lets talk about users and permissions

[timmi]

my point of view:
it's nice to link users with hosts, so they can do anything whith it - add items, graphs, map, etc... all you have to do - just create empty host and link it with the user, so he becomes an administrator of host (or group of hosts).
The mechanism can be similar with links between hosts and groups - with checks what user can or can't do with, for example, graphs - add new or just update current.

A greate truble with allowing user to add items - some users can add hundreds оf items with 5-second update interval and make slow system. One of decisions - set limits for users like max number of values stored in database - for all its hosts and items so if he have limit 50000 values and want to add item with a month of of history and 5 second update interval he try to reserve 20(values per minute)x60(minutes)x24(hours)x30(day)=86400 values and can't add this item. He have to decide - decrease history time or decrase update interval. In fact we grant recources of zabbix for user.

another possible decision of this problem - allow only insert items from template which host linked with, with default update interval and history from template or allow to add any item for this host.


PS - sorry for my english

[James Wells]

Greetings,

While overall, I agree with you, I do have one point I tned to disagree with...

my point of view:
it's nice to link users with hosts, so they can do anything whith it - add items, graphs, map, etc... all you have to do - just create empty host and link it with the user, so he becomes an administrator of host (or group of hosts).

When dealing with less than 20 or so users, I will agree with you, however, when you are dealing with the number of users I am, controlling access at the user level is a bit insane. Instead, my view is that, you should control access at the user group, or even server group level.

In my data center, I have roughly 50 users, broken down into 15 groups, each group has a number of clients that only they need access to. Under the current methodology, I have to go through and configure all 50 users individually. So let's assume that each user needs access to only 5 servers, I have to configure access 250 times. Now if, instead, we did it at the user group level, now I only have to configure access 75 times.

Now, the ideal way would be to use the user group to control the server group. You could change a users's access simply by changing the user group they are in. Additionally, you could mix and match access to clients, simply by changing the server groups that they are in.