In Abiquo, user scopes are administrator access lists. Scopes control the cloud locations (datacenters and public cloud regions) and tenants (Abiquo enterprises) that an administrator can manage. Scopes can also allow the tenants in a scope to access a resource with this scope. So administrators can use resource scopes to share virtual machine templates and virtual appliance spec blueprints. Abiquo 4.0 introduces user scopes and scope hierarchies.
User scopes
In Abiquo 4.0, administrators assign scopes to users, instead of to roles as in previous versions. During the upgrade, Abiquo will assign role scopes to users with that role. In previous versions, the default scope for all roles was the global scope. To make it easier to create multiple users with the same scope, Abiquo tenants will now have Now there is a default scope . When you create an enterprise it is impossible to have previously created a scope containing that enterprise. So Abiquo manages this situation by adding a new enterprise to the administrator’s scope and assigning that scope as the default for the enterprise. The administrator can later edit the enterprise and change the default scope depending on their own scope.for each enterprise tenant.
Which scope can I assign to a user?
In the dialog to create a user, Abiquo displays the enterprise enterprise’s default scope as the first element in the dropdown list. An administrator with the privilege to manage all enterprises and an unlimited scope (global or all enterprises) can assign any scope, whereas one with a limited scope, can assign lower scopes (child scopes of their scope) or the enterprise default scope. A user without the privilege to manage all enterprises can assign their own scope or the enterprise default scope.
The administrator with scope privileges can view their own scope, and view and manage the child scopes beneath their scope in the scope hierarchy. The administrator cannot delete a scope if it is the default for an enterprise.
A user with the default enterprise administrator role can assign the following scopes:
Own scope
The enterprise’s default scope (even if it is higher than their own scope)
An administrator with the “Allow user to switch enterprises” privilege can assign the following scopes:
Own scope
The enterprise’s default scope (even if it is higher than their own scope)
A lower scope in their scope hierarchy
What happens when I create an enterprise?
When you create an enterprise, you must add a default scope for that enterprise, which Abiquo will suggest as the scope for new users. Note that the default scope is always available for selection, even if it is above the scope of the administrator creating the user. Therefore Abiquo recommends that the default scope should be lower than or equal to the administrator’s scope. When you edit the enterprise, you can change the default scope and the new value will be available when you subsequently create users.
When you create an enterprise, Abiquo automatically adds the new enterprise to your scope so you can manage it, for example, to add it to other scopes. And a higher-level administrator can later remove it from your scope.
...
Scope hierarchies
Abiquo 4.0 introduces the hierarchy of scopes to enable administrators to share resources to tenants at lower levels without having them in their scope. All scopes except unlimited scopes can have a parent, which defines their position in the hierarchy.
So for example, the following diagram shows a scope hierarchy. Administrators create this hierarchy by assigning a parent to each scope. The unlimited global scope is the root parent scope.
Because this is a multinational MSP, the national scopes include all the resellers in each of the national units. The national administrators will manage the national reseller users.
Each reseller will have a scope to include their enterprise customers, and each enterprise will have one for their own tenants, which may be business units, or departments, such as the development team and the web team. The users of these teams can be managed by the administrator with a global scope, for example, with automatic user creation. Or they can be managed by the IT team of the enterprise tenant, because they are within their scope.
Administrators can also create scopes for resource sharing. For example, if templates of a particular type are used by a specific tenant type, for example, web teams. In the following diagram, an administrator with scope privileges has created the Web scope, which is a list of web team tenants, and they can assign it to web templates to easily share them with all of the web teams in their hierarchy. There can be multiple branches of the hierarchy and a user can access all branches below their scope.
An administrator with scope privileges also introduces scope hierarchies for resource sharing. A scope hierarchy is for sharing resources with related tenants without the need for the administrator to have all of these related tenants in their own scope. So administrators can share VM templates and VApp specs with tenants in child scopes beneath their own scope, but administrators manage only the tenants within their own scope.
The scope hierarchy feature is optional: you can just create a single level of scopes at the same level as the global scope as in previous versions of Abiquo. The scope hierarchy feature is also flexible, because an enterprise can belong to more than one scope, which means that an administrator could create an enterprise hierarchy for sharing, as well as more scopes for sharing templates of a specific type only with groups of tenants that will use those templates.
Which users can use shared resources?
Access to shared resources is the same as in previous versions. All users whose enterprises are listed in the scopes of a shared resource can access that resource (VM template or VApp spec).
Which users can manage shared resources?
In Abiquo v4.0 the users who can administer shared resources have changed. The criteria are as follows:
User enterprise is listed in the resource scope
Feature privileges (e.g. Manage VM templates in the Apps library)
Allow user to switch enterprise privilege (effectively manage shared resources)
Full datacenter access (User Datacenter scope)
Logged in to the owner enterprise
An administrator with sharing permissions and unlimited scope can manage all scopes. An administrator with a limited scope can assign the following scopes:
Own scope
Child scopes beneath their scope in the hierarchy
Enterprise default scope
To give an example of the tenant administrator, by default, tenant administrators do not have the Allow user to switch enterprises privilege. This means that they can only work with local resources in their own enterprise and Abiquo will not display the Scopes tab when they edit a template or spec.
How do I create a scope hierarchy?
An administrator with scope privileges and the “Allow user to switch enterprises” privilege can create a hierarchy by assigning a parent scope to any scope except an unlimited scope (. An unlimited scope is the Global scope or a Use all enterprises or Use all datacenters scope).
An administrator with the “Allow user to switch enterprises” privilege can view their own scope and manage child scopes beneath their own scope. When an administrator creates a new tenant, this tenant is automatically added to the administrator’s scope, so it is also part of the existing hierarchy. Later a higher-level administrator can move this tenant to another scope in a different part of the hierarchy.
It is important to remember that an scope.
The following diagram shows an example of a scope hierarchy.
...
For an administrator that can manage two resellers called 4x and 5x.
These resellers have customers, with their own departments, and the administrator does not manage their users but the administrator does share templates with them.
...
Does an administrator need to have their own enterprise in scope?
An administrator can belong to an enterprise that is not included in their administration own scope. This , which means that generally, they cannot manage their own enterprise, to add new users, manage credentials, and so on. But administrators can always access the Apps library of their own enterprise without having the enterprise in scope. This access depends on the appropriate some elements of this enterprise, eg. they cannot create users. But an administrator will usually have access to the Apps library, which is determined by their Apps library privileges, allowed datacenters, and datacenter scope. From the Apps library, administrators can also share resources And the administrator will be able to administer templates and specs when their enterprise is the owner of the resource. To share resources and manage shared resources, such as VM templates and VApp specs, with enterprises in their child scopes if they have , an administrator will need access to the owner enterprise and the “Allow user to switch enterprises” privilege.
The following screenshot shows an administrator that can manage two national resellers.
These resellers have customers, which have departments, but this administrator cannot manage them. However, the national administrator can share templates with tenants at lower levels in the scope hierarchy.
Related pages: