Configuring vCenter Roles and Permissions

By default, the SSO-Domain\Administrators (vsphere.local\Administrators) group is assigned an Administrator role on the vCenter and is defined as a Global Permission. This means that if there were to be more than one vCenter in an Enhanced Linked Mode configuration, then the vsphere\Administrators group will have Administrator role permissions on all the connected vCenters.

The only member of the vsphere.local\Administators group is the SSO administrator ([e-mail]). Users from other identity sources can be added as members of this group if you so desire.

However, in most environments, although multiple vCenters will be managed under a single ELM umbrella, you will sometimes need to provide vCenter-specific permissions. For instance, if you manage multiple vCenters belonging to different customers, then assigning global permissions is not considered ideal. In such cases, you will need to provide user access to specific vCenters only.

In this recipe, we will learn how to assign vCenter permissions to an Active Directory user/group.

Getting ready

Before you set off and assign vCenter permissions, ensure that the domain hosting the intended user/group is added as an identity source. To learn how to add identity sources, read the Configuring SSO identity sources recipe in this chapter.

How to do it...

The following procedure will guide you through the steps required to configure vCenter permissions to a domain user or group:

1. Log in to the vSphere Client (HTML 5) interface as the SSO administrator.
2. Select the vCenter object from the inventory, navigate to its Permissions tab, and click + to bring up the Add Permission window:

3. On the Add Permission window, select a domain user or group using the search box, and then specify a role. You can also choose to propagate the permissions to waterfall down to other inventory objects. Click OK to confirm:

4. Once done, the user/group should be listed under Permissions.

How it works...

Any user account that is used to log in to the vSphere Web Client needs permission on the vCenter to be able to view and manage its inventory. When configuring global permissions, it is important to ensure that it is propagated to the child objects so that the permissions are set on the vCenter Server(s) as well. Permissions can be configured for both local and Active Directory users, provided that the required identity sources are added to SSO.