6.0.3

Understanding Authorization in vSphere
The primary way of authorizing a user or group in vSphere is the vCenter Server permissions. Depending
on the task you want to perform, you might require other authorization.
vSphere 6.0 and later allows privileged users to give other users permissions to perform tasks in the
following ways. These approaches are, for the most part, mutually exclusive; however, you can assign use
global permissions to authorize certain users for all solution, and local vCenter Server permissions to
authorize other users for individual vCenter Server systems.
vCenter Server
Permissions
The permission model for vCenter Server systems relies on assigning
permissions to objects in the object hierarchy of that vCenter Server. Each
permission gives one user or group a set of privileges, that is, a role for a
selected object. For example, you can select an ESXi host and assign a role to
a group of users to give those users the corresponding privileges on that
host.
Global Permissions
Global permissions are applied to a global root object that spans solutions.
For example, if both vCenter Server and vCenter Orchestrator are installed,
you can give permissions to all objects in both object hierarchies using global
permissions.
Global permissions are replicated across the vsphere.local domain. Global
permissions do not provide authorization for services managed through
vsphere.local groups. See “Global Permissions,” on page 144.
Group Membership in
vsphere.local Groups
The user [e-mail] can perform tasks that are associated
with services included with the Platform Services Controller. In addition,
members of a vsphere.local group can perform the corresponding task. For
example, you can perform license management if you are a member of the
LicenseService.Administrators group. See “Groups in the vsphere.local
Domain,” on page 27.
ESXi Local Host
Permissions
If you are managing a standalone ESXi host that is not managed by a
vCenter Server system, you can assign one of the predened roles to users.
See the vSphere Administration with the vSphere Client documentation.
Understanding the vCenter Server Permission Model
The permission model for vCenter Server systems relies on assigning permissions to objects in the vSphere
object hierarchy. Each permission gives one user or group a set of privileges, that is, a role for the selected
object.
You need to understand the following concepts:
Permissions
Each object in the vCenter Server object hierarchy has associated
permissions. Each permission species for one group or user which
privileges that group or user has on the object.
Users and Groups
On vCenter Server systems, you can assign privileges only to authenticated
users or groups of authenticated users. Users are authenticated through
vCenter Single Sign-On. The users and groups must be dened in the
identity source that vCenter Single Sign-On is using to authenticate. Dene
users and groups using the tools in your identity source, for example, Active
Directory.
vSphere Security
136 VMware, Inc.