Setting the Grant Manager Policy

4/8/2010

You can use the Grant Manager Policy to grant system administrative privileges that are held by the Manager role to other security roles, without modifying metabase role assignments.

The Grant Manager policy (4119) is enforced by the Configuration Manager, and a Manager role is required to modify it.

The following list shows the possible values.

The default value for this policy depends on the type of device. The following table shows the default values.

The following example shows how to change the security policy. In this example,

<characteristic type="SecurityPolicy">
     <!-- Grant Manager Policy to SECROLE_USER_AUTH --> 
     <parm name="4119" value="16" />
</characteristic>

As shown in Security Policy Settings, the Grant Manager policy is 4119.

As shown in Security Roles, the value for User Authenticated is 16.

Best Practices

The best practice for the setting Grant Manager policy for bootstrap depends on the method of bootstrapping.

• Using a .cpf file to bootstrap
  The Grant Manager policy should be set to SECROLE_NONE so that only a message that is marked as Manager will be treated as such.

  The following example shows how to change the GRANT MANAGER policy to SECROLE_NONE:

  <!-- Updating the Grant Manager policy so that only the message that is already assigned the Manager role can be worked as manager message. -->
  <characteristic type="SecurityPolicy">
     <parm name="4119" value="0"/>
  </characteristic>
  

  For more information, see Bootstrapping To Use a CPF File.

• Using Remote API (RAPI) to bootstrap
  The Grant Manager policy should be set to SECROLE_USER_AUTH to enables the device to accept RAPI messages that require MANAGER privileges. The permissions associated with this role are determined by the settings that the user requires access to if he or she is not the manager of the device.

  The following example shows how to change the GRANT MANAGER policy to SECROLE_USER_AUTH:

  <characteristic type="SecurityPolicy">
     <parm name="4119" value="16"> 
  </characteristic>
  <!-- other settings -->
  

  For more information, see Enabling Remote API (RAPI) Bootstrapping.

• Over-the-air (OTA) bootstrap using the OMA Client Provisioning protocol
  The Grant Manager policy should be set to SECROLE OPERATOR and SECROLE_OPERATOR_TPS.

  The following example shows how to change these settings:

  <characteristic type="SecurityPolicy">
     <parm name="4119" value="132"/>
  </characteristic>
  

  For more information, see Enabling OTA Bootstrapping.

• Bootstrap the device to use an OMA Device Management server remote OTA provisioning
  After the device is bootstrapped, the Grant Manager policy should be set to SECROLE_MANAGER to enable the device to accept a configuration request OTA from the OMA DM server.

  The following example shows how to change the GRANT MANAGER policy to SECROLE_MANAGER:

  <characteristic type="SecurityPolicy">
     <parm name="4119" value="8"/>
  </characteristic>
  

  For more information, see Bootstrapping To Use An OMA DM Server.

• Bootstrap the device to use an OMA Client Provisioning server
  After the device is bootstrapped, the Grant Manager policy should be set to SECROLE_OPERATOR_TPS to enable the device to accept a WAP push gateway, a Trusted Provisioning Server URL for continuous provisioning. The message coming from the OMA Client Provisioning TPS will be granted the Manager role after the device is bootstrapped.

  The following example shows how to change the GRANT MANAGER policy to SECROLE_USER_AUTH:

  <characteristic type="SecurityPolicy">
     <parm name="4119" value="16"> 
  </characteristic>
  <!-- other settings -->
  

  For more information, see Bootstrapping To Use an OMA Client Provisioning Server.

Comments

One provisioning XML file typically contains configuration information for multiple Configuration Service Providers. To use this example, you must replace the values as appropriate, and add the node as a child of the OMA Client Provisioning file. For information about the syntax of this file, see OMA Client Provisioning Files. For examples, see OMA Client Provisioning XML File Examples.

See Also

Other Resources

Security Roles
Security Policy Settings