Security, Authentication, and Access Control
What this domain tests
Security questions test the difference between authentication and authorization, the role of the NetWorker Authentication Service, local versus AD/LDAP identities, user-group privileges, NMC roles, and restricted data zones.
Authentication
NetWorker uses the NetWorker Authentication Service (authc) to validate identities. Local users can be created in the authentication service; enterprise users can come from Active Directory or LDAP. nsrlogin caches credentials for command-line use, and nsradmin operations are subject to NetWorker authentication and authorization. If authc is unavailable, console and command-line logins can fail even though nsrd is running.
Authorization and roles
Authentication proves who you are; authorization determines what you can do. NetWorker uses user groups with privileges such as Admin, Operator, Monitor, Backup, and Recover. External roles map AD or LDAP groups to NetWorker user groups. NMC has its own console roles, including Console Admin, Console User, and Security Admin; these are not the same as NetWorker user-group privileges. A user can authenticate successfully but still be denied an operation because no role grants the needed privilege.
Restricted data zones
Restricted data zones (RDZs) provide multi-tenant separation so tenants see only their own clients, devices, and save sets. They require careful assignment of resources and users; a misassigned resource can expose data across tenants.
Worked example
An AD user can log in to NMC but cannot start a restore. Authentication works because authc accepts the AD credentials and the external role mapping succeeds. Authorization fails because the mapped NetWorker user group has Monitor or Backup privilege but not Recover privilege. Add the user’s group to a user group with the required recover privilege, then retest. Changing the password or restarting nsrd would not fix this.
Traps
Do not confuse NMC console roles with NetWorker user-group privileges. Do not assume an AD group grants access until the external role mapping is configured. Do not grant Admin privilege to solve a recover-only problem. Remember that authc availability affects both console and CLI access.