VMware 4817V62 Administration Guide - Page 219

Example 2: Child Permissions Overriding Parent Permissions,

Get VMware 4817V62 - vSphere - PC PDF manuals and user guides View all VMware 4817V62 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 219 highlights

Chapter 18 Managing Users, Groups, Roles, and Permissions Figure 18-3. Example 1: Inheritance of Multiple Permissions group A + role 1 group B + role 2 VM Folder VM A VM B user 1 has permissions of role 1 and role 2 Example 2: Child Permissions Overriding Parent Permissions This example illustrates how permissions assigned on a child object override permissions assigned on a parent object. You can use this overriding behavior to restrict user access to particular areas of the inventory. In this example, permissions are to two different groups on two different objects. n Role 1 can power on virtual machines. n Role 2 can take snapshots of virtual machines. n Group A is granted Role 1 on VM Folder, with the permission set to propagate to child objects. n Group B is granted Role 2 on VM B. User 1, who belongs to groups A and B, logs on. Because Role 2 has been assigned at a lower point in the hierarchy than Role 1, it overrides Role 1 on VM B. User 1 can power on VM A, but not take snapshots. User 1 can take snapshots of VM B, but not power it on. Figure 18-4. Example 2: Child Permissions Overriding Parent Permissions group A + role 1 group B + role 2 VM Folder VM A VM B user 1 has permissions of role 1 only user 1 has permissions of role 2 only Example 3: User Permissions Overriding Group Permissions This example illustrates how permissions assigned directly to an individual user override permissions assigned to a group that the user is a member of. In this example, permissions are assigned to a user and to a group on the same object. n Role 1 can power on virtual machines. n Group A is granted Role 1 on VM Folder. n User 1 is granted No Access role on VM Folder. User 1, who belongs to group A, logs on. The No Access role granted to User 1 on VM Folder overrides the group permission. User 1 has no access to VM Folder or VMs A and B. Figure 18-5. Example 3: User Permissions Overriding Group Permissions group A + role 1 user 1 + no access VM Folder VM A VM B user 1 has no access to the folder or the virtual machines VMware, Inc. 219

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
  • 231
  • 232
  • 233
  • 234
  • 235
  • 236
  • 237
  • 238
  • 239
  • 240
  • 241
  • 242
  • 243
  • 244
  • 245
  • 246
  • 247
  • 248
  • 249
  • 250
  • 251
  • 252
  • 253
  • 254
  • 255
  • 256
  • 257
  • 258
  • 259
  • 260
  • 261
  • 262
  • 263
  • 264
  • 265
  • 266
  • 267
  • 268
  • 269
  • 270
  • 271
  • 272
  • 273
  • 274
  • 275
  • 276
  • 277
  • 278
  • 279
  • 280
  • 281
  • 282
  • 283
  • 284
  • 285
  • 286
  • 287
  • 288
  • 289
  • 290
  • 291
  • 292
  • 293
  • 294
  • 295
  • 296
  • 297
  • 298
  • 299
  • 300
  • 301
  • 302
  • 303
  • 304
  • 305
  • 306
  • 307
  • 308
  • 309
  • 310
  • 311
  • 312
  • 313
  • 314
  • 315
  • 316
  • 317
  • 318
  • 319
  • 320
  • 321
  • 322
  • 323
  • 324
  • 325
  • 326
  • 327
  • 328
  • 329
  • 330
  • 331
  • 332
  • 333
  • 334
  • 335
  • 336
  • 337
  • 338
  • 339
  • 340
  • 341
  • 342
  • 343
  • 344
  • 345
  • 346
  • 347
  • 348
  • 349
  • 350
  • 351
  • 352
  • 353
  • 354
  • 355
  • 356
  • 357
  • 358
  • 359
  • 360
  • 361
  • 362
  • 363
  • 364
Figure 18-3.
Example 1: Inheritance of Multiple Permissions
VM A
VM B
VM Folder
group
B + role 2
user 1 has permissions
of
role 1 and role 2
group
A + role 1
Example 2: Child Permissions Overriding Parent Permissions
This example illustrates how permissions assigned on a child object override permissions assigned on a parent
object. You can use this overriding behavior to restrict user access to particular areas of the inventory.
In this example, permissions are to two different groups on two different objects.
n
Role 1 can power on virtual machines.
n
Role 2 can take snapshots of virtual machines.
n
Group A is granted Role 1 on VM Folder, with the permission set to propagate to child objects.
n
Group B is granted Role 2 on VM B.
User 1, who belongs to groups A and B, logs on. Because Role 2 has been assigned at a lower point in the
hierarchy than Role 1, it overrides Role 1 on VM B. User 1 can power on VM A, but not take snapshots. User
1 can take snapshots of VM B, but not power it on.
Figure 18-4.
Example 2: Child Permissions Overriding Parent Permissions
VM A
VM B
VM Folder
group
B + role 2
user 1 has permissions
of
role 1 only
user 1 has permissions
of
role 2 only
group
A + role 1
Example 3: User Permissions Overriding Group Permissions
This example illustrates how permissions assigned directly to an individual user override permissions assigned
to a group that the user is a member of.
In this example, permissions are assigned to a user and to a group on the same object.
n
Role 1 can power on virtual machines.
n
Group A is granted Role 1 on VM Folder.
n
User 1 is granted No Access role on VM Folder.
User 1, who belongs to group A, logs on. The No Access role granted to User 1 on VM Folder overrides the
group permission. User 1 has no access to VM Folder or VMs A and B.
Figure 18-5.
Example 3: User Permissions Overriding Group Permissions
VM A
VM B
VM Folder
user 1 + no access
user 1 has
no access to the folder
or the virtual machines
group
A + role 1
Chapter 18 Managing Users, Groups, Roles, and Permissions
VMware, Inc.
219