Is there any way to restrict the window in which a custom role has access to vCenter, i.e. if i have a dev team and create them custom permissions but only want them to be able to login during business hours.
Is there also the ability to grant access obly via the web client so that members dont have to login to the vSphere client itself.
Many Thanks
There is no mechanism within vCenter/vSphere to restrict a Roles access by time.
Unfortunately from the reading I've done there is no way to restrict access based on whether you access via the web client or fat client. The reason being is that you're effectively connecting to the same API/Service, even on similar ports.
The question really would be why? If you stop the role doing X then they couldn't do it in the vSphere Client or the Web Client. The only reason I can imagine is that if you keep them out of the web client then they are restricted by proxy of the lack of features in there since they started dropping them in v5.1
This link lists the features only available in one version or the other
Which vSphere client should I use and when? | VMware vSphere Blog - VMware Blogs
As for your time-based issue you could restrict access to your vCenter server to locally run copies of vSphere or Web client. Then restrict the times that someone can RDP onto that box?
And for my final trick you could set up a "craaaazy" script in powercli that added the Dev Teams permissions at 6pm and removed them at 8am??
Managing vSphere Permissions with PowerCLI | VMware PowerCLI Blog - VMware Blogs
Not ideal or reliable if the scheduled task stopped working, but you could do it 🙂
Enjoy
Chris
If the proper access controls aren’t in place, virtual machines are even more vulnerable to abuse than physical systems, as any user with access to the vSphere client can delete or modify the guest operating systems or make changes to other inventory objects, like folders, resource pools, and datastores.
In VMware, you can manage these user and group rights with roles and privileges. There are 11 predefined roles that determine what actions a user or group is allowed to take in vCenter Server or ESX/ESXi. Some roles have one or more privileges, while others have no privileges at all. You can’t assign privileges to a user without first assigning a role to that user.
Three of the pre-established roles are permanent, meaning that the privileges associated with that role cannot be modified. These permanent roles are available to a stand-alone ESX or ESXi server, or to vCenter Server. The remaining eight are sample roles which can be modified as needed. These eight roles are exclusive to vCenter Server.
Below are the pre-established roles:
The privileges assigned to a pre-defined role are more comprehensive than described as above, so if you want to know exactly what permissions a role allows to a user, you can view the selected privileges when assigning the role to a user or group.
VMware automatically allows users access to child objects. For example, if a user has been given read-only rights for a folder, that user will have read-only rights for all of the sub-folders as well. You can disable this setting, if necessary, when allocating roles.
You can change the privileges associated with the sample roles listed above. Before editing a role, however, it’s recommended that you clone the role first.
1. Log in to vSphere with administrative rights. Click “Home,” then “Roles.”
2. Select the role from the left pane and then click “Clone Role” to create an exact copy of the role.
3. Choose the clone from the left pane. Click “Administration,” “Role,” and then “Edit Role.”
4. Select or deselect the appropriate privileges from the options. Expand a privilege to see the child privileges. If you aren’t sure what a privilege does, select it and then read the description on the bottom of the window.
5. Give the role a descriptive name and then click “OK” to modify the role.
You can also create custom roles if the pre-established roles don’t meet your needs.
1. In vSphere, click “Home” and then click “Roles.”
2. Click “Add Role.” Select the preferred options from the list, and then create a name for the new role.
3. Click “OK.”
Once you’ve created or modified the roles as needed, you can assign the roles to the users and groups associated with your ESX/ESXi host or vCenter Server.
There a few things to keep in mind when configuring access controls in VMware, however. First of all, if a group is assigned a role, all of the users in that group are given those same privileges unless the users have roles of their own assigned. Second of all, if a user is assigned privileges in VMware, those privileges take precedence over the privileges of the group.
For example, User A and User B are assigned to Group 1. Group 1 has been assigned the Read-Only role. User A doesn’t have a role assigned to it, so it automatically gets all of the permissions given to Group 1. User B, however, has been assigned the No Access role, so User B has no permissions at all.
VMware also validates the users and groups in Windows Active Directory against the users and groups in vCenter Server. So, if a user or group exists in vCenter Server, but doesn’t exist in the domain, VMware will delete all of the permissions associated with the user or group during validation.
You can also assign privileges to multiple inventory objects in VMware by creating a folder and moving all of the appropriate objects to that folder.
1. Go to Home, Inventory, and then Hosts and Clusters. Click the inventory object and then click “Permissions.”
2. Right-click an empty area in the right pane, then click “Add Permissions” to open the Assign Permissions window.
3. Click “Add” and insert the appropriate user(s) or group(s). Select the desired role for the user(s) from the drop-down menu.
4. Review the list of permissions in the right pane. To prevent access to child objects, uncheck “Propagate to Child Objects.”
5. Click “OK” to assign the permissions to the selected user(s) or group(s).
To change permissions for a user or group, select the appropriate user or group from the right pane. Click “Inventory,” “Permissions,” and then “Properties.” To remove permissions, click “Inventory,” “Permissions,” and then “Delete.”
VMware provides administrators with several other options for managing users and groups — administrators can limit access to the vSphere client, for example, and instead provide access only to the Web-based client — but the above instructions describe the fundamental basics for managing access control in vSphere.
Hi ,
Team only acess for vm creation & monitors all vm migrations utilization check.
regards,
Harishankar Gupta
+91 9920428164
Is that a question or a statement?
It is not obvious what you mean.