topic Re: Guest and IoT Manager Administration in ExtremeCloud IQ- Site Engine Management Center

Guest and IoT Manager Administration

Matthew_Perry — Wed, 19 Jun 2019 02:00:08 GMT

We are evaluating if Guest and IoT Manager would be useful for our students to use for on-boarding IoT devices. It looks like the this would be an good way for them to be able to self serve there devices but I'm not seeing a good way for our helpdesk to help them if they have issues. It appears that the only account that can view all devices that have been on-boarded is the local Admin account. Is there are way to let other account view all devices? It looks like we could set the student provisioner to see all other student devices but this in not really ideal.

Re: Guest and IoT Manager Administration

Rodney_Lacroix — Wed, 19 Jun 2019 02:19:11 GMT

You can actually do this by enabling the option:

"Provisioners using this Onboarding Template can view and edit each other's records" on the Common tab of the Onboarding Template.

That way, any provisioner who is assigned that template can also view/modify records made by someone else, using the same template.

If you have multiple templates, but want one user to be able to see them who ISN'T admin, you would create the provisioner account, enable all the templates you want that provisioner to be included on, and then also check that same "can view each other's records." That provisioner should then have access to any and all guests/devices created under the associated onboarding templates.

Re: Guest and IoT Manager Administration

Matthew_Perry — Wed, 19 Jun 2019 02:29:17 GMT

Doesn't enabling "Provisioners using this Onboarding Template can view and edit each other's records" in the template let all members of that template edit each other? As in I want the helpdesk to be able to view/edit these entries but I wouldn't want one student to be able to view/edit another students devices.

Re: Guest and IoT Manager Administration

Rodney_Lacroix — Wed, 19 Jun 2019 02:39:12 GMT

If you're talking about self-services (where students open the self-service URL), then the actual provisioner name of that particular self-service is the same.

So, in the case of the following self-service configurations, I've created two Self-Service provisionsers, "selfserviceuser" and "selfserve." In your case, students would go to the selfserviceuser URL (i.e., https:///GIM/user/selfserviceuser" and register themselves or their device.

The provisioner, "selfserviceuser" could then login to the provisioner login page using "selfserviceuser" as the provisioner username/password and see those devices.

The caveat to this, and maybe this is exactly what you're asking, is that there is no method - right now - for the selfserviceuser provisioner to see users/devices registered with the selfserve service. As the product stands right now, the entirety of all devices/guests - both self-service created or provisioner-created - can only be done by the admin account.

Re: Guest and IoT Manager Administration

Rodney_Lacroix — Wed, 19 Jun 2019 02:42:53 GMT

To answer this question:

Doesn't enabling "Provisioners using this Onboarding Template can view and edit each other's records" in the template let all members of that template edit each other? As in I want the helpdesk to be able to view/edit these entries but I wouldn't want one student to be able to view/edit another students devices.

I can offer this:

Your individual students aren't necessarily provisioners unless you make them provisioners. The typical deployment scenario is that a Helpdesk person would be a "provisioner" and have the task of onboarding the devices/guests. In that case, the guest accounts (student account) would have no long to the "provisioner" url of GIM and, therefore, not be able to see anything - only the accounts designated as provisioners.

If you have a large student population and you want them to onboard their own devices, I'd suggest the self-service option.

The other option is designating provisioners that would onboard the devices/guests (students). Then you'd have control, as admin creating onboarding templates, on what each provisioner account can see.

Re: Guest and IoT Manager Administration

Matthew_Perry — Wed, 19 Jun 2019 02:49:18 GMT

Oh that's a different method then I was testing. I was added the AD group to the template so they could login as a provisioner. I'll have to see what the benefits of doing it this way are.