A hospital UCS user can see only one organization, which is what the design wants. Inside that organization the user cannot associate a service profile. The assigned role is read-only. What has to change?
Select an answer to reveal the explanation.
Short Explanation
You gave the guard a key to one room and a job description that says look, do not touch. The locale is already doing its job. The role is what grants or withholds the action, and a read-only role cannot associate a service profile.
Full Explanation
UCS splits authorization into a role and a locale. The role lists the privileges, such as associating a service profile. The locale limits which organizations those privileges apply to. This user is confined to one organization, so the locale is correct, and the read-only role is why the associate action is denied. Expanding the locale to every organization would let the same read-only user see more and still not associate a profile. The chassis discovery policy decides how many links must be up before a chassis is discovered. It does not authorize users. Fabric binding admits switches into a SAN by switch WWN and domain ID. It does not log anyone into UCS Manager. Caveat: if a remote AAA server returns a different role name than the one you edited, the session keeps the remote role. The role name has to match. Operational check: assign a role that includes service-profile association, sign in again, and confirm the user can associate a profile in that one organization and still cannot see the others.