5.5

n
Assign SRM Roles and Permissions on page 13
During installation, SRM administrator rights are assigned to the vCenter Server administrator role. At
this time, only vCenter Server administrators can log in to SRM, unless they explicitly grant access to
other users.
n
SRM Roles Reference on page 14
SRM includes a set of roles. Each role includes a set of privileges, which allow users with those roles to
complete different actions.
How SRM Handles Permissions
SRM determines whether a user has permission to perform an operation, such as configuring protection or
running the individual steps in a recovery plan. This permission check ensures the correct authentication of
the user, but it does not represent the security context in which the operation is performed.
SRM performs operations in the security context of the user ID that is used to connect the sites, or in the
context of the ID under which the SRM service is running, for example, the local system ID.
After SRM verifies that a user has the appropriate permissions on the target vSphere resources, SRM
performs operations on behalf of users by using the vSphere administrator role.
For configuration operations, SRM validates user permissions when the user requests the operation.
Operations other than configuration operations require two phases of validation.
1 During configuration, SRM verifies that the user configuring the system has the correct permissions to
complete the configuration on the vCenter Server object. For example, a user must have permission to
protect a virtual machine and use resources on a secondary vCenter Server that the recovered virtual
machine uses.
2 The user performing the configuration must have the correct permissions to complete the task that they
are configuring. For example, a user must have permissions to run a recovery plan. SRM then
completes the task on behalf of the user as a vCenter Server administrator.
As a result, a user who completes a particular task, such as a recovery, does not necessarily require
permissions to act on vSphere resources. The role authorizes the action, but the action is performed by SRM
acting as an administrator. SRM performs the operations by using the administrator credentials that you
provide when you connect the protected and recovery sites.
SRM maintains a database of permissions for internal SRM objects that uses a model similar to the one the
vCenter Server uses. SRM verifies its own SRM privileges even on vCenter Server objects. For example, SRM
checks for the Resource.Recovery Use permission on the target datastore rather than checking multiple low-
level permissions, such as Allocate space.
SRM and the vCenter Server Administrator Role
If a user or user group has the vCenter Server administrator role on a vCenter Server instance when you
install SRM, that user or user group obtains all SRM privileges.
SRM does not perform verification of roles or permissions after installation. If you assign the vCenter Server
administrator role to users or user groups after you install SRM, you must manually assign the SRM roles to
those users.
You can assign SRM roles to users or user groups that do not have the vCenter Server administrator role. In
this case, those users have permission to perform SRM operations, but they do not have permission to
perform all vCenter Server operations.
Site Recovery Manager Administration
10 VMware, Inc.