2.7

In the figure, user Bob is logged in to Data Director and has been granted access to the system and to the
organization Alliance. Bob is also granted the SysAdmin role at the system level, and the DBAdmin role in the
organization Alliance. Bob's SysAdmin role applies to the system level. The SysAdmin role does not propagate
to any organizations. The role DBAdmin in organization Alliance and the role DBAdmin in organization
Benefits are separate roles that apply only within their organizations. Bob has the DBAdmin role in the Alliance
organization but does not have access to the Benefits organization.
Authenticating Users
User authentication is based on user login and password.
User login accounts and credentials are unique in Data Director. This enables managing credentials, roles,
permissions, and privileges for each user based on the user login account.
Create users and passwords in the following ways.
n
A system or organization administrator creates the user account and assigns a password.
n
A user registers for a Data Director account and specifies a password as part of the registration request.
Data Director encrypts the password and stores it with the user information. When the user logs in, that user's
credentials are stored in an HTTP session. Data Director uses the credentials to validate that the user is
authorized to view organization objects (database groups and databases) and to perform tasks.
Role-Based Access Control
Role-based access control enables system and organization administrators to control user access to Data
Director and to control what users can do after they log in. To implement role-based access control, system
and organization administrators associate (or revoke) privileges, permissions, and roles with (or from) user
login accounts.
Users
User logins (users) are unique accounts that enable users to access Data
Director. They include a password and identifying information such as name,
email address, and phone number. Because user login accounts are unique,
system and organization administrators can control each user's access and
actions by granting or revoking privileges, permissions, and roles to or from
the user's login account.
Users can be active or inactive. Inactive users cannot log in.
Privileges
Privileges control all actions in Data Director. They define the allowable actions
within an organization. Privileges apply to particular types of Data Director
objects. For example, you can apply the Stop Database privilege to
organizations, database groups, and databases and apply the Create
Database privilege to organizations and database groups. Privileges by
themselves are not associated with specific objects within an organization.
Permissions
Permissions associate a user and privilege pair with an object in Data Director.
Examples are granting a user permission to start or stop a specific database, to
modify an organization's backup templates, or to create other users in an
organization.
You can grant permissions to users by assigning a role to a user, or by granting
permissions directly to the user.
Roles
Roles are collections of permissions that can be associated with or granted to
users. Roles provide a convenient way to package all the permissions required
to perform a job, such as that of database administrator. Roles apply only to
the entity in which they are created. If you create a role at the system level, it
Chapter 3 Managing Users and Roles
VMware, Inc. 35