6.5.1

To manage permissions from the vSphere Web Client, you need to understand the following concepts:
Permissions Each object in the vCenter Server object hierarchy has associated
permissions. Each permission specifies for one group or user which
privileges that group or user has on the object.
Users and Groups On vCenter Server systems, you can assign privileges only to
authenticated users or groups of authenticated users. Users are
authenticated through vCenter Single Sign-On. The users and groups must
be defined in the identity source that vCenter Single Sign-On is using to
authenticate. Define users and groups using the tools in your identity
source, for example, Active Directory.
Privileges Privileges are fine-grained access controls. You can group those privileges
into roles, that you can then map to users or groups.
Roles Roles are sets of privileges. Roles allow you to assign permissions on an
object based on a typical set of tasks that users perform. Default roles,
such as Administrator, are predefined on vCenter Server and cannot be
changed. Other roles, such as Resource Pool Administrator, are predefined
sample roles. You can create custom roles either from scratch or by cloning
and modifying sample roles. See Create a Custom Role and Clone a Role.
You can assign permissions to objects at different levels of the hierarchy, for example, you can assign
permissions to a host object or to a folder object that includes all host objects. See Hierarchical
Inheritance of Permissions. You can also assign permissions to a global root object to apply the
permissions to all object in all solutions. See Global Permissions.
Add a Permission to an Inventory Object
After you create users and groups and define roles, you must assign the users and groups and their roles
to the relevant inventory objects. You can assign the same permissions to multiple objects simultaneously
by moving the objects into a folder and setting the permissions on the folder.
When you assign permissions from the vSphere Web Client, user and group names must match Active
Directory precisely, including case. If you upgraded from earlier versions of vSphere, check for case
inconsistencies if you experience problems with groups.
Prerequisites
On the object whose permissions you want to modify, you must have a role that includes the
Permissions.Modify permission privilege.
Procedure
1 Browse to the object for which you want to assign permissions in the vSphere Web Client object
navigator.
2 Click the Permissions tab.
vSphere Security
VMware, Inc. 27