...
...
...
...
| Table of Contents |
|---|
Introduction to resellers
Resellers are platform customers (enterprise tenants) that can have their own customers on the platform. This document describes how to create a reseller and a reseller administrator, and the different levels of access that you can grant this user. This document is a basic guide only, and customers should always consult the Abiquo Customer Service team for specific guidance and to resolve any doubts.
The platform has two main ways of controlling user access: through roles with privileges, and through scopes (for administration and resources). This document assumes you have a basic understanding of Abiquo roles and scopes. See Manage Roles and Manage scopes.
Generally, we recommend that you create a tenant admin role for your specific environment based on the default ENTERPRISE_ADMIN role, and then add scope and additional privileges for reseller administrators.
Create a reseller tenant and scope
A reseller admin will have a user scope that includes the Abiquo enterprises (tenants) that they will manage, which are their customers.
The reseller admin can manage these tenants and the resources of each individual tenant.
So, for example, you could have a reseller called "Onseller", which is an Abiquo tenant.
The reseller can then manage its customers (also Abiquo tenants) called "Customer", "Customer2" and "Customer3".
- Create a scope for your reseller, and select the list of tenants that the reseller will administer and the datacenters that they can work with.
- Edit the reseller enterprise and do the following:
- Assign the reseller scope as the Default scope for the enterprise
- Select the Reseller flag, which means that the enterprise will be the reseller for the default scope
The platform will mark the Reseller with (R) in the Enterprise list.
Create a reseller administrator role
| Info |
|---|
This page describes the details of some useful permissions for a reseller administrator role.
|
...
Introduction to reseller admin
A reseller admin role can have a range of privileges depending on how you will manage resellers and cloud users on the platform. So how the reseller will "manage its customers" will vary, depending on the privileges.
Before you create a reseller admin, we recommend that you first extend modify the standard USER and ENTERPRISE_ADMIN role to add all the features you will use in your platform. For public cloud, see Modify user roles to add public cloud. Also remove any privileges for features that you are not using.
...
Create a basic reseller administrator
To create a basic tenant admin role to cover all features for your platform. For example, if your tenant admins should be able to manage hard disks, add this privilege, and so on.
...
reseller administrator, you will first need to define their role, with the privileges they will have to perform actions on the platform.
| Tip |
|---|
To access and manage a user role, an administrator role must have the same privileges or more privileges than the user role. When you activate features for users, by adding privileges to user roles, also add these privileges to your administrator roles. |
A reseller role with minimum restrictions could grant the administrator the following privileges:
All dashboard privileges
Services privileges as required
No infrastructure privileges
Most virtual datacenter privileges (except for infrastructure or system administrator features)
Most virtual appliance privileges (except for infrastructure or system administrator features)
Most Catalogue privileges (except for global and infrastructure features)
Most user privileges (except to Manage reseller enterprises)
No system configuration privileges, except access to reports
Event privileges for the current enterprise
Control privileges as required
For the reseller user Scope, select the reseller scope.
...
...
Adjust the reseller role to your requirements
The following sections describe different ways to use the platform and how
Reseller privileges to switch enterprises
The base privileges for standard reseller admins are these Home view privileges:
List enterprises within scopeAllow user to switch enterprise
When you assign these privileges to a reseller admin role, the user can view a list of their enterprises (in scope) in the home Home view and switch from one enterprise to another to manage virtual resources.
When the reseller admin switches to an enterprise, they will be able do all the typical enterprise administration tasks. For example, obtain public IP addresses and create private networks, upload templates, etc, according to their role, such as upload VM template files.
The reseller admin stays will stay in the enterprise they have switched to until they switch to another. The enterprise does not change when the user logs out and logs in again.
...
Alternative basic reseller admin per tenant
If you wish to maintain a separate administrator account for each tenant, the administrator can log in with a separate user to in each tenant that they will administer. In this case, the user will not use a shortcut button to switch enterprises. So you do not need to add the List enterprises within scope or the Allow user to switch enterprise privilege. We only recommend this option for resellers with a small number of tenants! .
