-- ================================================================= -- Copyright (c) 2004-2014 New H3C Tech. Co., Ltd. All rights reserved. -- -- Description: This MIB is to provide the definition of the RBAC -- (Role Based Access Control) system. -- Reference: -- Version: V1.0 -- History: -- V1.0 2014-08-08 Initial version, created by Xu Yang -- ================================================================= HH3C-RBAC-MIB DEFINITIONS ::= BEGIN IMPORTS hh3cCommon FROM HH3C-OID-MIB Unsigned32, OBJECT-TYPE, MODULE-IDENTITY FROM SNMPv2-SMI TruthValue, RowStatus, StorageType, TEXTUAL-CONVENTION FROM SNMPv2-TC; hh3cRbac MODULE-IDENTITY LAST-UPDATED "201408081547Z" ORGANIZATION "New H3C Tech. Co., Ltd." CONTACT-INFO "Platform Team New H3C Tech. Co., Ltd. Hai-Dian District Beijing P.R. China http://www.h3c.com Zip:100085" DESCRIPTION "This MIB is to provide the definition of the RBAC (Role Based Access Control) system." REVISION "201408081547Z" DESCRIPTION "The initial revision of this MIB module." ::= { hh3cCommon 158 } -- Top-level structure of MIB hh3cRbacNotifications OBJECT IDENTIFIER ::= { hh3cRbac 0 } hh3cRbacObjects OBJECT IDENTIFIER ::= { hh3cRbac 1 } hh3cRbacInfo OBJECT IDENTIFIER ::= { hh3cRbacObjects 1 } hh3cRbacConfig OBJECT IDENTIFIER ::= { hh3cRbacObjects 2 } -- definition of textual conventions Hh3cResourceType ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "A User can be restricted from accessing resources by RBAC resource access policies. There are four types of resource access policies as below: vlan(0) Bit value of 0 indicates that the user has access to no VLANs. Bit value of 1 indicates that the user has access to all VLANs. A user can be selectively assigned access to VLANs by configuring entries in the 'hh3cRbacPolicyTable'. interface(1) Bit value of 0 indicates that the user has access to no interfaces. Bit value of 1 indicates that the user has access to all interfaces. A user can be selectively assigned access to interfaces by configuring entries in the 'hh3cRbacPolicyTable'. vrf(2) Bit value of 0 indicates that the user has access to no VRFs. Bit value of 1 indicates that the user has access to all VRFs. A user can be selectively assigned access to VRFs by configuring entries in the 'hh3cRbacPolicyTable'. seczone(3) Bit value of 0 indicates that the user has access to no security zones. Bit value of 1 indicates that the user has access to all security zones. A user can be selectively assigned access to security zones by configuring entries in the 'hh3cRbacPolicyTable'." SYNTAX BITS { vlan(0), interface(1), vrf(2), seczone(3) } Hh3cRuleType ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "There are two types of rules. List as below: system: pre-defined by system and isn't editable. user: defined by user and is editable. " SYNTAX INTEGER { system(1), user(2) } Hh3cRuleOperation ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "Privileges of a rule. exec - execute operation read - Read operation write - Write operation Note that if an operation is not supported by an entity, the operation does not apply to the entity." SYNTAX BITS { exec(0), read(1), write(2) } Hh3cRuleAction ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "This indicates the action of a rule that defines the access privileges. permit - permit the privileges deny - deny the privileges " SYNTAX INTEGER { permit(1), deny(2) } Hh3cEntityType ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "This indicates the type of the entity in a rule." SYNTAX INTEGER { unknown(1), command(2), feature(3), featuregroup(4), webmenu(5), xmlelement(6), oid(7) } -- -- nodes defined -- hh3cRbacRoleDefaultEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "This object controls if an authenticated user can access the system when he or she isn't authorized any user roles. The default value is false." DEFVAL { false } ::= { hh3cRbacConfig 1 } hh3cRbacRoleDefaultRoleName OBJECT-TYPE SYNTAX OCTET STRING (SIZE (1..63)) MAX-ACCESS read-write STATUS current DESCRIPTION "If hh3cRbacRoleDefaultEnable is true, this object specifies the user role applied to the user when he or she accesses the system without any authorized user roles. If this object is not configured, the default user role applied is listed as below: network-operator - When login to the default MDC or default Context. mdc-operator - When login to the non-default MDC. context-operator - When login to a non-default Context. " ::= { hh3cRbacConfig 2 } -- -- definition of hh3cRbacRoleTable -- hh3cRbacRoleTable OBJECT-TYPE SYNTAX SEQUENCE OF Hh3cRbacRoleEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table shows the basic configuration information about all user roles." ::= { hh3cRbacConfig 3 } hh3cRbacRoleEntry OBJECT-TYPE SYNTAX Hh3cRbacRoleEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the hh3cRbacRoleTable. One entry per role defined on the device." INDEX { hh3cRbacRoleName } ::= { hh3cRbacRoleTable 1 } Hh3cRbacRoleEntry ::= SEQUENCE { hh3cRbacRoleName OCTET STRING, hh3cRbacRoleDescription OCTET STRING, hh3cRbacRoleResourceAccess Hh3cResourceType, hh3cRbacRoleStorageType StorageType, hh3cRbacRoleRowStatus RowStatus } hh3cRbacRoleName OBJECT-TYPE SYNTAX OCTET STRING (SIZE (1..63)) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The name of a role." ::= { hh3cRbacRoleEntry 1 } hh3cRbacRoleDescription OBJECT-TYPE SYNTAX OCTET STRING (SIZE (0..128)) MAX-ACCESS read-create STATUS current DESCRIPTION "Description of the role." ::= { hh3cRbacRoleEntry 2 } hh3cRbacRoleResourceAccess OBJECT-TYPE SYNTAX Hh3cResourceType MAX-ACCESS read-create STATUS current DESCRIPTION "Defines the default access to the resources to which access can be controlled. For example a role which has access to all VLANs, all Interfaces, no VRF and no security zone will be 0011." ::= { hh3cRbacRoleEntry 3 } hh3cRbacRoleStorageType OBJECT-TYPE SYNTAX StorageType MAX-ACCESS read-only STATUS current DESCRIPTION "Storage type of this row." ::= { hh3cRbacRoleEntry 4 } hh3cRbacRoleRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "Status of this row." ::= { hh3cRbacRoleEntry 5 } -- -- definition of hh3cRbacRuleTable -- hh3cRbacRuleTable OBJECT-TYPE SYNTAX SEQUENCE OF Hh3cRbacRuleEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table shows the configuration information about rules in all user roles." ::= { hh3cRbacConfig 4 } hh3cRbacRuleEntry OBJECT-TYPE SYNTAX Hh3cRbacRuleEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the hh3cRbacRuleTable. One entry indicates one rule in a role." INDEX { hh3cRbacRoleName, hh3cRbacRuleType, hh3cRbacRuleNumber } ::= { hh3cRbacRuleTable 1 } Hh3cRbacRuleEntry ::= SEQUENCE { hh3cRbacRuleType Hh3cRuleType, hh3cRbacRuleNumber Unsigned32, hh3cRbacRuleAction Hh3cRuleAction, hh3cRbacRuleOperation Hh3cRuleOperation, hh3cRbacRuleEntityType Hh3cEntityType, hh3cRbacRuleEntity OCTET STRING, hh3cRbacRuleRowStatus RowStatus } hh3cRbacRuleType OBJECT-TYPE SYNTAX Hh3cRuleType MAX-ACCESS not-accessible STATUS current DESCRIPTION "The type of a rule." ::= { hh3cRbacRuleEntry 1 } hh3cRbacRuleNumber OBJECT-TYPE SYNTAX Unsigned32 (1..256) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The index of rules in one role. There are two kinds of rules in a role. One is system defined, the other is user defined. The total numbers of user defined rules is 