Info needed about Permissions

[vmwaredude1]

Hi,

Can someone please point me to a document, or if they can share the permission concepts used in ESX and VC?

I am aware of different roles used in VC and ESX, but still I will like to know more about it.

Thanks

[GBromage]

Well, in simple terms a "role" is a set of permissions. Such as, the ability to reboot a VM machine, or create a new one.

Then, within your cluster, folder, VM structure you can grant those permissions to a user or group by choosing the object, and selecting the person's user/group and what "role" you want them to play on that object (or ones beneath it.)

If you're familiar with granting permissions on a file system, it's the same mentality. The role defines the rights you're granting, and you assign the NT user or group rights to an object.

[virtualdud3 · Accepted solution]

Here is a document that should help out greatly:

http://www.vmware.com/pdf/vi3_vc_roles.pdf

###############

If you found this information useful, please consider awarding points for "Correct" or "Helpful". Thanks!!!

[Texiwill]

Hello,

Where you set the roles for users is also important. Remember to set them on the View that makes sense. You would not set a VM role on a resource pool for example, but a Folder would work just fine.

Best regards,

Edward L. Haletky, author of the forthcoming 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', publishing January 2008, (c) 2008 Pearson Education. Available on Rough Cuts at http://safari.informit.com/9780132302074

[GBromage]

I disagree with you about not setting permissions on resource pools.

In a managed service / hosting environment, it's not unusual for a department to purchase an amount of resources from the central pool, instead of buying their own server(s). So, you'd create a resource pool and set reservations and limits based on your SLA agreement, then grant that department's IT staff rights to the resource pool. They can then create, delete, reboot and manage their own VMs within that pool only.

[Texiwill]

Hello,

Some roles only apply to resource pools and some only apply to VMs, I mimic my resource pools as folders and set VM roles on the folders and resource roles on the pools. I had issues early on where I setup perms on resource pools and the did not work when logging in via the Web site yet did work when using the VIC. This could be a bug in the website but the solution was to put VM type roles only on VM type things (folders, VMs) and resource type roles on resource type things. I really like to keep these things separate as much as possible but the comment was based on my observations of what works with all the myriad ways to access ESX VMs.

Best regards,

Edward L. Haletky, author of the forthcoming 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', publishing January 2008, (c) 2008 Pearson Education. Available on Rough Cuts at http://safari.informit.com/9780132302074