After you have added administrative users with Commander roles, assign access rights to your cloud infrastructure. You can assign access rights to:
- Restrict which parts of your cloud infrastructure that each administrative user can access.
- Allow administrative users to carry out a specific set of commands on specific cloud accounts or datacenters.
- Control visibility of events, tasks, and alerts.
Access rights can't be assigned to a user who only has a Service Portal role.
Even when you have restricted your users' access to infrastructure elements that contain a number of sockets equal to or less than your licensed amount, Commander will see all of the sockets available for the entire cloud account. If this amount is higher than the amount for which you purchased licensing, you will receive warnings about exceeding your license. These warnings appear whenever a Commander user logs into the system, but they are not shown to Service Portal users. If you have questions about your license and its enforcement, contact your account manager.
The six levels of access rights that can be assigned to users with Commander roles are:
- Operator with approval
- Operator without deploy/clone (non-provisioning operator)
The following table shows all of the tasks that can be performed with each level of access rights. Remember that access rights restrict what you can see, search for, and manage. For example, when performing a search, your access rights determine what search results will be returned. Some of these tasks also require a particular role.
All of these tasks require some level of access rights; tasks that don't require access rights don't appear in this table.
For each administrative user account, you can assign Commander roles for different access rights to cloud accounts or datacenters.
A higher level of access rights always take precedence over lower levels. For example, if you assign Administrator access rights for a cloud account and then assign Auditor access rights for a datacenter within that cloud account, the user account has Administrator access rights for all datacenters.
Conversely, if you assign Auditor access rights for a cloud account and then assign Administrator access rights on one datacenter within that cloud account, then the user account has Administrator access rights on the specified datacenter and Auditor access rights for the cloud account and all other datacenters in that cloud account.
- You can assign access rights below the cloud account level only for vCenter cloud accounts.
- A user with a Reporter role may only be assigned an access level of Auditor. To display the Reporter role, the
embotics.role.reporter.visiblesystem property must be set to 'True'. Contact customer support before making any changes to a system property.
- A user with a Commander Role of Enterprise Admin can manage access rights if
embotics.permission.modifyrole.nonsuperuseris set to 'True'. Contact customer support before making any changes to a system property.
Configuration > Identity and Access
Commander Role of Superuser and Enterprise Admin
Administrator Access Rights
- Click the Users tab.
- On the Users page, select an administrative user.
- Click Assign Rights.
- From the list, select one or more cloud accounts.
To quickly find a cloud account or datacenter, you can search for it by name.
- (Optional) To assign access rights for a datacenter, select Show datacenters.
The option to show or hide datacenters is only visible when you have datacenters in Commander. By default, if no access rights are assigned to any datacenters, then datacenters are not shown.
- Optional: To assign administrator access rights to all infrastructure resources, select User is administrator on all cloud accounts.
- Click Set Role, and select a role.
- Click OK.