I am new to UCS and looking to migrate from Windows AD.
I can login as administrator and perform all tasks however I wish to provide a non administrator user with the ability to administer users.
Can someone please help with how this can be done.
This explains how to administer users but does not explain how to delegate permissions:
Currently when a users logs in to UCS all they see is the blog item.
Hi McHenry,
The link you provide is for simple user management in the UCS web gui.
All ‘advanced’ settings can be achieved using the Windows applet “Active Directory Users and Computers”
Follow this guide for delegating permissions and you should be all sorted.
Is there not a way of controlling access to certain modules in the UCS gui?
I see currently a user can access only the blog item.
What if this was not connected to AD, how would one manage user permissions then?
You can set the visibility by editing the portal as an administrator and assigning group permissions for this.
However, this does not mean that the user can then connect to the underlying application. It simply means that the tiles can be seen and clicked on.
You can also make a normal user an administrator by giving them additional group permissions, allowing them to edit other users.
also,
you can control who can see what in the portal by linking tiles to specific groups.
After reading your question again, I wonder if you are simply looking to make a user an UCS admin?
In this case, you go to user settings → groups and just tick “Domain admins” in the additional groups tab; sorted…
If you plan to allow that non admin user (a group of users) rights JUST to change/reset other users passwords RSAT is the only way.
Circling back to this.
Our domain is multi tenant so I do not want users to be able to view anything outside of their tenant OU.
Is this possible?
Same challenge here: We would like to give one or more users of a group to manage the group memberships. Groups in our case should be able to self-manage who may join or send invites. This could be also a use case for departments in modern, flat organizations or sister-companies or tenants.
If we need to use RSAT to configure delegation on the UCS panel, wouldn’t that break the S4 connector? I am currently deploying UCS primarily as the identity source for my Linux “realm” And I want the “AD Realm” just to manage a few windows workstations, So I am using the S4 connector replication model.
Is the replication bi-directional? I mean, if I use RSAT to create such a delegation to a “role-jradmin” group, would that translate into the same delegation in the UCS portal?
