Administrative domains (ADOMs)
Administrative domains (ADOMs) enable the admin administrator to constrain other FortiWeb administrators’ access privileges to a subset of policies and protected host names. This can be useful for large enterprises and multi-tenant deployments such as web hosting.
ADOMs are not enabled by default. Enabling and configuring administrative domains can only be performed by the admin administrator.
Enabling ADOMs alters the structure of and the available functions in the GUI and CLI according to whether you're logging in as the admin administrator, and, if you are not logging in as the admin administrator, the administrator account’s assigned access profile.
Differences between administrator accounts when ADOMs are enabled
admin administrator account |
Other administrators | |
|
Access to config global |
Yes |
No |
|
Can create administrator accounts |
Yes |
No |
|
Can create & enter all ADOMs |
Yes |
No |
If ADOMs are enabled and you log in as admin, a superset of the typical CLI commands appear, allowing unrestricted access and ADOM configuration.
config global contains settings used by the FortiWeb itself and settings shared by ADOMs, such as RAID and administrator accounts. It does not include ADOM-specific settings or data, such as logs and reports. When configuring other administrator accounts, an additional option appears allowing you to restrict other administrators to an ADOM.
If ADOMs are enabled and you log in as any other administrator, you enter the ADOM assigned to your account. A subset of the typical menus or CLI commands appear, allowing access only to only logs, reports, policies, servers, and LDAP queries specific to your ADOM. You cannot access global configuration settings or enter other ADOMs.
By default, administrator accounts other than the admin account are assigned to the root ADOM, which includes all policies and servers. By creating ADOMs that contain a subset of policies and servers, and assigning them to administrator accounts, you can restrict other administrator accounts to a subset of the FortiWeb’s total protected servers.
The admin administrator account cannot be restricted to an ADOM. Other administrators are restricted to their ADOM, and cannot configure ADOMs or global settings.
To enable ADOMs
Log in with the admin account.
Other administrators do not have permissions to configure ADOMs.
|
Back up your configuration. Enabling ADOMs changes the structure of your configuration, and moves non-global settings to the root ADOM. For details about how to back up the configuration, see backup full-config. |
Enter the following commands:
config system global
set adom-admin enable
end
FortiWeb terminates your administrative session.
Log in again.
When ADOMs are enabled, and if you log in as admin, the top level of the shell changes: the two top level items are config global and config vdom.
-
config globalcontains settings that onlyadminor other accounts with the prof_admin access profile can change. -
config vdomcontains each ADOM and its respective settings.
This menu and CLI structure change is not visible to non-global accounts; ADOM administrators’ navigation menus continue to appear similar to when ADOMs are disabled, except that global settings such as network interfaces, HA, and other global settings do not appear.
Continue by defining ADOMs. For details, see Defining ADOMs.
To disable ADOMs
Delete all ADOM administrator accounts.
|
|
Back up your configuration. Disabling ADOMs changes the structure of your configuration, and deletes most ADOM-related settings. It keeps settings from the root ADOM only. For details about how to back up the configuration, see backup full-config. |
Enter the following commands:
config system global
set adom-admin disable
end
FortiWeb terminates your administrative session.
Continue by reconfiguring the appliance. For details, see the FortiWeb Administration Guide:
http://docs.fortinet.com/fortiweb/admin-guides
See also
Defining ADOMs
Some settings can only be configured by the admin account—they are global. Global settings apply to the appliance overall regardless of ADOM, such as:
- Operation mode
- Network interfaces
- System time
- Backups
- Administrator accounts
- Access profiles
- FortiGuard connectivity settings
- HA and configuration sync
- SNMP
- RAID
- X.509 certificates
- TCP
SYNflood anti-DoS setting - Vulnerability scans
- ping and other global operations that exist only in the CLI
Only the admin account can configure global settings.
|
In the current release, some settings, such as user accounts for HTTP authentication, anti-defacement, and logging destinations are read-only for ADOM administrators. Future releases will allow ADOM administrators to configure these settings separately for their ADOM. |
Other settings can be configured separately for each ADOM. They essentially define each ADOM. For example, the policies of adom-A are separate from adom-B.
Initially, only the root ADOM exists, and it contains settings such as policies that were global before ADOMs were enabled. Typically, you will create additional ADOMs, and few if any administrators will be assigned to the root ADOM.
After ADOMs are created, the admin account usually assigns other administrator accounts to configure their ADOM-specific settings. However, as the root account, the admin administrator does have permission to configure all settings, including those within ADOMs.
To create an ADOM
Log in with the admin account.
Enter the following commands:
config vdom
edit <adom_name>
where <adom_name> is the name of your new ADOM. Alternatively, to configure the default root ADOM, type root.
|
|
The maximum number of ADOMs you can add varies by your FortiWeb model. The number of ADOMs is limited by available physical memory (RAM), and therefore also limits the maximum number of policies and sessions per ADOM. For details, see the FortiWeb Administration Guide: |
The new ADOM exists, but its settings are not yet configured.
Either:
- Assign another administrator account to configure the ADOM (continue with Assigning administrators to an ADOM), or
- Configure the ADOM yourself by entering commands such as:
config log...
config server-policy...
config system...
config waf...
See also
- Assigning administrators to an ADOM
- Administrative domains (ADOMs)
- Permissions
- system admin
- system accprofile
Assigning administrators to an ADOM
The admin administrator can create other administrators and assign their account to an ADOM, constraining them to that ADOM’s configurations and data.
To assign an administrator to an ADOM
If you have not yet created any administrator access profiles, create at least one. For details, see system accprofile.
In the administrator account’s accprofile "<access-profile_name>" setting, select the new access profile.
(Administrators assigned to the prof_admin access profile will have global access. They cannot be restricted to an ADOM.)
In the administrator account’s domains "<adom_name>" setting, select the account’s assigned ADOM. Currently, in this version of FortiWeb, administrators cannot be assigned to more than one ADOM.