6.0.3

To manage permissions from the vSphere Web Client, you need to understand the following concepts:
Permissions
Each object in the vCenter Server object hierarchy has associated
permissions. Each permission species for one group or user which
privileges that group or user has on the object.
Users and Groups
On vCenter Server systems, you can assign privileges only to authenticated
users or groups of authenticated users. Users are authenticated through
vCenter Single Sign-On. The users and groups must be dened in the
identity source that vCenter Single Sign-On is using to authenticate. Dene
users and groups using the tools in your identity source, for example, Active
Directory.
Roles
Roles allow you to assign permissions on an object based on a typical set of
tasks that users perform. Default roles, such as Administrator, are predened
on vCenter Server and cannot be changed. Other roles, such as Resource Pool
Administrator, are predened sample roles. You can create custom roles
either from scratch or by cloning and modifying sample roles.
Privileges
Privileges are ne-grained access controls. You can group those privileges
into roles, that you can then map to users or groups.
You can assign permissions to objects at dierent levels of the hierarchy, for example, you can assign
permissions to a host object or to a folder object that includes all host objects. See “Hierarchical Inheritance
of Permissions,” on page 138. You can also assign permissions to a global root object to apply the
permissions to all object in all solutions. See “Global Permissions,” on page 144.
Add a Permission to an Inventory Object
After you create users and groups and dene roles, you must assign the users and groups and their roles to
the relevant inventory objects. You can assign the same permissions to multiple objects simultaneously by
moving the objects into a folder and seing the permissions on the folder.
When you assign permissions from the vSphere Web Client, user and group names must match Active
Directory precisely, including case. If you upgraded from earlier versions of vSphere, check for case
inconsistencies if you experience problems with groups.
Prerequisites
On the object whose permissions you want to modify, you must have a role that includes the
Permissions.Modify permission privilege.
Procedure
1 Browse to the object for which you want to assign permissions in the vSphere Web Client object
navigator.
2 Click the Manage tab and select Permissions.
3 Click the Add icon, and click Add.
4 Identify the user or group that will have the privileges dened by the selected role.
a From the Domain drop-down menu, select the domain where the user or group is located.
b Type a name in the Search box or select a name from the list.
The system searches user names, group names, and descriptions.
c Select the user or group and click Add.
The name is added to either the Users or Groups list.
vSphere Security
142 VMware, Inc.