Hello and welcome to this presentation which explains and demonstrates how to create custom
roles for deploying the Oracle Private Cloud Appliance. The custom administrator and user
roles are based on default roles within Oracle Enterprise Manager Cloud Control. And you
see how to create administrator and user accounts using these roles.
Oracle Enterprise Manager Cloud Control includes a large suite of default roles for users.
For the purposes of managing the Oracle Private Cloud Appliance as a platform for Infrastructure
as a Service, create three custom roles from default roles installed with Oracle Enterprise
Manager. The three roles are:
the Cloud Administrator EM_CLOUD_ADMINISTRATOR, the Self Service Administrator, EM_SSA_ADMINISTRATOR,
and the Self Service User EM_SSA_USER. Each of these roles is defined by a set of
particular privileges. As you see in this presentation, you create
a new custom role by effectively copying one of the roles provided by Oracle Enterprise
Manager. You can modify these custom roles if you need to add or remove privileges in
your enterprise, leaving the default roles intact.
Use the custom role to create administrators or users for your enterprise.
In this session, I'm logged in as sysman - the Oracle Enterprise Manager default super user.
From this point on, I will leave out the underscore mention, although the underscore separates
the tokens in the role and user names in this demonstration. That goes for the EM and the
ICD roles and users. To create and manage roles, navigate through
the Setup menu to Security to Roles. The custom role I create is for a cloud administrator,
so I want to create a new role like the EM_CLOUD_ADMINISTRATOR role.
Click the radio button in the Select column next to EM_CLOUD_ADMINISTRATOR.
Then click Create Like to start the process. On the Properties page, Enter the name for
the role: ICD_CLOUD_ADMINISTRATOR. Provide a short description. Here, I enter
Cloud Administrator for ICD development. There are no more inputs for the Properties, so
click next. The list of Selected Roles shows the default
roles configured in Oracle Enterprise Manager Cloud Control for the Cloud Administrator.
Because we are creating a role like the default EM_CLOUD_ADMINISTRATOR, we keep the current
selected roles. Click Next.
There are several target privileges enabled by default for cloud administrators. Scroll
through the list to see which privilege grants are in place. We make no changes.
Click Next. The resource privileges appear. Scroll through
the list to see all the resource privilege grants.
The next step in the interface shows administrators that are assigned this role, but because this
is a new role and there are no administrators, click Review.
The review page provides a detailed look at the new role. Scroll to examine all the details.
Then, click Finish The list of roles returns and a confirmation
message lets you know the role has been successfully created.
Next, create a user - or administrator - based on this role.
To create a Cloud Administrator with the new custom role, start by navigating through the
Setup menu, through Security, to Administrators. The list of administrators - or users - appears.
Click Create. The Properties page appears. Enter a name for the administrator. Here,
I enter ICD_CLOUD_ADMIN. The reason I don't use the full word Administrator is that Oracle
Enterprise Manager does not allow the same name to be used for a role and for an administrator.
Provide a password, and confirm it by entering the password again.
Check the box, or enable, Expire password now. This forces the new administrator to
change the password on the initial login. Click Next.
The roles page appears, and two roles are selected by default: EM_USER and PUBLIC. Leave
these roles in place. Scroll the available roles list and locate
the ICD_CLOUD_ADMINISTRATOR role. Click the role on the list, then click the move button
to place the role on the list of selected roles.
Click Next. The target privileges are those enabled by
all the selected roles. Because we do not want to change the target, or resource privileges,
click Review. When the review page appears, click Finish.
The Administrators list appears, displaying a confirmation message the ICD_CLOUD_ADMIN
administrator has been successfully created. The ICD_CLOUD_ADMIN administrator also appears
on the list of administrators. You have seen how to create a custom role
like the default EM_CLOUD_ADMINISTRATOR role, and you have seen how to use the role to create
a user. In the following segments, you see a series
of screen captures that present essential details for creating two more roles and users:
the Self Service Administrator and Self Service User.
Here is the Properties interface for creating a self service administrator, based on the
EM_SSA_ADMINISTRATOR role, using the Create Like feature. The custom administrator created
is ICD_SSA_ADMINISTRATOR. And as before, we make no changes to the roles and privileges
for this custom administrator. After creating the custom role, create the
administrator ICD_SSA_ADMIN. The Properties interface shows the name. The password has
been set to expire, requiring a reset on initial login.
The Roles interface shows the EM_USER and PUBIC roles, which Oracle Enterprise Manager
requires, and the custom ICD_SSA_ADMINISTRATOR role. No additional changes are made to the
privileges for the ICD_SSA_ADMIN administrator. The last role and administrator - or user
- is a self service user, based on the EM_SSA_USER role, using the Create Like feature. The custom
user created is ICD_SSA_USER. No changes are made to the roles and privileges for this
custom user. After creating the custom user role, create
the user ICD_USER. The Properties interface shows the name. The password has been set
to expire, so the user is required to reset it on initial login.
The Roles interface shows only the ICD_SSA_USER on the Selected Roles list. No additional
changes are made to the privileges for the ICD_USER.
You have seen the process to create a custom role from a default Oracle Enterprise Manager
role. And you have seen the process to create an administrator using the custom role.
You also saw essential details for creating the Oracle Enterprise Manager Cloud Control
self service adminstrator and self service user.
For more information on Oracle Enterprise Manager Cloud Control, see oracle.com/enterprise-manager
For more information on Oracle Private Cloud Appliance, see oracle.com/engineered-systems/private-cloud-appliance.
This ends the presentation.