...
Users view privileges
The users view privileges determine how the administrator can manage their customers and cloud users.
It is not necessary for your reseller administrators to have these privileges.
For example, if If you manage all cloud user accounts with a centralized system, you may wish to such as SAML, you can remove the Manage users privilege from the reseller administrator.
User management
...
Manage users
If you are not using a central user management system, you can have an administrator who can manage users. They can then perform the tasks of creating, editing, and deleting the users in the enterprises in their user scope only.
To allow the reseller to manage enterprises and users in a single pane of glass, rather than and not by switching enterprises, assign the privileges to Manage to Manage enterprises and Manage users of all enterprises. This privilege refers to all enterprises, but it means all enterprises within the administrator's scope. Note that although the privilege is called "Manage users of all enterprises", the administrator can only manage the enterprises listed in their scope
If your reseller will be managing users, in addition to the Manage users privilege that is part of the standard tenant admin role, you can assign additional privileges, such as Manage roles.
| Tip |
|---|
To access and manage a user role, an administrator role must have the same privileges or more privileges than the user role. When you activate features for users, by adding privileges to user roles, also add these privileges to your administrator roles. |
Note that each enterprise must have a default Default scope, which the platform will automatically assign to all new users in the enterprise. Note that administrators Many reseller hierarchies use only a single scope each tenant under a reseller, so in this case, the tenant users and administrators may all use the same scope. And an enterprise’s Default scope defines the enterprise’s place in the tenant hierarchy (by the scope and its parent scope), so you should consider this before allowing any changes.
Administrators can change the user scope . However, administrators who can manage scopes if they have the privilege to Manage scopes. Note that administrators with the Manage scopes privilege can also assign the enterprise enterprise’s Default scope to their users, even if it is higher scope than or completely different to their own scope! However, if you are using data aggregation for resellers or key nodes, you must use the enterprise default scope to define the top level scope for the reseller or key node, so it would not be convenient to change it for administrator security.
...
Shared resource management
If your reseller needs to be able to share resources (VM templates and VApp spec blueprints (specs)) to give access to their customers, then your reseller will be able to share templates and specs by assigning selecting (or unassigning) deselecting) scopes for the templates and specs. The administrator can select their own scope and the scopes beneath their below that scope in the hierarchy to for VM templates and specs.
Note that it is possible for enterprises to belong to more than one scope and this means that you can create a scope just to create a group of tenants who will all use the same resources.
...
Resellers creating tenants and the scope hierarchy
If your reseller administrator is able to create their own tenantstenant enterprises, Abiquo will automatically add these to the reseller 's scope.
If the reseller's tenants are part of a scope hierarchy (the reseller scope is a parent of the tenant scope) and your reseller does not need to manage their users or enterprises, then you can remove them from your the reseller 's scope. If you wish to To allow your reseller to manage their own scope hierarchy, assign the Manage the Manage scopes privilege. This means that the reseller can add their tenants to a scope hierarchy beneath their own scope
Reseller Pricing
...
For more information, see:
...
With the platform's pricing system, you can assign prices to your reseller customers using a pricing model, which has a list of resource prices. Generally, you would enable resellers to view their own pricing model and to create new pricing models for their own customers, based on the prices that you will charge them including a markup.
For a guide to Pricing for the Reseller, see Pricing view and the Reseller Pricing section in the pricing documentation.
For details of how to onboard hardware profile prices into pricing models at all levels of the hierarchy, see Synchronize public cloud price lists.
Reseller dashboards
The platform can obtain billing data from public cloud providers and display it on billing dashboards. When you add compute credentials for your reseller customers you can also configure and enable the billing dashboards for them. These dashboards display the latest bills and estimated bills for Amazon, Azure, and Google Cloud.
For more details, see Display cloud provider billing data
Create an organization hierarchy
...