Manage Scopes

Scope concepts

An Abiquo scope is a list of resources (enterprises and/or datacenters) for access control.

A "user scope" is the list of resources (datacenters and enterprises) that a user can view and manage. This is also called an "administration scope". This scope works together with the user's privileges and allowed datacenters, which define how they can use resources. So this means that an administrator can deploy VMs in their enterprise's allowed datacenters, even if the datacenters are not in the administrator's scope.

A "resource scope" is a list of enterprises whose users can access the resource, assuming they have the other required permissions. For example, administrators select scopes for VM templates and Virtual Appliance Spec blueprints. The administrator selects scopes to share the resources with the users of the enterprises within the scopes. They can select their own scope, and if there is a scope hierarchy, they can select the scopes underneath their scope.

A "scope hierarchy" is for sharing resources to tenants that are below an administrator's own scope. Administrators can only manage users in tenants of their own scope. But they can share VM templates and VApp specs with tenants in scopes below their scope.

The following screenshot shows a scope with enterprises and a child scope

The Global scope is the default scope for the cloud administrator that contains all elements and it cannot be modified. 

The following scopes are called unlimited scopes:

• The global scope
• Any scope with the Use all enterprises checkbox selected, which will include ALL current and future enterprises
• Any scope with the Use all datacenters checkbox selected, which will include ALL current and future datacenters

An unlimited scope is always at the top of the scope hierarchy, which means it cannot have a parent scope. An unlimited scope has new resources added automatically, so you will not need to modify it to include new elements. Only a user with an unlimited scope can create an unlimited scope in the same dimensions as their scope.

Scope use cases

A global managed service provider could create a scope for country or region. For example, in Spain, with datacenters in Madrid, Barcelona, Valencia and Seville.

• User scope for datacenters: An administrator for Spain would have access to all these datacenters, but the administrator for Eastern Spain would only have access to Barcelona and Valencia, which are on the east coast of Spain.
• User scopes for enterprises: The administrator for Spain may have scope for Spain that only includes the top-level Spanish national organization to manage its users and resources.
• Scope hierarchy: The administrator for Spain could also have a scope hierarchy beneath the Spain scope that includes the scopes for Eastern Spain and Central and Southern Spain and then their customers at a lower level. The administrator for Spain can only manage the users of the Spanish national organization but they can share templates and Vapp specs with tenants in the scopes at all levels of the hierarchy.

Diagram: an example of a scope hierarchy

Managing Scopes

From the Users view, if you have permission to Manage scopes and the Allow user to switch enterprises privilege, you can access the Scopes tab and manage scopes. 

Create or Modify a Scope

Click the add button to create a new scope.

1. Enter the scope name

• To create a limited scope
  • If it is within a scope hierarchy, select the parent scope
  • Select enterprises and datacenters to include in the scope
• OR To create an unlimited scope for enterprises or datacenters, mark the appropriate checkbox(es). 
  
  • Use all enterprises will automatically include all current enterprises and add all new enterprises
  • Use all datacenters will automatically include all current datacenters and add all new datacenters

Screenshot: an unlimited enterprises and datacenters scope.

To change an unlimited scope to a limited scope, first unselect the Select all checkbox, then select individual resources.  You cannot remove an enterprise from a scope that is using shared templates with that scope. You cannot modify the default Global scope. You cannot modify your own scope. After you create or modify a scope, you can assign it to a user or a resource.

• See Manage Users#CreateorEditaUser
• See Manage resource scopes

Delete a scope

You cannot delete the default Global scope. You cannot delete your own scope. You cannot delete a scope if it is in use in certain circumstances, for example, if it is the default for an enterprise, or it is assigned to a shared template that is in use by an enterprise.  To delete a scope, select it in the list and click the delete button.

Related pages

• Manage cloud tenants: Manage Enterprises
• Create roles with privileges to control access to platform actions: Manage Roles
• Manage Users