6.7

If multiple group permissions are defined on the same object and a user belongs to two or more of those
groups, two situations are possible:
n
No permission for the user is defined directly on the object. In that case, the user has the privileges
that the groups have on that object.
n
A permission for the user is defined directly on the object. In that case, the user's permission takes
precedence over all group permissions.
Example 1: Inheritance of Multiple Permissions
This example illustrates how an object can inherit multiple permissions from groups that are granted
permission on a parent object.
In this example, two permissions are assigned on the same object for two different groups.
n
Role 1 can power on virtual machines.
n
Role 2 can take snapshots of virtual machines.
n
Group A is granted Role 1 on VM Folder, with the permission set to propagate to child objects.
n
Group B is granted Role 2 on VM Folder, with the permission set to propagate to child objects.
n
User 1 is not assigned specific privileges.
User 1, who belongs to groups A and B, logs on. User 1 can both power on and take snapshots of VM A
and VM B.
Figure 2‑3. Example 1: Inheritance of Multiple Permissions
group B + role 2
user 1 has privileges
of role 1 and role 2
group A + role 1
VM A
VM B
VM Folder
Example 2: Child Permissions Overriding Parent Permissions
This example illustrates how permissions that are assigned on a child object can override permissions
that are assigned on a parent object. You can use this overriding behavior to restrict user access to
particular areas of the inventory.
In this example, permissions are defined on two different objects for two different groups.
n
Role 1 can power on virtual machines.
n
Role 2 can take snapshots of virtual machines.
n
Group A is granted Role 1 on VM Folder, with the permission set to propagate to child objects.
n
Group B is granted Role 2 on VM B.
vSphere Security
VMware, Inc. 24