How to Configure and Authenticate External Directories › Supported External Directories › Add a Security Profile

Add a Security Profile

Creating a security profile means mapping a new one to either a user account or group provided by the current security providers. You can select the users or groups who can access the system and add them to a security profile.

Follow these steps:

1. Select Security Profiles from the Security menu.

   The Security Profiles dialog appears.

   Note: You must have sufficient access rights to open this dialog; otherwise, a security error message is displayed. Administrators have these access rights by default.

2. Click Add.

   The Add Security Profiles dialog appears.

3. Select the security authority from the Available Directories tree, browse and click the required security principal.

   You can view the selected security authority and principal in the Container Identifier and Names fields, respectively.

4. Double-click a principal in the tree, or click Add to List.

   The security principals shown in the Names field are added to the List of security profiles.

   To add more profiles, repeat the last two steps on the Add Security Profiles dialog.

5. Click OK.

   The selected user account or group is mapped to the security profile and the Class Permissions dialog is displayed.

   Note: If you have added more than one security principal, the Class Permissions dialog is not displayed. You must select the profile in the Security Profiles dialog, and click Class Permissions.

6. In the Class Permissions dialog, select the object class to which you want to assign the rights.

   Note: You can select multiple object classes and specify the class permissions for all of them. For continuous selection, press the Shift key and then click the objects; for random selection, press the Ctrl key and then click the objects.

7. Select the permission in the Class access drop-down list, and click OK.

   The given permissions are assigned to the new security profile.

The Add Security Profiles dialog displays a list of available security authorities: Windows NT domains, UNIX authentication targets, external directories such as X.509 certificate subsystem.

The manager stores the list of available security authorities. When running in a Windows NT domain environment, the manager node will automatically calculate all explicit domain trusts available. You can see the list of available security authorities from the Add Security Profiles dialog.

In some cases you may wish to use an implicitly trusted domain when creating security profiles - a domain that is not in the directly calculated list.

The Security Profiles dialog allows you to add and remove authorities, but only within the Windows NT name-space (winnt).

• To add an implicitly trusted domain, click Add and enter the domain name in the new dialog.
• To remove an implicitly trusted domain, highlight the domain you wish to remove and click Remove.

Note: Conferring trust is enforced by the operating system. You cannot add a domain and have the manager trust this domain unless the underlying operating system already trusts the domain in question.