Manage Users

Account Components

Concerto uses the following components to implement user accounts:

• Concerto views—A view is the specific set of menus that a user can see in Concerto. There are two Concerto views:
  • Service Provider view—This view allows the user to perform actions on the Concerto infrastructure and manage tenants.
  • Tenant view—This view allows the user to perform actions for a single tenant.
• Account types—The account type determines which views a user can access and whether the user has full or read-only access to the views.
  There are four types of user accounts:
  • Service Provider Administrator—Provides full access to Service Provider view and Tenant views for all tenants.
  • Service Provider Operator—Provides read-only access to Service Provider view and Tenant views for all tenants.
  • Enterprise Administrator—Provides full access to Tenant view for a single tenant.
  • Enterprise Operator—Provides read-only access to Tenant view for a single tenant.
• Permissions—Permissions identify which operations you can perform on objects. Objects include lifecycle menus, tables shown on lifecycle screens, and SD-WAN configuration objects such as CGNAT profiles.
  There are 3 categories of permissions:
  • General permissions for lifecycle menus and screens—You set these permissions from the Add Role or Edit Role screen when you add or edit a role.
  • Individual region, site, or device permissions—(Releases 13.1.1 and later.) You set these permissions from the configuration screen for the region, site, or device. See Set Permissions for Individual Regions,  Sites, and Devices, below.
  • Individual SD-WAN configuration object permissions—You set these permissions from the Permissions step in the workflow for the object. See Object Permissions in Versa Concerto for SD-WAN.
• Concerto roles—You assign a role to each user account, and the role determines the account type and permissions for the account. 
  
  The role of the current account displays in the upper-right corner of the Concerto UI. In the following example, the user is logged into account dev1, which has role Service Provider Administrator.
  
  
  
  Concerto comes pre-configured with a default role for each account type. You can create additional roles, which are referred to as custom roles.

Concerto Lifecycles

The top-level menu in Concerto displays a navigation panel on the left side of the screen. This panel lists the lifecycles that are available in the current Concerto view. 

The following table lists the two Concerto views with their corresponding navigation panels and lifecycles. 

View	Navigation Panel	Lifecycles
Service Provider view		Tenants Inventory Users—You cannot change permissions for this lifecycle. Service provider administrators are automatically granted permission to perform all actions for all User lifecycle menu options and service provider operators are granted read-only permissions. Infrastructure Subscriptions Settings
Tenant view		View Configure Deploy Analytics Inventory Users Settings

Create User Accounts

This section describes how to create service provider and enterprise accounts.

Manage Concerto Roles

Roles determine the account type and permissions for an account.

Configure Default Account Settings

For Releases 11.4.1 and later.

You can configure settings for user accounts such as settings for password policy and login attempts. Account settings apply to both service provider and enterprise accounts.

To configure account settings:

1. In Service Provider view, select Users > User Settings.
   
   
   
   The following screen displays.
   
   
2. Enter information for the following fields.
    

   Setting	Description
   Maximum Number of Login Attempts Allowed Before Account is Locked	Enter the number of user login attempts that are allowed before the user's account access is locked. Configuring a maximum number of login attempts protects against brute force login attacks.
   Default Time for Locked Account to Unlock	Enter the default time before a locked account is unlocked, in seconds. If a user enters the wrong password too many times and is locked out, the user's account is unlocked after this amount of time has passed.
   Number of Days of Inactivity Before Account is Deactivated	Enter the number of days that an account can be inactive before the account is deactivated.
   Number of Days Before Account Expires	Enter the number of days before an account expires.
   Time Interval Before User Can Reset Password Again (secs)	If a user resets their password, enter the amount of time, in seconds, that must pass before the user can reset their password again.
   Concurrent Login Policy	Select a concurrent login policy. A concurrent login allows a user to log in to a system using the same credentials but using different devices. Note that this field is supported in Versa Director Releases 22.1 and later. Allow—Allow concurrent logins. Deny—Do not allow concurrent logins. Force Logout—The active user is logged out before another user can log in with the same credentials.
   Minimum Password Length	Enter the minimum length of the password. Note that this field is supported in Versa Director Releases 22.1 and later.
   Require at Least One Uppercase Letter in Password	Click the toggle to require at least one uppercase letter in a password.
   Require at Least One Lowercase Letter in Password	Click the toggle to require at least one lowercase letter in a password.
   Require at Least One Number in Password	Click the toggle to require at least one number in a password.
   Require at Least One Special Character in Password	Click the toggle to require at least one special character in a password.
   Require User to Reset Password on First Login	Click the toggle to require a user to reset their password when logging in for the first time.
   Prohibit Dictionary Words in Password	Click the toggle to prohibit users from using dictionary words in their password. A password dictionary contains a list of words or characters that users may not use in their passwords. Note that this field is supported in Versa Director Releases 22.1 and later.
   Enable Password History	Click the toggle to enable password history. Number of Passwords to Keep in Password History—Enter a number of passwords to keep in the password history (or use the up and down arrows) that the user is not allowed to reuse.
   Expire Password	Click the toggle to expire passwords. Number of Days Before Password Expires—Enter the number days before a password expires (or use the up and down arrows).

