMGR

admin

Tr@1ning

2011 All rights reserved.

Exercise:

14

Login to SMGR

Use your Classroom Info txt document to find your assigned SMGR IP

Launch browser, login using the URL:

https://serverIP/

Initial password:

admin / Tr@1ning


System Manager Home page

Current log

on info

Task oriented views


Navigation only shows options for current view

Tabs instead of long pages

State preserved as you navigate between tabs

System Manager Navigation


Tabbed Navigation

SMGR will automatically create tabs for pages visited

Tabs allow you to quickly navigate back and forth

Can have up to 5 open at

once (plus the Home tab)


Lets think about the enterprise

19


20


Administrators can be assigned to groups


Roles / Permissions

Users assigned roles

Roles group together different permissions

Permissions provide access to SMGR resources (UI)

Resources allow you to perform tasks!

User UI Resource

SMGR Users & Permissions


Resources

System Manager is controlled by its web console

By allocating permissions to admins, they unlock sections of the SMGR interface

SMGR Resources


Roles

Roles group together different permissions

Provides a convenient way of assigning permissions en masse


Roles

Role Y

The total permissions held by a user is the aggregate of all roles assigned to them

Role X


Roles in practice

SMGR home page for user with the System Administrator role

All links available

System

Administrator


Roles in practice

SMGR home page for user with the End User role

Many SMGR resources off limits (ghosted links)

End User


Makes sense?

Good time to create some users


Creating users is simple process

Once user is created, they can be assigned a role by the System Administrator

Creating Users How?


Creating SMGR Users

Login name must be of the form [email protected]

Password for SMGR login


Authentication Type

User Management User Creation

Corporate

Active Directory

LDAP

Local authentication

(If SMGR has been configured to speak to an LDAP backend)


Creating SMGR Users

SMGR admins do not need special communication profiles

Communication profiles are service oriented explored in Avaya Aura Session Manager training

Leave as-is


Creating SMGR Users

Multiple roles may be selected and assigned

Default Role = End User


Creating SMGR Users

When youre ready, save the user by clicking Commit


Exercise:

34

Create new user account

Define a new administrator user

the head sys admin

Provide:

Name

Password (use P@ssw0rd)

Login details

Assign System Administrator role

Test by logging in as your newly created user


Avaya Aura Session Manager

Avaya Aura Communication Manager

Avaya Aura Communication Manager Messaging

Avaya Aura Modular Messaging

Avaya Aura Presence Services

Avaya Aura Conferencing

Etc

Products adopted SMGR for management

SMGR Adoption


Avaya Aura Session Manager

Avaya Aura Communication Manager

Avaya Aura Communication Manager Messaging

Avaya Aura Modular Messaging

Avaya Aura Presence Services

Avaya Aura Conferencing

Etc

Products adopted SMGR for management

SMGR Adoption

MAS

CS 1000

SMGR also supports heritage Nortel services (UCM features)


1. Manage adopting services

(admin task)

2. Provision service for someone

(a communication user)

The communication profile details the Aura services a user is provisioned for

Describes the ways in which a user may be contacted

So what can this new admin user do?


Exercise:

38

View Communication Profile address types

Click to edit your newly created user

Expand Communication Profile

Consider the types of communication address

39


Group A Group B


Groups can be of different types

Bring collections of resources together for easier management

Groups of Users

Groups of Roles

Groups of Operations

SMGR Group Management


Having users in the same group as other resources does NOT automatically grant permissions to access those resources!

Generic groups of resources

I dont carry permission to

access operations just because Im in

the same group

I dont get automatically

assigned the roles that are in the same

group as me



However when assigning what resources a role has control over, you can select a group as a resource

Provides role with permissions over all items belonging to a group


Group Name: Team1

Group Type: Users

Role X

I have permission to view / add / delete / edit users, and the

resource that I have access to is Team 1


Creating a Group


Creating a Group

Navigate to group management

Enter a name, and select a group type


Creating a Group


Users?

Operations?

