topic Re: Tab 'Permissions' missing in vRO 7.6 client in VMware Aria Automation Orchestrator Discussions

Tab 'Permissions' missing in vRO 7.6 client

BernhardSie — Thu, 06 Jun 2019 11:24:03 GMT

In vRO 7.6 client the Tab 'Permissions' is missing, in vRO clients < V7.6 Tab 'Permissions' is present:

Any ideas?

Thank you!

Re: Tab 'Permissions' missing in vRO 7.6 client

daphnissov — Thu, 06 Jun 2019 12:06:43 GMT

Permissions are gone in 7.6.

Re: Tab 'Permissions' missing in vRO 7.6 client

randomname — Thu, 06 Jun 2019 15:48:27 GMT

VMware has decided to remove the ability to delegate workflow execution to non-administrators. Your choices are now:

1. Make everyone in your company an administrator of vCenter and any other external system vRO was calling and tell them to spend hours or days doing manually all the stuff your workflows used to do in minutes.

2. Make everyone in your company an administrator of vRO.

3. Give VMware millions of dollars for vRA just so non-administrators can run workflows like they have been for years after only paying for vCenter, and still lose the ability for those non-administrators to run workflows from vCenter with context sensitivity.

Re: Tab 'Permissions' missing in vRO 7.6 client

FreddyFredFred — Fri, 07 Jun 2019 09:41:58 GMT

VMware has decided to remove the ability to delegate workflow execution to non-administrators. Your choices are now:
1. Make everyone in your company an administrator of vCenter and any other external system vRO was calling and tell them to spend hours or days doing manually all the stuff your workflows used to do in minutes.
2. Make everyone in your company an administrator of vRO.
3. Give VMware millions of dollars for vRA just so non-administrators can run workflows like they have been for years after only paying for vCenter, and still lose the ability for those non-administrators to run workflows from vCenter with context sensitivity.

If these are my only 3 options, it sounds like I'm forced to go with #2 and add any users that need to run workflows to the vRO admins group which means it's basically security by obscurity in terms of accessing vRO? If someone finds my vRO instance they can login and do anything they want?

That's certainly disappointing since I use that permission tab to allow a service account to run workflows. Glad I found this out before doing my upgrade!

Re: Tab 'Permissions' missing in vRO 7.6 client

APJ7033 — Wed, 07 Aug 2019 02:13:01 GMT

So I too am in the same boat here, I did find this in the release notes

Role management and group-based permission assignment:

Assign roles to the users accordingly to the functionalities they want to use.
- [IMPORTANT] Role management is only available for vRealize Orchestrator instances authenticated with vRealize Automation.
Create groups, assign and delete users accordingly to the permissions they need to have in the group.
- [IMPORTANT] Users from vRealize Orchestrator instances authenticated with vSphere can now be assigned to groups and given Run permissions. To enable group-based permissions for vRealize Orchestrator instances authenticated with vSphere, contact VMware Global Support Services and follow the instructions to download the relevant vRealize Orchestrator patch. For more information on VMware Global Support Services, please visit https://www.vmware.com/support/services.html.
Assign content items to a group.
- For more information on vRealize Orchestrator roles and groups, see Orchestrator Client Permissions.

VMware vRealize Orchestrator 7.6 Release Notes

I have yet to test this but it looks promissing, I just need to find the release they are talking about. I will update once I have the correct release.

It is a little frustrating that VMware bundles such a major change into a point release.