1024. In one role, the user defined rules will be applied first and then the system defined rules. For the rules of same type, the following guidelines will be applied: Non-OID: If two rules of the same entity type conflict, the rule with the higher index takes effect. OID: If the MIB node specified in a rule is a child node of the MIB nodes specified in other rules, only this rule takes effect. If the same OID is specified in multiple rules, the rule with the higher index takes effect." ::= { hh3cRbacRuleEntry 2 } hh3cRbacRuleAction OBJECT-TYPE SYNTAX Hh3cRuleAction MAX-ACCESS read-create STATUS current DESCRIPTION "The action of a rule." ::= { hh3cRbacRuleEntry 3 } hh3cRbacRuleOperation OBJECT-TYPE SYNTAX Hh3cRuleOperation MAX-ACCESS read-create STATUS current DESCRIPTION "Privileges of a rule." ::= { hh3cRbacRuleEntry 4 } hh3cRbacRuleEntityType OBJECT-TYPE SYNTAX Hh3cEntityType MAX-ACCESS read-create STATUS current DESCRIPTION "This indicates the type of the entity in a rule. There are seven types of entity as below: unknown: invalid. command: a command or a set of commands that match a regular expression. feature: a feature which contains a set of commands. featuregroup: a group of features. webmenu: web menus. xmlelement: XML elements. oid: the specified MIB node and its child nodes." ::= { hh3cRbacRuleEntry 5 } hh3cRbacRuleEntity OBJECT-TYPE SYNTAX OCTET STRING (SIZE (0..255)) MAX-ACCESS read-create STATUS current DESCRIPTION "This indicates the entity that the privileges of rule apply to. It is may be a regular expression of commands, feature name, feature group name, web menu, xml element or oid. If the type of entity is feature or webmenu or xmlelement and the entity is a zero length string, then this rules applies to all the features or web menus or xml elements." ::= { hh3cRbacRuleEntry 6 } hh3cRbacRuleRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "Status of this rule." ::= { hh3cRbacRuleEntry 7 } -- -- definition of hh3cRbacPolicyTable -- hh3cRbacPolicyTable OBJECT-TYPE SYNTAX SEQUENCE OF Hh3cRbacPolicyEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table shows the configuration information about resource access policies in all user roles. A role may be restricted from accessing various resources of a device. This table lists the resources that a role can access." ::= { hh3cRbacConfig 5 } hh3cRbacPolicyEntry OBJECT-TYPE SYNTAX Hh3cRbacPolicyEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the hh3cRbacPolicyTable. One entry indicates an accessible resource. If a role named 'R' can access VLAN1 to VLAN10, then there will be 10 entries in this table. There are two objects to specify the resource in this table. If the value of 'hh3cRbacPolicyType' is 'vlan' or 'interface', the column 'hh3cRbacPolicyValue' is a four octets value which means vlan ID or IfIndex. If the value of 'hh3cRbacPolicyType' is 'vrf' or 'seczone', the column 'hh3cRbacPolicyValue' is a string indicating the name of the VRF or security zone." INDEX { hh3cRbacRoleName, hh3cRbacPolicyType, hh3cRbacPolicyValue } ::= { hh3cRbacPolicyTable 1 } Hh3cRbacPolicyEntry ::= SEQUENCE { hh3cRbacPolicyType INTEGER, hh3cRbacPolicyValue OCTET STRING, hh3cRbacPolicyRowStatus RowStatus } hh3cRbacPolicyType OBJECT-TYPE SYNTAX INTEGER { vlan(1), interface(2), vrf(3), seczone(4) } MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object indicates the type of the resource access policy of this entry." ::= { hh3cRbacPolicyEntry 1 } hh3cRbacPolicyValue OBJECT-TYPE SYNTAX OCTET STRING (SIZE(1..64)) MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object identifies the resource this role can access. If the value of 'hh3cRbacPolicyType' is 