In Abiquo, user scopes are administrator access lists: scopes control the cloud locations (datacenters and public cloud regions) and tenants (Abiquo enterprises) that an administrator can manage. Scopes can also allow the tenants in a scope to access a resource with this scope. So administrators can use resource scopes to share virtual machine templates and virtual appliance spec blueprints. Abiquo 4.0 introduces user scopes and scope hierarchies.
User scopes
In Abiquo 4.0, administrators assign scopes to users, instead of to roles as in previous versions. During the upgrade, Abiquo will assign role scopes to users with that role. In previous versions, the default scope for all roles was the global scope.
To make it easier to create multiple users with the same scope, Abiquo tenants will now have a default scope. When you create an enterprise it is impossible to have previously created a scope containing that enterprise. So Abiquo manages this situation by adding a new enterprise to the administrator’s scope and assigning that scope as the default for the enterprise. The administrator can later edit the enterprise and change the default scope depending on their own scope.
In the dialog to create a user, Abiquo displays the enterprise default scope as the first element in the dropdown list. An administrator with an unlimited scope (global or all enterprises) can assign any scope, whereas one with a limited scope, can assign lower scopes (child scopes of their scope) or the enterprise default scope.
Manage scopes
The administrator cannot delete a scope if it is the default for an enterprise. The administrator cannot remove an enterprise from a scope if the scope is the default for an enterprise.
Scope hierarchies
Abiquo 4.0 introduces the hierarchy of scopes to enable administrators to share resources to tenants at lower levels without having them in their scope. All scopes except unlimited scopes can have a parent, which defines their position in the hierarchy.
A cloud administrator can create a hierarchy of scopes for sharing resources to lower levels. Or tenants may create enterprises that are automatically added to their scope, and as a result, they are also added to the hierarchy, but not to the parent scopes.
When creating a scope, an administrator with an unlimited scope can select a parent scope and create a hierarchy of different levels of scopes. When an administrator with a limited scope creates a scope, it can only be a lesser scope.
The tenants in the child scope do not need to be included in the parent scope, if the administrator does not need to manage these tenants (e.g. edit enterprise, manage users, and so on).
For example, an enterprise may have two enterprises in scope. But the enterprise's scope may be the parent scope of other scopes.
A user with a parent scope may share resources with enterprises (tenants) included in all lower child scopes, even if these enterprises are not included in the parent scope, meaning that the parent scope enterprises cannot manage these enterprises.
A user with a lower child scope may share resources with its lower child scopes.