6.7

vSphere Permissions and User
Management Tasks 2
Authentication and authorization govern access. vCenter Single Sign-On supports authentication, which
means it determines whether a user can access vSphere components at all. Each user must also be
authorized to view or manipulate vSphere objects.
vSphere supports several different authorization mechanisms, discussed in Understanding Authorization
in vSphere. The focus of the information in this section is how vCenter Server permission model works
and how to perform user management tasks.
vCenter Server allows fine-grained control over authorization with permissions and roles. When you
assign a permission to an object in the vCenter Server object hierarchy, you specify which user or group
has which privileges on that object. To specify the privileges, you use roles, which are sets of privileges.
Initially, only the administrator user for the vCenter Single Sign-On domain, [e-mail]
by default, is authorized to log in to the vCenter Server system. That user can then proceed as follows:
1 Add an identity source in which users and groups are defined to vCenter Single Sign-On. See the
Platform Services Controller Administration documentation.
2 Give privileges to a user or group by selecting an object such as a virtual machine or a
vCenter Server system and assigning a role on that object for the user or group.
Roles, Privileges, and Permissions
(http://link.brightcove.com/services/player/bcpid2296383276001?
bctid=ref:video_roles_privileges_permissions_vsphere_web_client)
This chapter includes the following topics:
n
Understanding Authorization in vSphere
n
Managing Permissions for vCenter Components
n
Global Permissions
n
Using Roles to Assign Privileges
n
Best Practices for Roles and Permissions
n
Required Privileges for Common Tasks
VMware, Inc.
18