Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 427 / 861

426 Enabling remote access with clientless VPN
Using roles to assign rules to users
Role attributes
Once a role is created, you must assign its attributes. These attributes influence a user’s access
privileges. In general, there are three types of attributes that you can assign to a role:
By default, a user cannot access any resources until you assign an access profile to a role to which the
user is a member. This allows for fine-grained access control for all users based on their role within the
organization.
Creating and assigning roles
Use the role structure to assign access privileges and customized resource portal pages for a user or
group of users based on the existing structure of your internal and external authentication servers.
For example, you can create a role with one set of access privileges for a group named Engineering and
another role with another set of privileges for a group named Sales. When you move a user from the
Engineering group to the Sales group, the user is also moved from the Engineering role to the Sales
Role. All of the user’s privileges associated with the Engineering role are removed and the new set of
privileges associated with the Sales role are assigned.
Note:
When you define an external authentication server by creating an authentication server record,
the security gateway automatically creates a default user role that controls the access privileges of all
users on the server and a default group role that controls the access privileges of all groups on the
server.
See
“Creating authentication server records” on page 253.
Roles can also be implemented in a tree structure. By enabling inheritance, a tree structure simplifies
the administration of privileges. For example, if the parent of the marketing role is employee, the role
marketing inherits all the privileges of the role employee. Therefore, the administrator does not have
to duplicate any effort when creating the Marketing role.
Prerequisites
Complete the following tasks before beginning this procedure:
■
“Defining VPN profiles to allow communication between the security gateway and clientless
users”
on page 413
■
“Adding simple rules” on page 417
■
“Adding advanced rules” on page 421
To create a role
1 In the SGMI, in the left pane, under Policy, click Clientless VPN .
2
In the right pane, on the Roles tab, click New .
3 In the Clientless VPN Role Properties dialog box, on the General tab, do the following:
Access profiles Most common user privileges are defined in the access profile associated with the role. There
are numerous privileges that a user may have.
Constraints Privileges associated with a role are subject to various constraints that are also assigned to
the role. For example, access to the Internet may be allowed, but access to certain sites are
denied.
Portal attributes Content of the portal page the user can access when logging on to clientless VPN.
Role type In the drop-down list, select the role type.