'vlan' or 'interface', the column 'hh3cRbacPolicyValue' is a four-octet-value which means vlan ID or IfIndex. If the value of 'hh3cRbacPolicyType' is 'vrf' or 'seczone', the column 'hh3cRbacPolicyValue' is a string indicating the name of the VRF or security zone." ::= { hh3cRbacPolicyEntry 2 } hh3cRbacPolicyRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "Status of this row." ::= { hh3cRbacPolicyEntry 3 } -- -- definition of hh3cRbacFeatureGroupTable -- hh3cRbacFeatureGroupTable OBJECT-TYPE SYNTAX SEQUENCE OF Hh3cRbacFeatureGroupEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table shows the configuration information about feature groups on a device." ::= { hh3cRbacConfig 6 } hh3cRbacFeatureGroupEntry OBJECT-TYPE SYNTAX Hh3cRbacFeatureGroupEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the hh3cRbacFeatureGroupTable. One entry indicates a feature in particular group." INDEX { hh3cRbacFeatureGroupName } ::= { hh3cRbacFeatureGroupTable 1 } Hh3cRbacFeatureGroupEntry ::= SEQUENCE { hh3cRbacFeatureGroupName OCTET STRING, hh3cRbacFeatureGroupRowStatus RowStatus } hh3cRbacFeatureGroupName OBJECT-TYPE SYNTAX OCTET STRING (SIZE(1..31)) MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object indicates the name of a feature group." ::= { hh3cRbacFeatureGroupEntry 1 } hh3cRbacFeatureGroupRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "Status of this row." ::= { hh3cRbacFeatureGroupEntry 2 } -- -- definition of hh3cRbacFeaturesInGroupTable -- hh3cRbacFeatureInGroupTable OBJECT-TYPE SYNTAX SEQUENCE OF Hh3cRbacFeatureInGroupEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table shows the configuration information about features in feature groups on a device." ::= { hh3cRbacConfig 7 } hh3cRbacFeatureInGroupEntry OBJECT-TYPE SYNTAX Hh3cRbacFeatureInGroupEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the hh3cRbacFeaturesInGroupTable. One entry indicates a feature in a particular group. If a newly created feature group doesn't contain any feature, there's no entry appearing in this table." INDEX { hh3cRbacFeatureGroupName, hh3cRbacFeatureNameInGroup } ::= { hh3cRbacFeatureInGroupTable 1 } Hh3cRbacFeatureInGroupEntry ::= SEQUENCE { hh3cRbacFeatureNameInGroup OCTET STRING, hh3cRbacFeatureInGroupRowStatus RowStatus } hh3cRbacFeatureNameInGroup OBJECT-TYPE SYNTAX OCTET STRING (SIZE(1..15)) MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object indicates the name of a feature in the feature group." ::= { hh3cRbacFeatureInGroupEntry 1 } hh3cRbacFeatureInGroupRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "Status of this row." ::= { hh3cRbacFeatureInGroupEntry 2 } -- -- definition of hh3cRbacFeatureTable -- hh3cRbacFeatureTable OBJECT-TYPE SYNTAX SEQUENCE OF Hh3cRbacFeatureEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table shows the information about features on a device." ::= { hh3cRbacInfo 1 } hh3cRbacFeatureEntry OBJECT-TYPE SYNTAX Hh3cRbacFeatureEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the hh3cRbacFeatureTable. One entry indicates information about a feature on a device." INDEX { hh3cRbacFeatureName } ::= { hh3cRbacFeatureTable 1 } Hh3cRbacFeatureEntry ::= SEQUENCE { hh3cRbacFeatureName OCTET STRING, hh3cRbacFeatureDescription OCTET STRING } hh3cRbacFeatureName OBJECT-TYPE SYNTAX OCTET STRING (SIZE(1..15)) MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object indicates the name of a feature." ::= { hh3cRbacFeatureEntry 1 } hh3cRbacFeatureDescription OBJECT-TYPE SYNTAX OCTET STRING (SIZE(1..63)) MAX-ACCESS read-only STATUS current DESCRIPTION "This object indicates the introduction of the feature." ::= { hh3cRbacFeatureEntry 2 } END