| Table of Contents |
|---|
Introduction to scopes
...
...
Introduction to scopes
A
...
scope is an access list that contains a list of resources (enterprises and/or datacenters) to allow access.
You can use scopes to:
Create restricted sets of resources for administrators
Share resources with a group of tenants and an optional tenant hierarchy
Create a tenant hierarchy for pricing, billing, and cost and usage aggregation, which is useful for resellers and large organizations
You can also control access to features and resources in the platform with privileges and allowed locations.
...
Create a scope
| Excerpt | name | Create a scope
|---|
| Info |
This is a general guide to creating a scope. But there is more specific guidance for creating different kinds of scopes in the sections below. |
You can use scopes as access lists for users, enterprises, and/or resources. You can also use them to define tenant hierarchies for accounting and billing aggregation.
| Panel | ||
|---|---|---|
| ||
Privileges: Manage scopes, Allow user to switch enterprises, Manage role and scope allowed CIDRs |
To create a scope do these steps:
Go to Users → Scopes
Click the + add button
...
Enter the details as described in the following table
...
Field
...
Description
...
Name
...
The name of the scope
...
Parent scope
...
For General info:
For the Name, we recommend that you identify the tenant, resource, or user group that the scope will apply to
To add the scope to a hierarchy, select a Parent scope. We recommend that under a hierarchy with limited scopes you should not select unlimited scopes (
Use all enterprisesand/orUse all datacenters)
...
Allowed CIDRs
...
To optionally create a default list of network addresses from which users with this scope can access the platform, enter Allowed CIDRs. You can also set allowed CIDRs for a role. The user will inherit the role and scope CIDRs. Any allowed CIDRs set directly for the user will have priority over these inherited allowed CIDRs.
...
External scopes
...
To specify attributes of an external system to define the user groups that this scope should apply to, enter External scopes. An example of an external
...
scope could be an LDAP group for the user.
...
This is for external authentication modes
...
, such as OpenID and LDAP. A user's external scopes must map to a single Abiquo scope (local or global). See LDAP and Active Directory Integration and Abiquo OpenID Connect Integration
...
Scope entities
...
Field
...
Description
...
Enterprises
...
.
To create a default list of network addresses from which users with this scope can access the platform, enter Allowed CIDRs. You can also set allowed CIDRs for a user role. A user will inherit the role and scope CIDRs. Any allowed CIDRs set directly for the user will have priority over these inherited allowed CIDRs.
For Entities:
Select Enterprises to use in the scope. To automatically include all existing and future enterprises, select the
...
option to Use all enterprises.
If you assign this
...
scope to a user
...
, then the user can manage resources in the list of enterprises selected
...
If you assign this
...
scope to a resource
...
, then users can access the resources if they belong to the enterprises that are
...
in the scope
...
list
Enterprise default scopes do not use the enterprises list, but enterprise default scopes are the default scope for users you create in the enterprise
Select Datacenters (and public cloud regions) to include in the scope
...
. To automatically include all existing and future datacenters, select the options to Use all datacenters.
If you assign this
...
scope to a user
...
, then the user can manage resources in the list of datacenters selected.
Resource scopes do not use the datacenters list
Enterprise default scopes do not use the datacenters list, but enterprise default scopes are the default scope for users you create in the enterprise
After you create a scope, you can assign it to a user, an enterprise, or a resource.
...
Create a scope for a tenant and its users
...
Create a scope for the tenant
On the General info tab, select a parent scope, for example,
Global scopeor a reseller scope
In the Datacenters list, select the appropriate locations (datacenters and public cloud regions) where the users will work.
Create the tenant enterprise and on the General tab for the Default scope select the tenant's scope.
Abiquo will automatically add the enterprise to its Default scope
When an administrator creates users in the tenant, the platform will automatically suggest the tenant's enterprise scope for these users.
...
Create a scope for the administrator
On the General info tab, optionally select a parent scope, for example, the Global scope or a reseller scope
Go to the Entities tab. In the Enterprises list, select the enterprises to administer
In the Datacenters list, select the appropriate locations (datacenters and public cloud regions) to administer
...
Create a scope to share resources
The resources in the Catalog (Apps library) Catalogue include images (VM templates) and blueprints (VApp specs).
You may wish to create and maintain a group of core resources and share these with many tenants.
To share a catalog catalogue resource:
Create administrator roles with the appropriate privileges to manage the resources
To share resources, an administrator must also be able to switch enterprises
Define and create scopes as required
The resource scopes should contain the enterprises that will access the resource
The platform allows the user to work with a resource if the user is in a tenant enterprise in the resource's scopes. The platform does not check the user's scope
To share resources with ALL current and future tenants, use the default
Global scopeor create an unlimited enterprise scopeTo allow an administrator to share resources and manage the tenants, add the tenants to the administrator's scope
To allow an administrator to share resources without access to the tenants, add the tenants to one or more scopes, and make the administrator's scope the parent scope
Log in to the enterprise that owns the resources
To modify VM templates, the administrator must be in the enterprise that created the template
To create a new version of a VApp spec, the user must work with a VApp created from the spec in the enterprise that created the spec
Edit a resource and go to Scopes
Select the scopes that contain tenants who will use the resources
...
You can share resources with your own scope and child scopes of your scope
Each tenant can belong to more than one scope
Each scope can have one parent scope only
The platform will only consider the enterprises in the resource scopes, not the locations
...
Assign scopes to create a reseller hierarchy
You can use a reseller hierarchy for billing, pricing, and to manage and aggregate your cloud costs and usage. To create a reseller hierarchy, assign scopes to reseller, key node, and reseller customer tenants.
...
To define the hierarchy levels, use the Default scopes of the reseller, key node, and reseller customer enterprises.
Go to Users → Users → Enterprises
For the reseller and key node enterprises, create a scope
Select an appropriate Parent scope, for example
For a reseller, select the Global scope or no parent scope
For a key node, select the reseller's Default scope as the parent scope
For a sub-enterprise of a key node, e.g. a Department, select the key node's Default scope as the parent scope
Create or edit an enterprise to make it a Reseller or Key node enterprise
Set the appropriate scope as the Default scope for the enterprise. Abiquo will automatically add the enterprise to its Default scope
Note that if you change the default scope of an enterprise, Abiquo will not remove the enterprise from its previous scope
...
Basic scope hierarchy: The administrator for Spain could also have a scope hierarchy beneath the Spain scope that includes the scopes for Eastern Spain and Central and Southern Spain and then their customers at a lower level. The administrator for Spain can only manage the users of the Spanish national organization but they can share templates and Vapp specs with tenants in the scopes at all levels of the hierarchy.
...
| title | Click here to show/hide the hierarchy diagram |
|---|
...
Modify a scope
Notes about modifying scopes:
...