VMware 4817V62 - vSphere - PC, Administration Manual

Page: 209 / 364

Managing Users, Groups, Roles, and
Permissions
18
Use users, groups, roles, and permissions to control who has access to your vSphere managed objects and what
actions they can perform.
vCenter Server and ESX/ESXi hosts determine the level of access for the user based on the permissions that are
assigned to the user. The combination of user name, password, and permissions is the mechanism by which
vCenter Server and ESX/ESXi hosts authenticate a user for access and authorize the user to perform activities.
The servers and hosts maintain lists of authorized users and the permissions assigned to each user.
Privileges define basic individual rights that are required to perform actions and read properties. ESX/ESXi
and vCenter Server use sets of privileges, or roles, to control which users or groups can access particular
vSphere objects. ESX/ESXi and vCenter Server provide a set of pre-established roles. You can also create new
roles.
The privileges and roles assigned on an ESX/ESXi host are separate from the privileges and roles assigned on
a vCenter Server system. When you manage a host using vCenter Server, only the privileges and roles assigned
through the vCenter Server system are available. If you connect directly to the host using the vSphere Client,
only the privileges and roles assigned directly on the host are available.
This chapter includes the following topics:
n
“Managing vSphere Users,” on page 209
n
“Groups,” on page 210
n
“Removing or Modifying Users and Groups,” on page 211
n
“Best Practices for Users and Groups,” on page 211
n
“Using Roles to Assign Privileges,” on page 211
n
“Permissions,” on page 215
n
“Best Practices for Roles and Permissions,” on page 222
n
“Required Privileges for Common Tasks,” on page 223
Managing vSphere Users
A user is an individual authorized to log in to a host or vCenter Server.
Several users can access the vCenter Server system from different vSphere Client sessions at the same time.
vSphere does not explicitly restrict users with the same authentication credentials from accessing and taking
action within the vSphere environment simultaneously.
VMware, Inc. 209