Creating a Group

Group membership can be selecting using a query


Complex Queries

Creating a Group

Build complex queries using multiple conditions


Group members can be specifically selected

Creating a Group

Once the membership type has been

committed, it cannot be edited later


Creating a group

When selecting resources for a group of type all:

click advanced search, then select the type to see available resources


Creating a Group Adding Users

Users may be added to a group when a group is being edited (see previous slides)

Or, a user can be added to a group by editing the user

Add several users to group at once

(User Management screen)

Add user individually

(Edit user profile)


Exercise:

51

Create a Group

Define a new group of users

This will group together the users responsible for logging

Create 2 new users (the logging team) and assign them to the logging group

(Dont worry too much about the role yet)

Group A


SMGR Roles Controlling access to resources

Roles give access to specific types of System Manager resources

Aggregate many permissions under one name


Role Assignation


SMGR Role

Default roles

- May be expanded when installing new products

Custom made role

- You may define a role for exactly what you need


Creating a Custom Role


Defining a Role

A role can provide permission to access 1 or more resource type


Users

Operations

Apply filters for easier searching

Defining a Role

Once a resource type is chosen, you can select which resources to add


E.g., When adding permission to view, edit, or delete users:

The resource type will users

The resources themselves will be specific users

Adam, Bob, Carol, Deborah (for example)

E.g., When adding permission to view specific menu items:

The resources type will be operations

The resources correspond to SMGR links

Defining a Role


Defining a Role Attributes

Attributes allow you to drill down either further

You can select precisely the attributes of a user profile that you wish to grant permissions for


Defining a Role Attributes

Not all resource types have attributes

E.g. operations


And since we mentioned operations

There are lots!

Given the mapping to URIs in the web console, it indicates how fine grained the level of access control can be


Role Resource Types?

Key types


Exercise:

64

Create a new role

Define a role

This role will carry privileges relating accessing logs and alarms

Add all operations with the term event in them

Hint: use a filter!

Apply the role to the newly created users

Test!

Log in as user with only the new role

Group B


Exercise:

65

Create another role

Define another role

This role will carry privileges relating to user creation and management

Once the role has been created, create 3 new users

This admin team will oversee Human Resources (HR) assign them the newly created role

Extension: If you have time, also create a group for the HR team, and assign these newly created users

Group B


Deleting Users

Deleting Users required 2 confirmations!

#1


Deleting Users

Deleting Users required 2 confirmations!

#2

68


Group A Group B

Susan is getting

married, and is

changing her job I must update her details

and roles

And Daniel is leaving

the company Ill need to delete his profile


Exercise:

69

Modify User

One of the HR staff has decided to get married

Change their last name to smith and update their postal address (you choose the details)

She has also decided to switch jobs remove the HR user management role previously assigned her

Also delete one user

2011. All rights reserved.

By the end of this lesson, you should

70

Course Objectives

Know how to:

Create SMGR administrators

Apply existing roles to new users

Create new groups & add users to them

Create new roles and define privileges

Avaya Aura System Manager Administering User Profiles

Avaya Aura System Manager Advanced Administration


Course Outline

Backing up / restoring from backup

Discovering inventory in the Network

Deploying product licenses

Bulk import

Bulk export

Configuring SMGR high availability (HA)


Course Objectives

Know how to:

Backup SMGR data

Use SMGR to discover inventory in the Avaya network

Use SMGR as a WebLM server

Manage data in bulk

Configure SMGR for HA


Backing Up SMGR Data


Information held by Avaya Aura SMGR

Product Management Data

Element definitions

Configuration

Routing Policies, endpoint profiles

User Profile Data

Admins / communication users

User profiles, addresses, roles etc.

Communication profiles

Application sequencing


Backing up SMGR Information


A backup can be created on the local file system

Or copied to a remote Linux server


backup

Only specify the filename, not the path


When backing up to a remote server (safer), you will need the remote server SSH login details


Specify the full path


Backups can be performed when needed (now)

And / or scheduled to take in the future (recurring?)

Backing up SMGR Information Scheduling


Perform a local backup

1. Create a local backup of your SMGR data - now

2. Also schedule a regular maintenance backup:

To take place daily

At midnight

Starting tomorrow

Ending after 1 month


When the backup completes, SMGR will summarize the details

Viewing the backup

SSH

SSH into the SMGR VA to view the backup

admin/admin


Locate your backup

SSH into your SMGR

Use the SMGR IP (from your browser URL)

Username / password: admin / admin

Navigate to the location

Default is: /var/avaya/backup/manual

Take a look!


