# Least permissions

> Prerequisites and least-privilege service account permissions for each OneFuse module endpoint type

---

Site [llms.txt](/llms.txt)

---

## Ansible Tower

For OneFuse Ansible Tower Modules.

1. Create or determine the **Service Account** for the OneFuse Ansible Tower Module.
2. Log in to Ansible Tower as an **Administrator**.
3. Go to **Access** > **Users**.
4. Add the **Service Account** via either **Local Users** or **LDAP User Account** (do not use Social, Azure AD, or Kerberos). If the desired Service Account already exists, edit the user.
   1. Under the **Details** section for the user, verify the following:

      | Setting | Selection |
      | --- | --- |
      | User Type | Normal User |

   2. Select **Save**.
   3. Under the **Permissions** tab for the Service Account, perform the following:

      | Resource | Selection | Role |
      | --- | --- | --- |
      | Organizations | Select all Organizations OneFuse will integrate with | Member |
      | *For granular permissions instead of at an Organizational level, set below:* | | |
      | Projects | Select all Projects OneFuse will integrate with | Use |
      | Job Templates | Select all Job Templates OneFuse will integrate with | Execute |
      | Inventories | Select all Inventories OneFuse will integrate with | Inventory Admin |

   4. **Save** the user.

## BlueCat

For OneFuse BlueCat IPAM and/or DNS Modules.

1. Create or determine the **Service Account** for the OneFuse BlueCat Module IPAM and/or DNS.
2. Log in to BlueCat as an **Administrator**.
3. Go to **Administration** > **Users and Groups**.
4. Add the **Service Account** via either **Local Users** or **Groups**. If the desired Service Account already exists, edit the user.
   1. Under **User Access** for a Local User, verify the following:

      | Setting | Selection |
      | --- | --- |
      | Administrator | Do **not** check the Administrator checkbox |
      | Security Privilege | No Access |
      | History Privilege | Hide |
      | Access Type | API |

   2. Under **General** for a Group, verify the following:

      | Setting | Selection |
      | --- | --- |
      | Administrator Privilege | Do **not** check the Administrator checkbox |

   3. **Save** the user or group.
5. **Grant rights to the BlueCat Configuration**:
   1. Go to **Administration** > **Configurations**.
   2. Select the desired Configuration from the Configuration list.
   3. Scroll down to **Access Rights** and select **New Access Right...**.
   4. Select the Service Account Local User or Group and select **Add**.
   5. Select the following:

      | Setting | Selection |
      | --- | --- |
      | **Access Right** | |
      | Default Access | View |
      | Default Access | Quick Deployment (checked) |
      | **Overrides** | |
      | **IPv4 Objects** | |
      | IPv4 Address | Full Access |
      | **Resource Records** | |
      | Alias Record | Full Access |
      | Host Record | Full Access |

   6. Select **Add** to save the Configuration's Access Rights.

## Infoblox

For OneFuse Infoblox IPAM and/or DNS Modules.

1. Create or determine the **Service Account** for the OneFuse Infoblox Module IPAM and/or DNS.
2. Log in to Infoblox UI as an **Administrator**.
3. Go to **Administration** > **Administration** > **Groups**.
4. Add a new **Infoblox Admin Group**:

   | Setting | Selection |
   | --- | --- |
   | **Step 1 of 8 - Allow access from** | |
   | Allow access from | Any |
   | **Step 5 of 8 - Roles** | |
   | Allowed Interfaces | API (required); GUI (recommended for troubleshooting); Cloud API only (No PAPI) |

5. **Save** the new Infoblox Admin Group.
6. Select the **Permissions** tab.
7. Select **+** to **Create a New Permission**.
   1. Select the Infoblox Group from Step 4 from the dropdown for **Group Permission**.
   2. Select the following from the **Permission Type** dropdown and check the specified permissions:

      **IPAM permissions** (Infoblox IPAM OneFuse Module):

      | Resource/Functions | Read/Write | Read-Only |
      | --- | --- | --- |
      | All Network Views | | Yes |
      | All Hosts | Yes | |

      **DHCP permissions** (Infoblox IPAM OneFuse Module):

      | Resource/Functions | Read/Write | Read-Only |
      | --- | --- | --- |
      | All Network Views | | Yes |
      | All Hosts | Yes | |
      | All IPv4 DHCP Fixed Addresses/Reservations | Yes | |

      **DNS permissions** (Infoblox DNS OneFuse Module):

      | Resource/Functions | Read/Write | Read-Only |
      | --- | --- | --- |
      | All DNS Views | | Yes |
      | All Hosts | Yes | |
      | All A Records | Yes | |
      | All PTR Records | Yes | |

      **Grid permissions** (only for using Infoblox with Microsoft DHCP Ranges):

      | Resource/Functions | Read/Write | Read-Only |
      | --- | --- | --- |
      | All Microsoft Servers | Yes | |

   3. Select **Save & Close** to save the Permissions.
8. Add or verify that the **Service Account** is in the Infoblox Admin Group.

