Citrix Systems 5.6 User Manual

To change a subject's RBAC role:

To change a user's role it is necessary to remove them from their existing role, and add them to a new role:

1. Run the commands:

xe subject-role-remove uuid=

<subject uuid>

role-name= \

<role_name_to_remove>

xe subject-role-add uuid=

<subject uuid >

role-name= \

<role_name_to_add>

To ensure that the new role takes effect, the user should be logged out and logged back in again (this requires

the "Logout Active User Connections" permission - available to a Pool Administrator or Pool Operator).

Warning:

Once you have added or removed a pool-admin subject, there can be a delay of a few seconds for ssh sessions
associated to this subject to be accepted by all hosts of the pool.

Auditing

The RBAC audit log will record any operation taken by a logged-in user.

• the message will explicitly record the Subject ID and user name associated with the session that invoked

the operation.

• if an operation is invoked for which the subject does not have authorization, this will be logged.
• if the operation succeeded then this is recorded; if the operation failed then the error code is logged.

Audit log xe CLI commands

xe audit-log-get [since=

<timestamp>

] filename=

<output filename>

This command downloads to a file all the available records of the RBAC audit file in the pool. If the optional

parameter 'since' is present, then it only downloads the records from that specific point in time.

To obtain all audit records from the pool

Run the following command:

xe audit-log-get filename=/tmp/auditlog-pool-actions.out

To obtain audit records of the pool since a precise millisecond timestamp

Run the following command:

xe audit-log-get since=2009-09-24T17:56:20.530Z \

filename=/tmp/auditlog-pool-actions.out

To obtain audit records of the pool since a precise minute timestamp

Run the following command:

xe audit-log-get since=2009-09-24T17:56Z \

filename=/tmp/auditlog-pool-actions.out