When needed, you can restore SMGR config

Restoring from backup

SMGR will remember previous backups


Restoring from backup

Be warned that this is a dangerous operation

It will wipe existing configuration in favor of the settings found in the backup


Restore from backup

Notice that your SMGR already has a number of users, domains & SIP elements defined

Delete any number of these

Restore your earlier backup

This will take 5 minutes or so

When SMGR becomes available again, check that the deleted elements have indeed been restored


Perform a remote backup

Work with a buddy

Backup to your buddys /tmp directory

Name your backup /tmp/NAMEbackup (use your own name)

SSH into your buddys SMGR, and locate your backup

admin / admin

Whats different about the format of the remote backup?


Inventory Discovery


The IT network


SMGR Service Discovery

BSM

Discoverable


SMGR Service Discovery

???


Inventory Auto Discovery Process

1. Configure SNMP Profile (s)

2. Define Subnet (s)

3. Enter CM details

4. Run discovery profile

135.64.0.*

SNMP

SNMP

NB: SNMP service is not

enabled by default on SM.

Requires running

setup_snmp on target SM



SMGR 6.0 supports automatic element discovery



SNMP access details

SNMP V3



Subnet



CM access details



IP currently being scanned

Devices discovered


0

Discover the CM in the network

Create a discovery configuration

Use SNMP V1

Read community: public

Write community: public

Define the subnet youre interested in

Use the IP address provided by the instructor

Use a subnet of 255.255.255.0

Enter CM access details

init / itsgrand3

Monitor the discovery process


Licensing Other Services


2

SMGR as License Manager

Some activities require permission!

Have to have a license

Avaya products are just the same


3

SMGR Integrated WebLM Server

Must have access to an Avaya WebLM Server before they can start properly

You have a

license for me?

License for

me?

Full Web LM

Server Integrated


4

SMGR Integrated WebLM Server

License file is bound to specific SMGR

Contains reference to MAC (unique ID)

Licenses are not portable!


5

Deploying Licenses


6

License you SMGR

Apply a license to your SMGR

Use the license.xml on your XP desktop

Check that POM now shows as a licensed product

Menu on the left

NB: We do not have a POM in the training lab


Handling Data in bulk


8

Helps prevent a bad day for the Admin!


9

Use Cases: Initial Provisioning

Initially provisioning an enterprise

Moving lots of information into a new Avaya Aura installation

Professional Services

Supposes data must

already exist

somewhere!


0

Use Cases: Large Data modifications

Modifying large sets of data

quickly


1

Bulk Import What can be imported?

User Profiles (Including Communication Profile)

Application Sequencing

Personal Contact Lists

Shared Addresses

Presence Access Control Lists (ACL)

SMGR Roles

Element Details

Etc.


2

Import Process

SMGR Data

Represented as XML

Read by SMGR and added to the DB

SMGR doesnt say how you do this only what format the data should be in


3

Performance

Bulk Import supports 60 records / minute

100,000 Users spread across multiple files

5,000 Users in a single 600Mb file

Initial provisioning of SMGR may involve a large dataset


4

Failed to import

Any records that fail to import should be provided for download by the UI

Records can then be modified and re-imported

Failed records?


5

Importing User data

SMGR supports both full and partial User data importing

Can update existing users details E.g. Add a contact

Communication

Profile

Contacts

Address

Roles

Contacts

Roles


6

Importing: User data

Done through the SMGR web interface


7


3 Sections

1. Select import XML

file

2. Configure Import

handling

???


8

Import a user record

Locate the importUser.xml file on your desktop

View the contents of the file

Import the user into your SMGR configuration

Import immediately (dont schedule)

Choose to continue processing other records on failure

If the user already exists, select to overwrite with the new one

Communication

Profile

Contacts

Address

Roles


9

On processing a record

that cannot be imported

will SMGR rollback?


0


If you are re-importing data, you probably dont want to touch successfully imported User data


1


3. Choose immediate

or scheduled import


2

Linux based testing tool for generating large datasets

Generates XML from simple input file

Download from:

http://taco.dr.avaya.com/wiki/index.php/Session_Man

ager_Bulk_Import_XML_Generator_R6.0_S34

./genxml.sh [-o ] []

Optional if omitted, output

thrown to stdout

Bulk Import XML Generator


3

Bulk Import XML Generator Linux based testing tool for generating large datasets


Download from:





thrown to stdout


4

Linux based testing tool for generating large datasets


Download from:





thrown to stdout

???