## Men&Mice Micetro

For OneFuse Men&Mice Micetro IPAM and/or DNS Modules.

1. Create or determine the **Service Account** for the OneFuse Men&Mice Micetro Module IPAM and/or DNS.
2. Log in to Men&Mice Micetro Management Console as an **Administrator**.
3. Go to **Tools** > **User Management** > **Roles**.
4. Select **Add** to add a new Role.
   1. Provide a Name (for example, `OneFuse_WebAccess`) and optional Description.
   2. Select **OK**.
5. Select **Tools** > **Global Access**.
   1. Under **Group, role or user names**, select **Add** and add the Role created in Step 4.
   2. Under **Permissions for \<Role Name\>**, select the following:
      - **Access to the web interface** (checked)
   3. Select **OK** to save.
6. Add the **Service Account** to either **Users** or **Groups**. If the desired Service Account already exists, edit the user.
   - Under **Roles**, select the following:
     - The Role created in Step 4 (checked)
     - **DNS Administrators (built-in)**: for the Men&Mice Micetro DNS OneFuse Module
     - **IPAM Administrators (built-in)**: for the Men&Mice Micetro IPAM OneFuse Module
   - Select **OK** to save.

## Microsoft

For the following OneFuse Microsoft Module(s): Active Directory, DNS, and IPAM.

1. Verify [Windows NTP](https://docs.microsoft.com/en-us/windows-server/networking/windows-time-service/windows-time-service-tools-and-settings) is set up correctly.
2. Create or determine the **Service Account** for the OneFuse Microsoft Module(s) Active Directory, DNS, and/or IPAM.

### Jump server

Perform the following if utilizing an OpenSSH Jump Server to the target AD/DNS and/or IPAM server.

<div class="alert alert-info" role="alert"><div class="h4 alert-heading" role="heading">Prerequisites</div>



- Install and configure **OpenSSH** on the Jump Server.
- Verify **Firewall rules** are open between the Jump Server and OneFuse Appliance(s).

</div>


Perform the following on all Windows Jump Server(s):

**RSAT (Remote Server Administration Tools):**

Resource: [Remote Server Administration Tools](https://docs.microsoft.com/en-us/windows-server/remote/remote-server-administration-tools)

1. Log in to the Jump Server as an **Administrator**.
2. Open **Server Manager** and select **Manage** > **Add Roles and Features**.
3. Accept defaults and select **Next** until the **Server Selection** tab.
4. Select the desired server from the list in **Server Selection** and select **Next**.
5. Accept defaults and select **Next** for **Server Roles**.
6. In the **Features** tab, scroll down and select **Remote Server Administration Tools**:

   | Module | Role(s) |
   | --- | --- |
   | Active Directory | Role Administration Tools: AD DS and AD LDS Tools |
   | DNS | Role Administration Tools: DNS Server Tools |
   | IPAM | Feature Administration Tools: IP Address Management (IPAM) Client |

7. Select **Next**.
8. Optionally have the server restarted, or leave the option unchecked and select **Install**.
9. Select **Close**.
10. Once installation completes, select **Tools** on the top-right menu of the **Server Manager**. Verify the following is listed:
    - **Active Directory**: Active Directory Users and Computers
    - **DNS**: DNS

**Local temporary folder permissions:**

1. Create a folder for storing OneFuse PowerShell Scripts (for example, `C:\OneFuse`).
2. Add the **Service Account** to the **Group or user names** for the Temporary Folder with the following **Allow** permissions:
   - Modify
   - Read & execute
   - List folder contents
   - Read

**Permission to run remote PowerShell scripts:**

1. Log in to the Jump Server as an **Administrator**.
2. Open **PowerShell**.
3. Run the following command and confirm when prompted.

   <div class="alert alert-warning" role="alert">


   This action could have a serious impact on your system and will enable other users/groups to run commands on the server.
   </div>


   ```powershell
   Set-PSSessionConfiguration -Name Microsoft.PowerShell -showSecurityDescriptorUI
   ```

4. Add the **Service Account** to **Select Users, Computers, Service Accounts, or Groups** with the following **Allow** permissions:
   - Full Control (All Operations)
5. Select **OK** and then confirm **Yes** to apply the change.

