You can assign only a single role to a user on vCenter Chargeback. If the user already has a role assigned to it,
the same is removed and the new role is set on the user. Only a user with the Super User role can assign the
Super User role or the Administrator role to a user on vCenter Chargeback.
You must have the Super User role or the Administrator role to perform this task.
N
OTE
If you assign a role to an LDAP group for a resource, then the LDAP users belonging to the LDAP group
will be assigned the same role on the resources. However, the LDAP user cannot perform any action on the
resources, if the LDAP group does not have at least read privileges on the various resource types at the vCenter
Chargeback level.
Procedure
1
In the Users & Roles tab, click Permissions.
A page listing the users, their type, whether the user has the Super User role or the Administrator role,
and if the user is a vCenter Server user then the vCenter Server name or if the user is an LDAP user or
group then the IP address of the LDAP server is displayed. The page also provides an option to select a
resource type.
2
Select the user from the table listing the users.
If any role has already been assigned to the user on vCenter Chargeback, the same is displayed under
Currently Assigned Role.
3
Select the required role from the menu under Set/Reset Role.
Ensure that you do not select any resource on the left-side pane.
N
OTE
You cannot assign the Super User role on a LDAP user or group.
4
Click Apply.
The selected role is assigned to the user on vCenter Chargeback.
What to do next
Assigning a role on vCenter Chargeback, other than the Super User role, only defines the actions that the user
can perform in the application. This does not implicitly give access to the resources created in the application.
To access a resource, the user must have either created it or should be explicitly assigned a role for the resource.
If the user is assigned the Administrator role, then he implicitly gets access to all the resources created by the
users that he has created.
Assigning the Super User role to a user automatically provides him with complete access to all the resources.
You need not explicitly assign a role to the user for each of the resources created in the application.
Assign a Role to a User for a Resource
A user can access a resource created in the application only if he has created it or has privileges to access it. A
user can be given privileges to access a resource by assigning a role to him for the required resource.
If a user is assigned the Super User role, then he can access any resource created in the application. If a user is
assigned the Administrator role, then he can also access the resources created by the users that he has created.
You can assign only a single role to a user for a given resource. If a user already has a role assigned to him for
a given resource, the same is removed and the new role is set on the user for the selected resource.
A user with the Super User role can assign any role on any resource to a user. A user with the Administrator
role can assign any of the system-defined roles, other than Super User and Administrator roles, and the custom
roles created by him. This user can assign the roles only to users created by him and on the resources he has
access to.
Chapter 4 Authenticating and Managing Users, Roles, and Permissions
VMware, Inc.
71
