6.0.3

vSphere Permissions and User
Management Tasks 4
vCenter Single Sign-On supports authentication, which means it determines whether a user can access
vSphere components at all. In addition, each user must be authorized to view or manipulate vSphere
objects.
vSphere supports several dierent authorization mechanisms, discussed in “Understanding Authorization
in vSphere,” on page 136. The focus of the information in this section is the vCenter Server permission
model and how to perform user management tasks.
vCenter Server allows ne-grained control over authorization with permissions and roles. When you assign
a permission to an object in the vCenter Server object hierarchy, you specify which user or group has which
privileges on that object. To specify the privileges, you use roles, which are sets of privileges.
Initially, only the user [e-mail] is authorized to log in to the vCenter Server system. That
user can then proceed as follows:
1 Add an identity source in which additional users and groups are dened to vCenter Single Sign-On. See
“Add a vCenter Single Sign-On Identity Source,” on page 31.
2 Give privileges to a user or group by selecting an object such as a virtual machine or a vCenter Server
system and assigning a role on that object to the user or group.
Roles, Privileges, and Permissions
(hp://link.brightcove.com/services/player/bcpid2296383276001?
bctid=ref:video_roles_privileges_permissions_vsphere_web_client)
This chapter includes the following topics:
n
“Understanding Authorization in vSphere,” on page 136
n
“Understanding the vCenter Server Permission Model,” on page 136
n
“Hierarchical Inheritance of Permissions,” on page 138
n
“Multiple Permission Seings,” on page 139
n
“Managing Permissions for vCenter Components,” on page 141
n
“Global Permissions,” on page 144
n
“Using Roles to Assign Privileges,” on page 147
n
“Best Practices for Roles and Permissions,” on page 150
n
“Required Privileges for Common Tasks,” on page 150
VMware, Inc.
135