Managing roles

The permission system in Prisma is based on user roles. Prisma offers default and custom user roles based on ACL rules.

Prisma provides default manager and default user roles with predefined ACL rules. These roles are available for all companies and cannot be modified or removed. Additionally, custom manager and user roles can be created. Custom roles are associated with companies and are only accessible within the company in which they were created. Parent companies can view but not utilize them.

Navigate to Administration > Roles > Manager roles or Administration > Roles > User roles (depending on the type of role to manage) to access the list of existing roles. Here, default roles can be reviewed, new roles created, and existing roles modified.

Manager roles list
Manager roles list
Manager roles list

Inspecting roles

Clicking a role card opens the Role configuration page. Default roles cannot be modified.

Creating new roles

To create a new role, click the blue plus:

Create new role form
Create new role form
Create new role form
  • Name: Name of the user role.
  • Company: Company in which the role is available.
  • Description: Description of the user role.

Click Create to complete the process.

Configuring roles

To access the configuration, click the role card button.

Basic settings

At the top of the configuration page, the associated company is displayed. Below that, the role name and description can be changed.

Basic settings
Basic settings
Basic settings

General permissions

General permissions can be allocated using switches. Enabling a permission category overrides the settings of specific permissions, offering a broader approach.

General permissions
General permissions
General permissions
  • Can do anything: Grants global authorization, overriding all specific checks.
  • Can see anything: Grants the read permission for all items.

Specific permissions

Specific permissions differ depending on the type of role: manager or user.

Manager

Specific permissions: Manager
Specific permissions: Manager
Specific permissions: Manager
  • Can assign roles: Create and assign roles to other users.
  • Can impersonate: Impersonate other users.
  • Can bypass support tokens: Bypass the requirement for a support token* when impersonating other users.
  • Can use Zabbix admin calls: Perform administrative actions on the Zabbix server using the root user.
  • Can modify quota: Manage modules and quotas.
  • Can create reseller companies: Create a reseller company if the necessary permissions are granted (Companies: create).
Support tokens are required for impersonating Prisma users from *other companies* and are always required when impersonating Prisma managers.

User

Specific permissions: User
Specific permissions: User
Specific permissions: User

ACL rule sets

Specific permissions are further subdivided into ACL rule sets. The available sets depend on the role type:

  • Manager roles: Instance administration, Company administration.
  • User roles: Reporting, Self Provisioning, AI.
Access control list: Reporting rule set
Access control list: Reporting rule set
Access control list: Reporting rule set

Permissions are divided into Create, Delete, Modify, and Read. Use the Toggle all button to synchronize all actions for a resource at once. Each permission can have one of three states:

  • Can Not: Prohibited.
  • Can: Allowed.
  • Can Grant: Allowed, and can also grant the permission to others.

To grant permissions to other roles, a role must itself have the necessary permissions to create or modify roles, found in Manager roles > Company administration > Roles.

Deleting roles

To delete a custom role, open the context menu and click Delete.