**Set WMI Control settings:**

1. Log in to the Jump Server as an **Administrator**.
2. From the Computer Management console, expand **Service and Applications**.
3. Right-click on **WMI Control** and select **Properties**.
4. Select the **Security** tab.
5. Expand the **Root** folder and select **CIMV2**, then select the **[Security]** button.
6. Add the **Service Account** to the **Groups or user names**.
7. Select the **Service Account** and select **Advanced** next to "For special permissions or advanced settings".
8. On the **Permissions** tab, select the desired user in **Permissions entries** and select **Edit**.
9. Select the following permissions:
   - **TYPE**: Allow
   - **APPLIES TO**: This namespace and subnamespaces
   - **PERMISSIONS**: Execute Methods, Enable Account, Remote Enable
10. Select **OK** to apply the changes.

**Add the IPAM server to the Jump Server's server pool:**

<div class="alert alert-warning" role="alert">


Perform if using this Jump Server for the Microsoft IPAM OneFuse Module.
</div>


1. Log in to the Jump Server as an **Administrator**.
2. Open **Server Manager** and right-click on **All Servers**, then select **Add Servers**.
3. In the **Add Servers** wizard, enter the IPAM Server Name and select **Find Now**.
4. Highlight the server name, select the arrow in the center to add it to the list, and select **OK**.
5. The IPAM server will appear in the list of servers.
6. Repeat for each IPAM server.

### Active Directory

Perform the following on all Windows servers for **Microsoft Active Directory** to enable creating, moving (optional), and deleting Computer Objects; creating and deleting OUs; and adding Computer Objects to Security Groups.

**Source**: [Delegating Administration by Using OU Objects](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/delegating-administration-by-using-ou-objects)

**Service:**

1. Verify **Active Directory Web Services** (ADWS) is installed. For Windows Server 2012 and newer, ADWS is pre-installed.
2. Recommended: Configure ADWS to start automatically on all servers.

**Computer Object delegation rights:**

<div class="alert alert-info" role="alert">


The following need to be applied to each top-level OU as required; child OUs will have the permissions applied automatically.
</div>


Delegate the following permissions to the Service Account on the appropriate OU to create/delete (and move) Computer Objects.

1. Create a Custom Task to delegate only on **Computer Objects**.
2. Select the following permissions for **Create selected objects in this folder** and **Delete selected objects in this folder**:
   - Read all properties
   - Create all child objects
   - Delete all child objects
3. If planning on building computers into a **Build OU**, add the following permissions:
   - Read
   - Write

**OU Object security rights:**

<div class="alert alert-info" role="alert">


The following need to be applied to each top-level OU as required; child OUs will have the permissions applied automatically.
</div>


Delegate the following permissions to the Service Account on the appropriate OU to create/delete OUs within the specified OU.

1. In the **Properties** of the OU, go to **Security** > **Advanced** and select **Add New Permissions**.
2. Select the desired **Service Account** and add the following:
   - **TYPE**: Allow; **APPLIES TO**: This object and all descendant objects; **PERMISSIONS**: List Contents, Read all properties, Write all properties, Read permissions, Create Organization Unit objects, Delete Organization Unit objects
   - **TYPE**: Allow; **APPLIES TO**: Descendant Organizational Unit objects; **PERMISSIONS**: List Contents, Read all properties, Write all properties, Read permissions, Delete, Create Organization Unit objects, Delete Organization Unit objects

**AD Security Group permission set:**

<div class="alert alert-info" role="alert">


The following delegation depends on whether it is to an OU or a Group(s).
</div>


Delegate the following permissions to the Service Account on the appropriate OU to place Computer Accounts into Security Group(s):

- Modify the membership of a Group

### DNS

Perform the following on all Forward and/or Reverse DNS Zones on Windows servers for **Microsoft DNS**.

**Configure Read-Access permissions to the top DNS server layer:**

1. In the **DNS Manager** window, right-click and select **Properties** of the DNS server.
2. Add the **Service Account** with the following permissions:
   - Read

**Configure Forward Lookup Zone(s):**

<div class="alert alert-info" role="alert">


Perform the following if registering/removing **A records**.
</div>


1. In the **DNS Manager** window, right-click on the Forward Zone where records are being registered.
2. In the **Security** tab, add the **Service Account** to the users list.
3. Select **Advanced** to verify the following permissions:
   - **TYPE**: Allow
   - **APPLIES TO**: This object and all descendant objects
   - **PERMISSIONS**: List Contents, Read all properties, Write all properties, Delete, Delete subtree, Read permissions, Modify permissions, Modify owner, All validated writes, Create all child objects, Delete all child objects
   - All **Properties** should be selected/checked.

