This document is part of the Abiquo walkthrough.
It describes how to manage tenants (enterprises), users, and their permissions and access in the cloud platform (roles and scopes).
The Users tab is where a Cloud Admin will define the enterprises (or cloud tenants) that can use the Abiquo cloud. For example, for an enterprise creating a private cloud the enterprises will be departments, project teams or cost centers. For a service provider the enterprises will be customers of the cloud service (including resellers).
The Cloud Admin controls which datacenters the Enterprise can access. This enables them to exert more control over the Infrastructure. And this information can be presented to the tenant so they can understand exactly where their applications and data are running.
To create an enterprise for a cloud tenant to consume cloud resources:
Log in as SysAdmin
From the Users pane click + to add the new enterprise
Enter the enterprise Name (the Enterprise logo and theme are optional)
Go to Datacenters and select a datacenter for the enterprise to use. Move the datacenter, or public cloud provider or region to the Allowed datacenters list.
Click Save
When creating a new enterprise, the Cloud Admin can define exactly how that enterprise can use the infrastructure. So while the enterprise will have a self-service experience, the Cloud Admin remains in control and defines the boundaries of what the enterprise can do.
At the heart of controlled self service are Allocation limits. These define how much of the compute, storage and networking resources the Enterprise can consume. The Cloud Admin can also exert granular control by defining allocation limits at the level of a datacenter, or even a virtual datacenter. Tenant Admins can also set limits for virtual datacenters.
The Soft Limit defines the point where the platform can issue a warning. In a self-service world this will be a decision point for the user. Do they need to request more resources, or will they look at the resources they are consuming and realize that there are environments that are no longer being used. Perhaps these can be undeployed and those resources made available for new environments.
This can be taken a stage further and the Cloud Admin can reserve physical infrastructure for an Enterprise. Perhaps they own part of the infrastructure, or they wish to take advantage of a Cloud service but do not want to share resources with other tenants. The reserved hardware is only available to the users in the enterprise that has been allocated the reservation of the hardware. Reserve hardware BEFORE the enterprise deploys in the cloud.
To set limits based on the business agreement with the Enterprise holder
Log in as SysAdmin
In Users view, select a specific enterprise
Select Edit and go to Reservations
Select a datacenter and rack where a server will be reserved for this enterprise
Move one of the available servers to add the server to the Reserved servers list.
Log in as ANY user NOT in this enterprise (note rack reserved servers should not be available).
Log in as ANY user in the enterprise with the reserved server.
Within an enterprise, Admins create users with roles. Roles can have over 100 granular privileges and you can base them on the Abiquo default roles for Cloud Admin, Enterprise Admin (tenant admin), and User. The Cloud Admin can therefore delegate as much, or as little administration as they require. Or they can create roles for specific administrative functions (e.g a Network Admin). You can link Abiquo roles to those in an external directory system such as LDAP, AD, or OpenID.
An Enterprise Admin can manage configurations at the enterprise level and provide access to standard users within the enterprise. Typically, this role is assigned to users who are responsible for administration of Cloud services for a specific group. You can also create a reseller user that will manage their own customers and the associated users.
To create an enterprise Admin user do these steps:
Log in as SysAdmin
Select a specific enterprise
Go to the Users pane and click + to add the new user
Select the default role ENTERPRISE_ADMIN
Select Global scope
Go to the Advanced tab and enter user details as required
Click Save
An Enterprise Admin user will be available. This user can manage template libraries and users for the enterprise.
In some environments, you may wish to create additional roles to support the desired models for system administration. You may also need to modify the access rights of existing roles.
To create a custom user role:
Login as SysAdmin
Select Users → Roles
Select the USER role and click the Clone button (or click + to add the new role)
Fill in the necessary info. (External roles are not necessary at this time)
Save the role
Select the role again and select the required privileges, then click Save. See Manage Roles#Privileges table
Create a new user and assign the new role to this user
The Admin can also define Administration scopes. These define groups of enterprises or data centers (Abiquo datacenters or public cloud regions) that can be administered by a user. This allows for more control over the infrastructure and it enables service providers to support a reseller model. Each reseller can manage a scope that is a list of their own customers. Admins can also create a scope hierarchy for sharing resources, such as VM templates and application blueprints, down a "tree branch" that includes the Admin's resellers, their customers and the customers' departments, and so on.