User`s guide

A user not having the Super User role or the Administrator role can assign a role to other users only on the
resources that he has access to. This user can assign only the roles he has access to and have the same or a
subset of the privileges that are defined in the role assigned to him.
The role that users can assign to other users on a resource depends on:
n
The permissions that the user has on the resource.
n
The roles that the user has access to.
NOTE If you assign a role to an LDAP group for a resource, then the LDAP users belonging to the LDAP group
will be assigned the same role on the resources. However, the LDAP user cannot perform any action on the
resources, if the LDAP group does not have at least read privileges on the various resource types at the vCenter
Chargeback level.
Procedure
1 In the Users & Roles tab, click Permissions.
A page listing the users, their type, whether the user has the Super User role or the Administrator role,
and if the user is a vCenter Server user then the vCenter Server name or if the user is an LDAP user or
group then the IP address of the LDAP server is displayed. The page also provides an option to select a
resource type.
2 Select the required resource type from the list.
3 Expand the resource type folder and select the resources for which you want to set the role on the user.
You can select more than one resource by pressing the Ctrl key and selecting each of the required resources.
However, the roles that you can assign on these resources would depend on the intersection of the
permissions you have on each of the selected resources.
4 Select the user from the table listing the users.
If any role has already been assigned to the user on the selected resources, the same is displayed under
Currently Assigned Role.
5 Select the required role from the menu under Set/Reset Role.
6 Click Apply.
The selected role is set on the user for the selected resources.
The role set on the user is applicable only for the selected resources. You must individually assign roles to the
user on the all required resources in the application. A user can have different roles on different resources.
Revoke the Role Assigned to a User for a Resource
Roles set on a user for a resource can be revoked as and when required.
Procedure
1 In the Users & Roles tab, click Permissions.
A page listing the users, their type, whether the user has the Super User role or the Administrator role,
and if the user is a vCenter Server user then the vCenter Server name or if the user is an LDAP user or
group then the IP address of the LDAP server is displayed. The page also provides an option to select a
resource type.
2 Select the required resource type from the list.
3 Expand the resource type folder and select the resources for which you want to revoke the role on the
user.
vCenter Chargeback User’s Guide
72 VMware, Inc.