Installation Manual

but grant different rights. Sometimes it is useful to assign generic rights to the lesser role and
include the LOM administrators in that role, as well as the administrative role.
Figure 6 shows an example in which the Admin user gains the Login privilege from the User role,
and advanced privileges are assigned through the Admin role.
Figure 6 Multiple roles (overlapping)
Admin User
User
Admin Role
User Role
Server
Virtual Power and Reset and
Remote Console privileges
Login privilege
Login privilege
If you do not want to use overlapping roles, you could assign the Login, Virtual Power and Reset,
and Remote Console privileges to the Admin role, and assign the Login privilege to the User
role.
Figure 7 Multiple roles (separate)
Admin User
User
Admin Role
User Role
Server
Login, Virtual Power and Reset,
and Remote Console privileges
Login privilege
How role access restrictions are enforced
Two sets of restrictions can limit directory user access to LOM devices.
• User access restrictions limit user access to authenticate to the directory.
• Role access restrictions limit an authenticated user's ability to receive LOM privileges
based on rights specified in one or more roles.
298 Kerberos authentication and Directory services