How to configure role-based access control (RBAC) for a connector in Veritas SaaS Backup (VSB)

Description

Role-based access control (RBAC) allows to manage users access on specific connectors in Veritas SaaS Backup (VSB) 

Managing access to a connector

Each new connector is by default accessible only to specific user roles – Master Administrators and Audit users. If a connector is created by a Backup Administrator, it will be accessible to the Backup Administrator who created the connector..

Using the RBAC configuration, users with the proper permissions can grant access to the connector to other users, who can perform only the actions of their assigned roles. 

Only two user roles have permissions to manage access:

• Master Administrator can manage access for all connectors
• Backup Administrator can manage access only for those connectors that he has access to

To manage access:

Before you begin, make sure you have created the necessary users. A step-by-step guide, can be found here.

Note: In release Q1 2020, the User Administrator user role was renamed to Master Administrator, and a new role – the Backup Administrator – was added. For a list of available user roles, click here.

Steps

1. Select the gear icon to the right of the connector, and then select Configure connector.

2. Select the lock icon at the bottom of the connector configuration window.

3. In the Access configuration box, select users to grant access to and deselect users to revoke access from.

Note: It is not possible to change the access for a Master Administrator, SSO Admin, or Audit user:

• Master Administrators always have universal access to all connectors to prevent getting locked out of a connector. 
• Audit users always have access to the audit logs for each connector, never to a connector's configurations or data.
• SSO Admins have access only to SSO configurations, never to a connector's configuration or data.

Accordingly, these roles are faded in the list and it is not possible to select or deselect these check boxes.

4. Select Save to apply your changes. Your settings will immediately come into effect regardless of whether you select Save or Close on the main Configuration window.

What happens when a user with restricted access signs into VSB?

When a user with restricted access signs in, unavailable connectors will be faded / grayed out, and no connector details such as connector status or backup size will be visible. The user will not be able to open the connector configurations, browse connector data, or take actions such as initiate a restore.

Changing a user role

The system remembers which connectors a user had access to when assigned with certain user roles. For example, let’s say a user is assigned the Standard Support user role and is given access to one specific connector. Then the user is assigned the SSO user role, which means he has access to no connectors. But now if he is re-assigned the Standard Support user role – or if he is assigned the Backup Admin, Full Support, or Standard Support user role – he will automatically have access again to the above-mentioned connector.