6.0.3

If multiple group permissions are dened on the same object and a user belongs to two or more of those
groups, two situations are possible:
n
If no permission is dened for the user on that object, the user is assigned the set of privileges assigned
to the groups for that object.
n
If a permission is dened for the user on that object, the user's permission takes precedence over all
group permissions.
Example 1: Inheritance of Multiple Permissions
This example illustrates how an object can inherit multiple permissions from groups that are granted
permission on a parent object.
In this example, two permissions are assigned on the same object for two dierent groups.
n
Role 1 can power on virtual machines.
n
Role 2 can take snapshots of virtual machines.
n
Group A is granted Role 1 on VM Folder, with the permission set to propagate to child objects.
n
Group B is granted Role 2 on VM Folder, with the permission set to propagate to child objects.
n
User 1 is not assigned specic privileges.
User 1, who belongs to groups A and B, logs on. User 1 can both power on and take snapshots of VM A and
VM B.
Figure 4‑3. Example 1: Inheritance of Multiple Permissions
group B + role 2
user 1 has privileges
of role 1 and role 2
group A + role 1
VM A
VM B
VM Folder
Example 2: Child Permissions Overriding Parent Permissions
This example illustrates how permissions that are assigned on a child object can override permissions that
are assigned on a parent object. You can use this overriding behavior to restrict user access to particular
areas of the inventory.
In this example, permissions are dened on two dierent objects for two dierent groups.
n
Role 1 can power on virtual machines.
n
Role 2 can take snapshots of virtual machines.
n
Group A is granted Role 1 on VM Folder, with the permission set to propagate to child objects.
n
Group B is granted Role 2 on VM B.
User 1, who belongs to groups A and B, logs on. Because Role 2 is assigned at a lower point in the hierarchy
than Role 1, it overrides Role 1 on VM B. User 1 can power on VM A, but not take snapshots. User 1 can take
snapshots of VM B, but not power it on.
vSphere Security
140 VMware, Inc.