Bulk Import XML Generator


5

Existing CM Association

(|-), , , ,

[], [],

LOCATION=

New CM Association

(|-), , , ,

[], [],

LOCATION= template=

No CM Association

(|-), , , ,

[], [] LOCATION=

Bulk Import XML Generator Input file format


6


5500-6500, 123456, avaya.com, nearEndSm, origSeq1, termSeq1, my-

cm.dr.avaya.com LOCATION=Denver

New CM Association


cm.dr.avaya.com asm2=secondarySm bsm=branchSm

LOCATION=Denver

No CM Association

5386000, 123456, avaya.com, nearEndSm, origSeq1, termSeq1

LOCATION=Denver



7




New CM Association


cm.dr.avaya.com asm2=secondarySm bsm=branchSm

LOCATION=Denver

No CM Association

5386000, 123456, avaya.com, nearEndSm, origSeq1, termSeq1

LOCATION=Denver

Range of endpoints

Vs single endpoint



8




SMs, CMs, Locations,

Domains & App

sequences must have

already been

administered before

attempting to import



9


Passwords can be supplied in the user data XML

These can be plaintext, or you can encrypt them and SMGR will decrypt the passwords

password1

%z[323*&3

um_bulkimport-encryptUtil.zip

um_bulkimport-encryptUtil.sh import

Usage:

Utility (Part of SMGR SDK)


0

Importing: Roles & Groups

In similar fashion, one can import roles

Note: No

functionality to

schedule Group

import yet


1

Miscellaneous

Login name treated as unique identifier

As such, loginname cannot be updated by bulk import

If importing users, roles & contacts:

1. Roles

2. Public Contacts | Shared Contacts

2. Users

If importing Presence ACL:

1. Users

2. Presence Data


2

Configuring Default Import Options


3

Configuring Default Import Options

0 = Skip

1 = Merge

2 = Replace

3 = Delete


4


5

SMGR Export Data

Achieved via CLI

Tool exportUpmUsers.sh must be executed from SMGR machine

1. Launch Putty & SSH in

using:

admin / admin

2. Switch to root

# su root (enter p/w root01)

3. Navigate to the

directory shown


6

SMGR Export Data

Inside the config directory, youll find the bulkexportconfig.properties file

Use this to configure:

Set number of records to be exported

File size

Export file destination


7

Perform Export

Can set options via the CL

u : SMGR Username authorized to export

p : Password

f : Export file name prefix

r : Records per file

d : Destination Folder

s : Record starting index

e : End offset index (number of records)

Optional Parameters


8

Export your SMGR user data

Export all SMGR user data

Unzip, and inspect the format of the XML data

# unzip

# cat

Compare to the XML files from the import exercise

Extension:

If you find yourself waiting, experiment with the settings in the bulkexportconfig.properties file

Try modifying your exported data, and using it to import new users into SMGR

Remember the login name

Field must be unique

Communication

Profile

Contacts

Address

Roles


9

Perform Export

You can also schedule an export to be performed

Script regular data exports?

t : Set export scheduled time

E.g:

exportUpmUsers.sh -t

2010:05:01:12:00:00

YYYY:MM:DD:HH:MM:SS

??? 1st of May 2010, at Midday


0

Perform Export

Zip file is created containing the export


1


2

Using the Exported Data

Exported data file can be used in GUI import

By default, data is

suitable for

complete import


3

Using the Exported Data

XML File can be amended for use in partial import


4

Demo

Modify Exported Data

Perform Partial Import


5

Exporting SMGR Roles

Separate CLI utility for exporting roles


6

Exporting SIP Entities

Domains, Locations, Adaptations, SIP Entities, Entity Links, Time Ranges, Routing Policies etc. can all be exported

Click the More Actions button to find option


7

Export your SMGR routing info

Export one or more collections of routing info:

Domain

Locations

Routing Policies

NB:

Remember that when re-importing something like a routing policy, it will contain references to SIP entities, domains, dial patterns and so on

These will need to have been re-imported first

Communication

Profile

Contacts

Address

Roles


High Availability


0

What is High Availability?