3. Click Submit.

Manage User Accounts

This section describes how to perform actions for existing user accounts. Only service provider administrators can manage service provider accounts. Both service provider and enterprise administrators can manage enterprise accounts. You can perform the following actions:

• Delete
• Edit
• Force Logout
• Reset Password
• Unlock Account

To manage user accounts:

1. Navigate to the Users table for the account type.
   • For service provider accounts, go to Service Provider view and select Users > Users.
   • For enterprise accounts, go to Tenant view and select Users > Users.
     
     The Users table displays.
     
     
2. To delete an account, hover over the row for an account and select the  Delete icon.
3. To unlock, reset a password, or force a logout for an account, hover over the row for an account and then click the  3-dot icon. Note that some actions are only available when the requirements described below display. 
    

   Action	Requirement	Description
   Unlock	User Name field displays a lock icon	Unlock the password for the account.
   Reset Password		Reset the account password. When you reset the password, the next time the user logs into the account, they are presented with the following screen to reset their password.
   Force Logout	Active field is Yes	Force the user to be logged out of the account.

4. To edit an account: 
   1. Hover over the row for the account, and then click the   Edit icon. The Edit User window displays.
      
      
   2. Select the General tab, and make your changes.
   3. Click Next or select the Settings tab.
      
      
       
   4. Make your changes and then click Save.

View and Export Audit Logs

For Releases 11.4.1 and later.

Internal audit logs capture information about all activity on Concerto, including all internal URLs that were visited, the payloads for each request, the actions that occur as a result of the request, and all errors that were encountered. The logs are placed in the Concerto audit tables, and they are also sent to Versa Director. 

There are separate log tables for actions performed in service provider and Tenant views.

To view and export audit logs:

1. To view audit logs for actions taken in Service Provider view:
   1. In Service Provider view select Users > Audit Logs.
      
      
      
      The Audit Log table for Service Provider view displays. 
      
      
   2. Continue to Step 3.
2. To view audit logs for actions taken in Tenant view: 
   1. In Tenant view select Users > Audit Logs.
      
      
      
      The Audit Log table for the current tenant displays. 
      
      
   2. Continue to Step 3.
3. To view details for a log entry, click theArrow icon to the left of the username. The log entry details display. 
   
   

   Field	Description
   Change Set	(For audit logs with the Modified action) Displays a comparison of the previous and updated versions of the object. This option displays in the audit log any time after you modify an object, including before you publish the object to the SD-WAN branch.
   Payload	Displays the content of the request. To maintain user privacy, sensitive user information is replaced with asterisks (****).
   Trace ID	Displays the trace ID associated with the request. When a user clicks a link in Concerto, Concerto generates a trace ID for the request.
   Operation	Displays audit logs for the listed operation.
   Session ID	Displays audit logs for the login session in which the action in this row was performed.
   Resource Group	Displays audit logs for the listed resource group.
   Resource	Displays audit logs for the listed resource.
   HTTP Method	Displays the HTTP method: DELETE GET HEAD PATCH POST PUT
   Task	Displays all the task details. This option displays in the audit log only after you publish the SD-WAN branch.
   View Diffs	(For audit logs with the Modified action) Click View to display the differences between last published configuration and the current published configuration. This option displays in the audit log only after you publish the SD-WAN branch.

4. To filter the Audit Logs table display:
   1. ClickShow Filter Bar icon. The Action filter displays by default. Note that you can delete this filter by clicking the  Delete icon in the field.
      
      
       
   2. To define an Action filter, select one of the following values from the Action drop-down list:
      • Created—Select to view audit logs with value Created in the Action column.
      • Deleted—Select to view audit logs with value Deleted in the Action column.
      • Modified—Select to view audit logs with value Modified in the Action column.
      • Read—Select to view audit logs with value Read in the Action column.
      • None—Select to view audit logs where no action is listed in the Action column. For example, at the service provider level for CLI operations, such as upgrade and show commands.
   3. To add a filter, click the Add Filter icon, and then select one of the following query types for filtering the log information.
      
