6.3

Managing Users and Access Control in vRealize Operations Manager
To ensure security of the objects in your vRealize Operations Manager instance, as a system administrator
you can manage all aspects of user access control. You create user accounts, assign each user to be a member
of one or more user groups, and assign roles to each user or user group to set their privileges.
Users must have privileges to access specic features in the vRealize Operations Manager user interface.
Access control is dened by assigning privileges to both users and objects. You can assign one or more roles
to users, and enable them to perform a range of dierent actions on the same types of objects. For example,
you can assign a user with the privileges to delete a virtual machine, and assign the same user with read-
only privileges for another virtual machine.
User Access Control
You can authenticate users in vRealize Operations Manager in several ways.
n
Create local user accounts in vRealize Operations Manager.
n
Use VMware vCenter Server
®
users. After the vCenter Server is registered with
vRealize Operations Manager, congure the vCenter Server user options in the
vRealize Operations Manager global seings to enable a vCenter Server user to log in to
vRealize Operations Manager. When logged into vRealize Operations Manager, vCenter Server users
access objects according to their vCenter Server-assigned permissions.
n
Add an authentication source to authenticate imported users and user group information that resides
on another machine.
n
Use LDAP to import users or user groups from an LDAP server. LDAP users can use their LDAP
credentials to log in to vRealize Operations Manager. For example, use Active Directory on a
Windows machine to log into vRealize Operations Manager through LDAP, by adding the Active
Directory server as an LDAP server.
n
Create a single sign-on source and import users and user groups from a single sign-on server.
Single sign-on users can use their single sign-on credentials to log in to
vRealize Operations Manager and vCenter Server. You can also use Active Directory through
single sign-on by conguring the Active Directory through single sign-on and adding the single
sign-on source to vRealize Operations Manager.
Users of vRealize Operations Manager
Each user has an account to authenticate them when they log in to vRealize Operations Manager.
The accounts of local users and LDAP users are visible in the vRealize Operations Manager user interface
when they are set up. The accounts of vCenter Server and single sign-on users only appear in the user
interface after a user logs in for the rst time. Each user can be assigned one or more roles, and can be an
authenticated member of one or more user groups.
Local Users in vRealize Operations Manager
When you create user accounts in a local vRealize Operations Manager instance,
vRealize Operations Manager stores the credentials for those accounts in its global database, and
authenticates the account user locally.
Each user account must have a unique identity, and can include any associated user preferences.
If you are logging in to vRealize Operations Manager as a local user, and on occasion receive an invalid
password message, try the following workaround. In the Login page, change the Authentication Source to
All vCenter Servers, change it back to Local Users, and log in again.
vRealize Operations Manager Customization and Administration Guide
10 VMware, Inc.