Forum Discussion

Lewis_Beard's avatar
Lewis_Beard
Icon for Expert rankExpert
31 days ago
Solved

How do access groups work? All options missing.

I need to allow a role to edit local Custom logicmodules only. I had seen the Access Groups but never tried them. I made a new one, but after doing so, it does NOT show up under the Access Groups li...
  • Asawari's avatar
    Asawari
    29 days ago

    Hey Lewis

    My name is Asawari, I am from the engineering team.

    I am happy to help you on your query.
    Creation of Access Group is the first screenshot that you have shared and creation of access group requires permission which is the second screenshot 
    Mentioned here https://www.logicmonitor.com/support/adding-a-role

    Access group are mapped to Logic modules hence their permissions are in Roles page under Modules Tab mentioned in https://www.logicmonitor.com/support/modules-role-permissions

    Mapping of AccessGroup to Modules is done in the modules editor mentioned in https://www.logicmonitor.com/support/access-groups-for-modules

    Please go through the above documents and let me know if you need further help. 
    Please do share your valuable feedback on usage of access groups. thanks!

Lewis_Beard's avatar
Lewis_Beard
Icon for Expert rankExpert
26 days ago

I guess I will open a support ticket, since this doesn't seem to be me missing something obvious, and nothing jumped out to the community.

But I will make a comment of where I left off for clarity:

  1. I created an Access Group. The group itself has no features other than Name, Tenant, and Description. I left Tenant blank because I have no idea what it is. There are no permissions to edit here.

  2. On the role I want to enable granular access to modules, I went to the Modules permissions, went under the "My Modules Toolbox" section (below Access Groups) and checked the "Modules: Manage (Limited)" box, and saved the changes.

    NOTE: I believe this corresponds to your first link, the section "Configuring Modules Permissions" step 5 aka "To enable a user to have permissions for Access Groups within Modules". The only difference is that, in your documentation, this is happening during role creation. I'm editing an existing role. So I click Save instead of Finish.

  3. I opened up the Modules section of the portal (I can do anything on the portal), filtered for the specific module I wanted to grant access to, and selected it. On the overview shown on the bottom of the UI when I've selected the module, I only see the usual tabs: Info, AppliesTo, Active Discovery, Collection, Normal Datapoints, Complex Datapoints, Graphs, Local History. I see NO Access Groups tab. When I edit the module itself, again, I see NO Access Groups tab at all, and there is nothing on the page.

    NOTE: this corresponds to your second link, "Assigning an Access Group to a Module" and I believe it would be Step 3, "Select the Access Groups tab" ... but no such tab seems to exist.


Anyway, I will open up a trouble ticket later this afternoon. I'm probably missing something. I just wanted to make the state clear. I'm sure I'm just missing something simple.

Thanks.

 

Mike_Moniz's avatar
Mike_Moniz
Icon for Professor rankProfessor
26 days ago

I wasn't even aware this was a feature. I also see the same thing where step 3 does not show a Access Group tab when doing a quick test in sandbox.

  • Lewis_Beard's avatar
    Lewis_Beard
    Icon for Expert rankExpert
    25 days ago

    I still have not found a solution to my problem but I did want to offer a warning. Normally, any role that has "Threshold" and "Manage" on a Resource Group can set a custom threshold on an instance. But for that role, if you dare to attach an Access Group to it, LogicMonitor for some weird reason ADDS A NEW REQUIREMENT!

    If you have any Access Group added to a role, for whatever reason, you all of a sudden have to have the checkbox set on the "Resources: Group Threshold" checkbox under the default Access Group. I'm not actually sure if this condition is added to the portal as a whole, or if it just messes up the role with an Access Role attached.

    I found this out because my group I'm trying to give access to, for Access Groups, suddenly couldnt change any instance thresholds AT ALL. And I had to dig around and find out.

    https://www.logicmonitor.com/support/threshold-management

    So proceed with extreme caution!!

    • Lewis_Beard's avatar
      Lewis_Beard
      Icon for Expert rankExpert
      25 days ago

      Thankfully it looks like the reason that role lost access to edit thresholds is somewhat my fault, but the warning still stands. I added the Access Group to that Role specifically because I didnt want them to be able to edit Modules like they used to be able to, so I had unchecked the whole Default row except for view, not knowing that the "Resources: Group Threshold" was a new feature.

      So it was somewhat my own fault, and the good news is that other groups should be fine as long as you dont uncheck that .... but again, the warning stands because obviously, when you want to use Access Groups for a role, the reason you want to do it, is because you dont want them messing with official modules.

      But whatever you do, do NOT uncheck group threshold permissions from the default row. Because it OVERRIDES the manage and threshold settings on the Resource tab!!

  • Lewis_Beard's avatar
    Lewis_Beard
    Icon for Expert rankExpert
    25 days ago

    See my comment to my comment about the Module Group Threshold thing. The warning is legit but there is a clarification. :) I dont want to repeat the whole post. :)