**Configure Reverse Lookup Zone(s):**

<div class="alert alert-info" role="alert">


Perform the following if registering/removing **PTR records**.
</div>


1. In the **DNS Manager** window, right-click on the Reverse Lookup Zone where records are being registered.
2. In the **Security** tab, add the **Service Account** to the users list.
3. Select **Advanced** to verify the following permissions:
   - **TYPE**: Allow
   - **APPLIES TO**: This object and all descendant objects
   - **PERMISSIONS**: List Contents, Read all properties, Write all properties, Delete, Delete subtree, Read permissions, Modify permissions, Modify owner, All validated writes, Create all child objects, Delete all child objects
4. All **Properties** should be selected/checked.

### IPAM

Perform the following on all Windows servers for **Microsoft IPAM**.

**Services:**

1. Verify **IPAM client** is installed:
   1. **Server Manager** > **Manage** > **Add Roles and Features**.
   2. Accept defaults and select **Next** until the **Features** option.
   3. Expand **Remote Server Administration Tools** > expand **Feature Administration Tools**.
   4. Select **IP Address Management (IPAM) Client**.
   5. Confirm and select **Install**.
2. Enable non-local administrators to run IPAM cmdlets in PowerShell (see Microsoft's IPAM documentation).

**Run IPAM PowerShell cmdlets:**

1. Follow Microsoft's instructions for enabling non-local administrators to run IPAM cmdlets in PowerShell.

**Service Account in Remote Management Users:**

1. Verify the **Service Account** is part of the following built-in Windows Group to allow remote connectivity:
   - Remote Management Users

**Microsoft IPAM Roles:**

1. Verify the **Service Account** has the following **Built-in Roles** in **Microsoft IPAM**:
   - **IP Address Record Administrator Role**, or a custom role with: Create IP address, Edit IP address, Delete IP address
   - **DNS Record Administrator Role**, or a custom role with: Create DNS resource records, Delete DNS resource records

   Source: [View Roles and Role Permissions](https://docs.microsoft.com/en-us/windows-server/networking/technologies/ipam/view-roles-and-role-permissions)

## ServiceNow

For OneFuse ServiceNow CMDB Module and/or OneFuse ServiceNow Connector.

1. Create or determine the **Service Account** for the OneFuse ServiceNow CMDB Module and/or ServiceNow Connector.
2. Log in to ServiceNow as an **Administrator**.
3. Go to **User Administration** > **Users**.
4. Add the **Service Account** to **Users** and select **Submit**.
5. Once the desired Service Account exists, edit the user.
6. Select the **Roles** tab and add/verify the following Roles:

   | OneFuse Module | OneFuse purpose | Role(s) |
   | --- | --- | --- |
   | ServiceNow Connector | Specific MID Server Account | `mid_server` |
   | ServiceNow Connector | OneFuse Service Account | `x_sovla_onefuse.admin`; `mid_server` only if this account will also be used as the MID Server account |
   | ServiceNow CMDB | OneFuse Service Account | `asset` (to add and update records); `itil` (to utilize the ServiceNow IRE API); `web_service_admin` (to utilize the ServiceNow API) |

7. Select **Update** to save.

## SolarWinds

For OneFuse SolarWinds IPAM Module.

1. Create or determine the **Service Account** for the OneFuse SolarWinds Module IPAM.
2. Log in to SolarWinds Orion as an **Admin**.
3. Go to **Admin** > **Accounts** > **Manage Accounts**.
4. Add the **Service Account** to either **Individual Accounts**, **Windows Groups**, or **SAML Groups**. If the desired Service Account already exists, edit the user.
5. Under **Default Summary View**, select to expand **IP Address Manager Settings** and verify the following:

   | Setting | Selection |
   | --- | --- |
   | IPAM Summary View | IP Address Manager |
   | IPAM Address Details View | IPAM IP Address Details - IP Address Details |
   | IPAM DHCP Server View | DHCP Server Details |
   | IPAM Roles & Permissions | Power User: read/write access and can initiate scans to all subnets. Full access to DHCP and DNS management. |

6. Select **Submit** to save.

<div class="alert alert-warning" role="alert">


**SolarWinds 4.9** requires **FULL admin rights** (not only Admin for IP Address Manager Settings). SolarWinds is tracking this bug under reference IPAM-2651.
</div>


## VMware Aria Automation

For OneFuse VMware Aria Automation Module.

- For **VMware Aria Automation 8x/Cloud**, refer to the [VMware Aria Automation installation and setup](/docs/onefuse/consume/vmware-aria-automation/aria-automation-8x/installation-and-setup/) section to create the OneFuse Service Account or API Token.
- For **VMware vRealize Automation 7.6**, refer to the [VMware vRealize Automation 7.6 installation and setup](/docs/onefuse/consume/vmware-aria-automation/vrealize-automation-76/installation-and-setup/) section to create the OneFuse Service Account.