      
       

      Query	Description
      Change Set	Search on a string of characters in an error message. Select the string search type: Contains—Results contain the search string that you enter. This is the default. RegEx—Results match a regular expression that you enter.
      Duration	Search on the duration of the requests: Seconds—Click to enter a search duration in seconds. This is the default. Milliseconds—Click to enter a search duration in milliseconds.
      Object Name	Search on an object name such as master profile, appliance, rule, element, profile, or subprofile name. Select the string search type: Contains—Results contain the search string that you enter. This is the default. Exact—Results contain the exact search string that you enter. RegEx—Results match a regular expression that you enter.
      Object Type	Search on an object type.
      Object Subtype	Search on an object subtype.
      Object Subtype Category	Search on an object subtype category.
      Operation	Select the type of operation to query. Select the string search type: Contains—Results contain the search string that you enter. This is the default. Exact—Results contain the exact search string that you enter. RegEx—Results match a regular expression that you enter.
      Payload	Search on a string of characters in the payload. Select the string search type: Contains—Results contain the search string that you enter. This is the default. RegEx—Results match a regular expression that you enter.
      Resource	Search on the type of resource. Select the string search type: Contains—Returns results that contains search string. This is the default keyword. Regex—Returns results that matches regular expression search string.
      Resource Group	Search on the type of resource group. Select the string search type: Contains—Returns results that contains search string. This is the default keyword. Exact—Returns results that matched the exact search string. RegEx—Returns results that matches regular expression search string.
      Date and Time Created	Search on the date and time: Preset—Returns results within the 7 days or a week. Custom—Returns results within a custom start date and end date.
      Status	Select the status on which to query: Client Error Redirection Server Error Successful
      Status Code	CLI Status Codes: 0—CLI exit code of 0 means that the CLI operation was successful. 1—CLI exit code of other than 0 means that the CLI operation was not successful. 126—CLI exit code of 126 means that a command was found but it is not executable. 127—CLI exit code of 127 means that a command was not found. HTTP Status Codes: 200—OK. The request succeeded. 201—Created. The request succeeded, and a new resource was created as a result. 204—No content. There is no content to send for this request, but the headers may be useful. 302—Found. The URI of requested resource was changed temporarily. Further changes in the URI may be made in the future. 400—Bad request. The server could not understand the request because of invalid syntax. 401—Unauthorized. The client must authenticate itself to receive the requested response. 403—Forbidden. The client does not have access rights to the content. 404—Not found. The server cannot find the requested resource. 405—Not acceptable. The web server, after performing server-driven content negotiation, found no content that conforms to the criteria given by the user agent. 500—Internal server error. The server encountered a situation that it does not know how to handle.
      Tenant Name	Select the tenant name.
      Trace ID	Enter an exact trace ID on which to query.
      Session ID	Enter an exact session ID on which to query.
      Username	Select the username on which to query. Select the string search type: Contains—Returns results that contains search string. This is the default keyword. Exact—Returns results that matched the exact search string. RegEx—Returns results that matches regular expression search string.

   4. Click Apply to apply the filter.
5. To export the logs in the audit logs table, after applying any filters, to a CSV file:
   
   
   1. Click Download CSV. The Download Audit List window displays.
   2. Enter values for the starting and ending rows. You can download a maximum of 5000 logs at a time.
      
      
   3. Click Download.

Encryption of Sensitive Information in Concerto

For Releases 13.1.1 and later.

Concerto nodes encrypt all sensitive information in a configuration before pushing the configuration to VOS devices. The sensitive information is also stored in the database on the Concerto node itself. Concerto nodes automatically encrypt and store sensitive configuration data such as passwords, keys, certificates files, and variables. This includes IPsec preshared keys (PSKs), the LDAP server profile bind password, and the passwords for local database users and user-authentication profile passwords. 

The following sample screens show how sensitive data is encrypted and protected in different configuration scenarios, after the password is saved.

• The sample screen below shows that the Bind Password used in the User and Device Authentication Profile configuration is stored in encrypted format in the database.
  
  
• The sample screen below shows that the Shared Key used in the site-to-site tunnels IPsec information is stored in encrypted format in the database.
  
  
• The sample screen below shows the encrypted certificate and private key files that are stored in the database as sensitive files.
  
  
• The sample screen below shows the encrypted sensitive variables used as parameters in a Main Template. Sensitive template variables are encrypted before being stored in the system.
  
  

Supported Software Information

Releases 10.1.1 and later support all content described in this article, except:

• Release 10.2.1 adds the Active column in the Users screen; adds support for the unlocking users from Concerto, changing passwords, resetting forgotten passwords, forcing user logout, and discovering appliances created in Versa Director; adds support for two-factor authentication.
• Release 11.3.1 adds support for mapping an external user role to a local Concerto role.
• Release 11.4.1 adds support for audit logs; adds the User Settings screen; adds support for mapping external custom roles to local Concerto custom roles.
• Release 13.1.1 adds support for permissions for individual sites and devices; adds support for encrypted sensitive information.

Additional Information

Configure Single Sign-On Using Director
Configure User Account Settings
Versa Concerto for SD-WAN.