How to limit actions in gettingStartedView by user privilege?

[brianplexxi]

Hi all,

Happy to be back on vSphere Web Client development again.  In our solution we have helpful links to actions for users on the getting started pages.  Some actions are not available to Read Only users.  How do I hide those actions in actionDisplayInfos?

[laurentsd]

See this post Web Client plugin security good practices about extensions filtering.

[brianplexxi]

Thanks Laurent.  Do I need to set a privilege on the action itself to get the Home shortcuts to gray out for non-privileged users, like the attached?

[brianplexxi]

I tried:

<com.vmware.actionsfw.ActionSpec>

          <uid>com.plexxi.home.manageSettings</uid>

          <label>#{label.manage.settings}</label>

          <icon>#{icon.settings}</icon>

          <command className="com.plexxi.connectui.HomeActions"/>

          <requiredPrivilege>Global.Settings</requiredPrivilege>

          <privateAction>true</privateAction>

</com.vmware.actionsfw.ActionSpec>

[laurentsd]

I think that should work but I am not familiar with this part of the code. Are you sure it's the right privilege?

[brianplexxi]

setting the privilege on the action group rather than the individual actions did the trick; now admin actions are grayed out for read only users.

Unlike vSphere however, I see no grayed out icon (its simply no longer there) nor do I get tooltip/description text explaining what the action is or that its unavailable.

Probably enough for now, but it gives users an inconsistent experience.

[laurentsd]

OK, thanks for the update.

[brianplexxi]

Is this supported on 5.5 U2b?  It works on my QA environment; though we have a customer with Global.Settings privilege and it's doesn't show up for them (somehow we're not seeing the privilege?)

[laurentsd]

If your QA setup and your customer are using the same Web Client version 5.5.2 and are seeing different results then it must be because your privileges are not setup the same way on vCenter.

[brianplexxi]

That's what I was thinking.  Windows vCenter vs. VCSA shouldn't mke a difference, right?

The code is checking "Global.Settings" and the user appears to have it.

Confused...

[laurentsd]

Right, Windows vCenter and VCSA are the same. We must be missing something else.

[brianplexxi]

Hi Laurent,

Do you have recommendations on debug tactics?

[brianplexxi]

Just learned the 5.5 vCenter in question is in linked mode with two other remote vCenters, if that makes a difference

[laurentsd]

Does the user have Global.Settings privileges with the other vCenters?

[brianplexxi]

It turned out to be a differences of user permissions buried in nested AD groups 🙂

Thank you!