6.0.3

Roles
Roles allow you to assign permissions on an object based on a typical set of
tasks that users perform. Default roles, such as Administrator, are predened
on vCenter Server and cannot be changed. Other roles, such as Resource Pool
Administrator, are predened sample roles. You can create custom roles
either from scratch or by cloning and modifying sample roles.
Privileges
Privileges are ne-grained access controls. You can group those privileges
into roles, that you can then map to users or groups.
Figure 4‑1. vSphere Permissions
Permission
vSphere object
User or group
Role
Privilege
Privilege
Privilege
Privilege
To assign permissions to an object, you follow these steps:
1 Select the object in the vCenter object hierarchy to which you want to apply the permission.
2 Select the group or user that should have privileges on the object.
3 Select the role, that is the set of privileges, that the group or user should have on the object. By default,
permissions propagate, that is the group or user has the selected role on the selected object and its child
objects.
The permissions model makes it easy to get things done quickly by oering predened roles. You can also
combine privileges to create custom roles. See Chapter 10, “Dened Privileges,” on page 255 for a reference
to all privileges and the objects to which you can apply the privileges. See “Required Privileges for Common
Tasks,” on page 150 for some examples of the sets of privileges you need to perform these tasks.
In many cases, permissions must be dened on both a source object and a destination object. For example, if
you move a virtual machine, you need some privileges on that virtual machine, but also privileges on the
destination data center.
The permissions model for standalone ESXi hosts is simpler. See “Assigning Permissions for ESXi,” on
page 187
vCenter Server User Validation
vCenter Server systems that use a directory service regularly validate users and groups against the user
directory domain. Validation occurs at regular intervals specied in the vCenter Server seings. For
example, if user Smith was assigned a role on several objects, and the user’s name was changed to Smith2 in
the domain , the host concludes that Smith no longer exists and removes permissions associated with that
user from the vSphere objects when the next validation occurs.
Similarly, if user Smith is removed from the domain, all permissions associated with that user are removed
when the next validation occurs. If a new user Smith is added to the domain before the next validation
occurs, the new user Smith is replaces the old user Smith in permissions on any object.
Chapter 4 vSphere Permissions and User Management Tasks
VMware, Inc. 137