Horizon Recording Role-Based Access Control

The Horizon Recording Role-Based Access Control (RBAC) is a management feature used to determine who can use Horizon Recording Console and what tasks those user groups are authorized to perform. With role-based access control, an administrator can create roles and give privileges to specific Active Directory user groups. They can do this by creating permissions for these groups.

Prerequisite

To use RBAC, enable LDAPS integration in the Service Settings page and provide all the required details.

Note: The existing local administrator and viewer users will continue to work as normally they would.

Roles

Roles are the first consideration when using RBAC for the Horizon Recording Console. Roles are a collection of privileges. The second considerations are access levels and user groups.

Users obtain privileges through their role assignments. You cannot assign privileges directly to user groups. A user that has multiple role assignments acquires the sum of all the privileges contained in those roles.

Built-in Roles

After a new installation, two built-in roles are created.

• Administrators - This role has all privileges enabled, but with no permissions

• Viewers - This role has only View Recording and View Dashboard privileges enabled, but with no permissions

If upgrading from a version where RBAC is not supported to the latest version with RBAC support, any groups assigned to the Admin CN or Viewer CN will be migrated to the corresponding Administrators or Viewers roles.

Note: Built-in roles cannot be deleted and their privileges cannot be updated. However, their permissions can be modified.

Privileges

Privileges provide the ability to perform specific actions, such as downloading or deleting a recording. Privileges are predefined. Privileges control what a user sees and/or the operations they can perform in Horizon Recording Console. For example, if a user does not have privileges to modify Service Settings, that page is not visible in the Horizon Recording Console when that user logs in.

The two types of Horizon Recording server privileges are Recording Privileges and Configuration Privileges. Recording Privileges apply to recordings that are available on a recording server. Configuration Privileges apply to the configuration of the recording server. The following describes the privileges based on the type.

Privilege	Description
Recording Privileges
View Recording	Enables viewing recordings. Note: View Recording is selected by default if the administrator selects any other recording privilge. View Recording is needed to select the other recording privileges.
View Dashboard	Enables viewing the dashboard.
Lock Recording	Enables locking recordings.
Unlock Recording	Enables unlocking recordings.
Download Recording	Enables downloading recordings.
Delete Recording	Enables deleting recordings.
Configuration Privileges
Audit Trail	Enables viewing the audit trail.
Manage Roles	Enables managing user roles.
Manage Agents	Enables managing agent machines.
Service Settings	Enables managing service settings.

Permissions and Access Levels

The Horizon Recording Console incorporates a combination of user groups and access levels as permissions. Privileges define the action that can be performed. The user group defines who can perform the action. The access level defines the scope of that action.

Note: Access levels only are meant for recording privileges. Access levels do not apply to configuration privileges. However, you will be asked to choose an access level even when users only have configuration privileges.

There are three access levels available in Horizon Recording console.

• Global - In this access level, all recordings are available in the system. With this access level, a user can perform all of the operations based on the assigned privileges on all of the available recordings in the system.

• Pool - This access level is assigned pools. With this access level, a user can perform all the operations based on the assigned privileges in all of the recordings available from the assigned pools.

  Note: The pool name can only be chosen when there is at least one recording available from that particular pool.

• Self - This access level is the recordings made by the current, logged in user. With this access level, a user can perform all of the assigned privileges in the recordings that belong to that specific user.

Permissions and Access Levels Examples

Role	Privilege	Permission	Effective Access
Global Administrators	All	Usergroup: domain1\admingroup1 Access Level: Global	Everything
Global Viewer	View Recording	Usergroup: domain1\viewgroup1 Access Level: Global	View all recordings
Self Viewer	View Recording	Usergroup: domain1\selfgroup1 Access Level: Self	View only self-recordings
Pool Viewer	View Recording	Usergroup: domain1\poolgroup1 Access Level: Pool Pool names: P1, P2, etc.	View pool recordings from only P1 and P2
Settings Admin	Service Settings	Usergroup: domain1\settingsgroup1 Access Level: NA (can select anything)	Manage Server Settings (no recording access)

Setting Up Role-Based Access Control

Create Roles

To create roles, a user needs to have the Manage Roles privilege. Also, LDAPS Integration must be enabled and configured. Permissions can be added from this wizard.

1. In the Horizon Recording Console, go to Manage Access > Roles > Add.

2. Type a Name and optional Description.

3. Click Next.

4. Select the required Privileges.

5. Click Next.

6. If LDAPS is enabled and configured, complete the following:

   • Click Add.

   • Search for the group name to assign to.

   • Click Search to filter Active Directory user groups based on your search criteria.

   • Select the Active Directory user group(s) that you want to assign to that role.

   • Select an Access Level.

     • If you select Pool access level, then select the pools.

   • Click Submit.

   • Click Save.

Note: Adding the user group is optional during role creation. User groups can be added later.

Manage Privileges

To manage privileges, a user needs to have the Manage Roles privilege. Also, LDAPS Integration must be enabled and configured.

You cannot add new or remove privileges because they are pre-defined. You can only enable or disable privileges in a role.

1. In the Horizon Recording Console, go to Manage Access > Roles.

2. Click the role name for which the selection of privileges need to be modified

3. In Privileges, click Edit.

4. Modify the selection.

5. Click Submit.

Manage Permissions

To manage permissions, a user needs to have the Manage Roles privilege. Also, LDAPS Integration must be enabled and configured.

You can add, edit, or delete permissions from a role.

1. In the Horizon Recording Console, go to Manage Access > Roles.

2. Click the role name for which the permissions need to be modified.

3. In Permissions, click Add to add a new permission based on the Create Roles section.

4. In Permission, click Edit to edit the Access Level of the permission.

5. In Permissions, Delete to delete a permission.

Delete Roles

To delete roles, a user needs to have the Manage Roles privilege. Also, LDAPS Integration must be enabled and configured.

1. In the Horizon Recording Console, go to Manage Access > Roles.

2. Select the role to be deleted.

3. Click Delete.

4. Review the Confirmation screen and click Delete.

Note: Deleting a role, deletes the permissions of that role.

Overview of Groups

For an overview of groups, a user needs to have the Manage Roles privilege. Also, LDAPS Integration must be enabled and configured.

The Horizon Recording Console can have multiple roles and permissions with multiple user groups. The Overview of Groups page provides an overview of all the user groups that are part of RBAC.

1. In the Horizon Recording Console, go to Manage Access > Groups.

2. Click a permission to see the roles it is part of with the list of privileges and access levels.