| Table of Contents |
|---|
To define how a user can work with resources, each user has a role with a group of privileges that allow access to different cloud features. You can create roles for each group of users such as cloud administrators, resellers, tenant administrators, standard users, and so on.
...
| Table of Contents |
|---|
Introduction to roles
| Excerpt | ||
|---|---|---|
| ||
Each cloud user has a role to define how they can work with resources. Each user role has a set of privileges to allow access to different cloud features. There are four default user roles in the system: Cloud administrator, Enterprise administrator, User, and Enterprise viewer. See Default roles. You can clone the default roles and modify them to create your own roles. The Privileges page lists all the privileges and shows the default roles that they belong to.
Privileges are generally independent. For example, if your user role does not have the You can specify directory groups for user roles. When users log in, the platform will automatically create users and assign the matching roles to them. You can use LDAP, Active Directory, OpenID Connect, and SAML. In addition to user roles, each user also has an administration scope to define the resources that a user can view, access, and administer |
...
. See Manage scopes. And |
...
each user's enterprise has a list of allowed datacenters and public cloud regions that users can work in. |
You can match user roles to OpenID, AD, or LDAP groups and when the platform will automatically create users and assign them the matching roles.
...
For details of the Abiquo concepts of enterprises and users, see |
...
Tenants and users in the Abiquo Walkthrough. |
| Tip |
|---|
For Abiquo API documentation of this feature, see RolesResource |
| Panel | ||||||
|---|---|---|---|---|---|---|
| ||||||
Privilege: Access roles screen |
...
For information about creating a reseller, see https://abiquo.atlassian.net/wiki/spaces/doc/pages/311361611/Abiquo+cloud+reseller+guide#Create-resellers. For information about creating a tenant administrator, see Create a tenant administrator user. |
...
Display roles
| Panel | ||
|---|---|---|
| ||
Privileges: Access Roles and Scope screens |
To display roles, go to Users → Roles → Roles. By default, you will see the Global roles that are available to for all enterprises and the platform will display them with "(and they have (Global)" after the name.
To display the Enterprise enterprise roles that belong to for a specific enterprise, select the enterprise.
...
...
Create or modify a role
| Excerpt | ||
|---|---|---|
| ||
Abiquo provides a set of default roles and you can clone and modify them to create new roles. |
...
See Default roles. |
...
For a list of the privileges for each |
...
Default Role
...
Description
...
CLOUD_ADMIN
...
role |
...
ENTERPRISE_ADMIN
...
Manages configurations at enterprise level and grants access to other enterprise users. This role is for users that are responsible for an enterprise to manage their cloud services. By definition, users with this role are restricted to administering their own enterprise.
...
USER
...
Manages the virtual appliances of an enterprise. Typically, this role is for users working with the cloud service. By definition, users with this role are restricted to their own enterprise.
...
Create or modify a role
| Panel | ||||||
|---|---|---|---|---|---|---|
| ||||||
Privilege: Manage global role, Associate role with enterprise, Manage roles, Manage scopes, see Privileges.
A user can only have one role, but a role can be associated with multiple OpenID, AD, or LDAP groups. |
...
When you clone a role, |
...
by default the new role will have |
...
|
...
as a prefix to its name, for example, |
...
|
...
. To create or modify a role:
|
...
After you create or clone the role, select the role name in the list and edit the privileges as required, then click Save.
Manage privileges
To modify a role's privileges:
- To modify a local role, select the enterprise
- Select a role from the Roles list
- You cannot modify the privileges of your own role. For other roles, you can only modify the privileges that are also assigned to your own role
- You cannot modify the privileges of the default CLOUD_ADMIN role
- In the Privileges pane, click a checkbox beside a privilege to add or remove the privilege.
- To add all the privileges in a group, click the All privileges checkbox beside the group name
- Privileges are generally independent, for example, a user whose role does not have the "Access Infrastructure view" privilege will not be able to see the Infrastructure icon in the UI. However, if this user's role has the privileges to "Manage datacenters" and "View datacenter details", the user will be able to access these functions through the API
- Save the changes by clicking Save
- Any other action outside of the Privileges pane will discard your changes, for example, clicking on another role name
Privileges table
| Info | ||
|---|---|---|
| ||
...
| class | landsc tinycode |
|---|
...
Home privileges
...
GUI Label _________________
...
Application Tag
...
Privilege____________________________________
...
Cloud Admin
...
Ent Admin
...
Ent User
...
Outbound API
...
Ent Viewer
...
Info
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
Infrastructure privileges
...
GUI Label _________________
...
Application Tag
...
Privilege____________________________________
...
Cloud Admin
...
Ent Admin
...
Ent User
...
Outbound API
...
Ent Viewer
...
Info
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
Virtual datacenters privileges
...
GUI Label _________________
...
Application Tag
...
Privilege____________________________________
...
Cloud Admin
...
Ent Admin
...
Ent User
...
Outbound API
...
Ent Viewer
...
Info
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
Virtual appliances privileges
...
GUI Label _________________
...
Application Tag
...
Privilege____________________________________
...
Cloud Admin
...
Ent Admin
...
Ent User
...
Outbound API
...
Ent Viewer
...
Info
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
Apps library privileges
...
GUI Label _________________
...
Application Tag
...
Privilege____________________________________
...
Cloud Admin
...
Ent Admin
...
Ent User
...
Outbound API
...
Ent Viewer
...
Info
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
Users privileges
...
GUI Label _________________
...
Application Tag
...
Privilege____________________________________
...
Cloud Admin
...
Ent Admin
...
Ent User
...
Outbound API
...
Ent Viewer
...
Info
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
System configuration privileges
...
GUI Label _________________
...
Application Tag
...
Privilege____________________________________
...
Cloud Admin
...
Ent Admin
...
Ent User
...
Outbound API
...
Ent Viewer
...
Info
...
X
...
X
...
X
...
X
...
Prcing privileges
...
GUI Label _________________
...
Application Tag
...
Privilege____________________________________
...
Cloud Admin
...
Ent Admin
...
Ent User
...
Outbound API
...
Ent Viewer
...
Info
...
X
...
X
...
X
...
X
...
Events privileges
...
GUI Label _________________
...
Application Tag
...
Privilege____________________________________
...
Cloud Admin
...
Ent Admin
...
Ent User
...
Outbound API
...
Ent Viewer
...
Info
...
X
...
X
...
X
...
X
...
X
...
Control privileges
...
GUI Label _________________
...
Application Tag
...
Privilege____________________________________
...
Cloud Admin
...
Ent Admin
...
Ent User
...
Outbound API
...
Ent Viewer
...
Info
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
X
...
Key to Info Column of Privileges Table
= new privilege
= changed privilege
= deprecated privilege
Related pages
- Manage cloud tenants: Manage Enterprises
- Manage Users
- Create action lists for users: Manage Scopes
...
 After you create or clone a role, select the role name in the list and edit the privileges as required, then click Save. |
...
Modify the privileges of a role
| Excerpt | ||||
|---|---|---|---|---|
| ||||
To modify the privileges of a user role:
|
...
Manage roles with the API
| Tip |
|---|
API Documentation For the Abiquo API documentation of this feature, see Abiquo API Resources and the page for this resource RolesResource. |
...
Privileges table
See Privileges
...
Related pages
Manage cloud tenants: Manage enterprises
Create action lists for users: Manage scopes