High Availability (HA) is the ability to access a service when you need it

Even in the case where an internal error has occurred

End users (SMGR admins) should not need to know!


1

SMGR High Availability

How does SMGR deliver HA?

2 SMGR nodes

Arranged in active node / backup node configuration

When the active node fails, the backup node automatically takes over


2

SMGR High Availability & System Platform

SMGR HA is facilitated by the Avaya Aura System Platform

Its really System Platform HA, but SMGR benefits by being a VA deployed to SP

Some things in life are free!

XEN Hypervisor - DOM-0

C-DOM

CentOS

SP

Utilities

Proc HDD RAM NIC


3


C-DOM

CentOS

SP

Utilities

SMGR Template

RHEL

System

Manager

Proc HDD RAM NIC

Active SMGR on System Platform


C-DOM

CentOS

SP

Utilities

SMGR Template

RHEL

System

Manager

Proc HDD RAM NIC

Remote SMGR node

(name for the backup)



4

Replicated VA machine state consists of:

Everything saved / committed

On the hard disk

In the SMGR database



5


Anything not in committed will not have been saved to disk, & will be lost in the case of a failover

VA must boot

when it fails over


6

High Availability Extent of impact

Admin will lose work-in-progress

Service outage will last as long as it takes to:

1. Detect active node is down

2. Boot the remote node VA (triggered automatically)


7


C-DOM

CentOS

SP

Utilities

Proc HDD RAM NIC


C-DOM

CentOS

SP

Utilities

SMGR Template

RHEL

System

Manager

Proc HDD RAM NIC

SMGR Template

RHEL

System

Manager


SMGR already installed

on one node

Once HA is configured, the SMGR template is replicated to the remote node


8


Proc HDD RAM NIC

Active SMGR on System Platform


Proc HDD RAM NIC

Remote SMGR on System Platform

C-DOM

CentOS

SP

Utilities

SMGR Template

RHEL

System

Manager

C-DOM

CentOS

SP

Utilities

SMGR Template

RHEL

System

Manager

192.168.1.102

192.168.1.101

192.168.1.102

192.168.1.167

SMGR VAs share the same IP configuration

- Problem??



9


Proc HDD RAM NIC


Proc HDD RAM NIC

C-DOM

CentOS

SP

Utilities

SMGR Template

RHEL 5.3

System

Manager

C-DOM

CentOS

SP

Utilities

SMGR Template

RHEL 5.3

System

Manager

192.168.1.101 192.168.1.101

???


0

Active Node definition:

Replicates its state to the remote node

Has the SMGR VA turned on

So what decides the active node?

Nodes score themselves

Highest score = active node

If a node cannot contact the other:

The uncontactable node is assumed down

The surving node becomes active (if it isnt already)

I am alive, have network connection, can contact

the gateway

Score =

6.0


1

SMGR High Availability Configuration

Crossover cable

Enterprise Network 6.0

3.1

Preferred Configuration


2

?

Geographical H/A isnt supported by this setup

Why?


3



System Platform Server fitted

with (at least) dual port NIC


4


Direct crossover connection allows high speed connection between SPs

Avoids large SP payloads having to travel over the regular network

SP & SMGR VM state copied from active



5



Crossover cable

Enterprise Network


6



Crossover cable

Enterprise Network

Crossover cable is preferred, not mandatory

Replication will happen over the regular network


7


admin

admin01

The Toolwire Internet Explorer contains a shortcut to the SP Web Console in Favorites


8

High Availability

Configure SMGR failover from within

the System Platform webconsole


9

High Availability

Remote node

Enter IP & login details for the remote node

The SP on which you are logged in is preferred by default


0

Configure SMGR for HA

Work with a buddy

Decide which SMGR will be active, which is remote

Log into SP webconsole on the active node

Configure failover using the details of the remote node

The initial replication may take some minutes to complete

Test by logging into the SMGR using the IP of the active node

Kill the active node VA, then attempt to access the SMGR IP again

Remote node should kick in, allowing you to use SMGR

Avaya Aura System Manager Advanced Administration

Thank you!

system manager administering user profiles

Documents