ZCS Administrator's Guide Network Edition 6.0.8

Specific Access Rights

Frequently requested access rights are described below. The steps to set up an administrator to manage multiple domains are described in this section.

Manage multiple domains

To have one domain administrator manage more than one domain, you assign the rights to manage individual domains to the administrator account or administrator group.

For example, to set up domanadministrator1@example.com to manage domainexample1 and domainexample2.com. Create a new administrator account on one of the domains to be managed.

1.	Click New>Administrator and create the administrator account on one of the domains to be managed (domainexample1.com)

2.	Select the following views that domain administrators need to manage a domain:

•	Account List View

•	Distribution List View

•	Alias List View

•	Resource List View

•	Domain List View

•	Saved Searches View

3.	Click Next to configure the grants for this domain. When the views are selected, the rights associated with these views automatically display on the Configure the Grants dialog.

Click Next. The informational box shows the grants were created.

Click OK in the Informational window.

The Configure Grants dialog displays again

4.	Now you add another domain to be managed (domainexample2.com).

•	On the Configure Grants page, click Add

•	Select the target type as domain

•	Enter the target’s domain name (domainexample2.com)

•	Right Type, select System Defined Right

•	Right Name type, adminConsoleAccountRights. Is Positive Right should be selected.

•	Click Add and More

•	The Add ACE page displays again and the Right Name field is empty. Type, adminConsoleDLRights and click Add and More

•	Continue to add the following right names:

•	adminConsoleAliasRights

•	adminConsoleResourceRights

•	adminConsoleSavedSearchRights

•	adminConsoleDomainRights

•	After the last right, click Add and Finish. The Configure the Grants dialog displays these rights associated with the target domain. If you are adding another domain to manage, click Add and More. Repeat Step 4. If not, click Finish.

Manage Distribution Lists

To assign a user to manage a distribution list, you create a distribution list and enable Admin Group, select the view, grant the distribution list rights, add the user to the list and make that user an administrator.

1.	Create a new distribution list and include the following:

•	Check Admin Group

•	Add the user who will be the administrator as a member of the DL.

•	Go to the Admin Views tab and check Distribution List View so the admin can view the distribution list.

•	Click Save.

2.	In the Configure Grants page add the following rights.

 

Right Name	Target Type	Target	Right Type
The following right let the administrator manage distribution lists.
listdistributionlist	dl	DL email address	SD Right
adddistributionlistalias	dl	DL email address	SD Right
adddistributionlistmember	dl	DL email address	SD Right
modifyDistributionlist	dl	DL email address	SD Right
getdistributionlistmembership	dl	DL email address	SD Right
RemoveDistributionlistmember	dl	DL email address	SD Right
This domain right displays user account list that the administrator can select from to add to a distribution list.
listAccount	domain	DL email address	SD Right

Change Passwords

To create delegated administrators who only change passwords, you create the admin or admin group, select the views and grant the taskSetPassword combo right.

1.	Select the following views

•	Account List view to be able to select accounts to change passwords

•	Alias List view to be able to find users who use an alias instead of account name.

2.	The Configure the Grants page displays recommended grants for the views you have chosen. For Change Password rights, do not configure these grants. Select Skip. Click Add to add the following right:

 

Right Name	Target Type	Target	Right Type
taskSetPassword	domain	domain address	SD Right

View Mail Access Right

View Mail access right can be granted on accounts, domains, and distribution lists.

Right Name	Target Type	Target	Right Type
adminLoginAs	Either: account domain dl	account, domain, or distribution list address	SD Right*

*To deny the View Mail right on the target, check the box for Is Negative Right (Deny)

To prevent administrators from viewing an account with a domain or distribution list, assign the Is Negative Right to the account.

Manage Class of Service Assigned to Users

You can expand the domain administrator role to be able to view and change the class of service (COS) assigned to a user. To add the rights to manage the COS for a domain, add the following rights to the domain administrator account or domain administrator admin group.

Add the System Defined Rights to each COS in the domain.

 

Right Name	Target Type	Target	Right Type
listCos	cos	COS name	SD Right
getCos	cos	COS name	SD Right
assignCos	cos	COS name	SD Right
This domain right displays the COS information in the user account’s General Information page.
zimbraCOSId	domain	domain address	Attribute Right Verb: Write AR Target: domain

Manage Cross Mailbox Search

This role creates a delegated administrator role that can run the Search Mail tool to search mail archives or live mail for accounts. This also allows the administrator to create, abort, delete, purge or get status of a cross mailbox search request.

Note: The Archiving and Discovery feature must be installed for this feature to work.

 

Right Name	Target Type	Target	Right Type
adminConsoleCrossMailboxSearchRights	(combo)	server name where cross mailbox searches can be run	SD Right

For full functionality, this role includes the ability to create new accounts so that the admin can create the target mailbox to receive the search results. If you do not want this role to have the ability to create accounts, grant the following negative right as well.

 

Right Name	Target Type	Target	Right Type
CreateAccount	domain	domain address	SD Right*

*To deny the Create Account right on the target, check the box for Is Negative Right (Deny)

If you want this admin to also view the target mailbox with the results of the cross mailbox search, grant the right to view that mailbox only.

 

Right Name	Target Type	Target	Right Type
adminLoginAs	account	cross mailbox search target account name	SD Right*

Manage Zimlets

This role creates a delegated administrator role that can create, deploy and view Zimlets.

 

Right Name	Target Type	Target	Right Type
adminConsoleZimletRights	server domain	server name or domain address	SD Right
adminConsoleAccountsZimletsTabRights	server domain	server name or domain address	SD Right

Manage Resources

This role creates a delegated administrator that can create and manage resources.

 

Right Name	Target Type	Target	Right Type
adminConsoleResourceRights	combo	server name or domain address	SD Right

Access to the Saved Searches

This role creates a delegated administrator that can access all the searches saved in the administration console Navigation pane, Search section.

Right Name	Target Type	Target	Right Type
adminConsoleSavedSearchRights	combo	server name or domain address	SD Right

 

Access to the Server Status Pages

This role creates a delegated administrator that can access the Server Status page. In addition to granting this right, you must also select the Admin View, Global Server Status View.

Right Name	Target Type	Target	Right Type
adminConsoleServerStatusRights	global		SD Right

 

 

ZCS Administrator's Guide Network Edition 6.0.8