This document is part of the Abiquo walkthrough.
It describes how to manage tenants (enterprises), users, and their permissions and access in the cloud platform (roles and scopes).
The Users tab is where a Cloud Admin will define the enterprises that are the cloud tenants that can use the Abiquo cloud. For example, for an enterprise creating a private cloud the enterprises will be departments, project teams or cost centers. For a service provider the enterprises will be customers of the cloud service (including resellers).
The Cloud Admin controls which datacenters the Enterprise can access. This enables them to exert more control over the Infrastructure. And this information can be presented to the tenant so they can understand exactly where their applications and data are running.
When creating a new enterprise, the Cloud Admin can define exactly how that enterprise can use the infrastructure. So while the enterprise will have a self-service experience, the Cloud Admin remains in control and defines the boundaries of what the enterprise can do.
At the heart of controlled self service are Allocation limits. These define how much of the compute, storage and networking resources the Enterprise can consume. The Cloud Admin can also exert granular control by defining allocation limits at the level of a datacenter, or even a virtual datacenter. Tenant Admins can also set limits for virtual datacenters.
The Soft Limit defines the point where the platform can issue a warning. In a self-service world this will be a decision point for the user. Do they need to request more resources, or will they look at the resources they are consuming and realize that there are environments that are no longer being used. Perhaps these can be undeployed and those resources made available for new environments.
This can be taken a stage further and the Cloud Admin can reserve physical infrastructure for an Enterprise. Perhaps they own part of the infrastructure, or they wish to take advantage of a Cloud service but do not want to share resources with other tenants. The reserved hardware is only available to the users in the enterprise that has been allocated the reservation of the hardware. Reserve hardware BEFORE the enterprise deploys in the cloud.
Within an enterprise, Admins create users with roles. Roles can have over 100 granular privileges and you can base them on the Abiquo default roles for Cloud Admin, Enterprise Admin (tenant admin), and User. The Cloud Admin can therefore delegate as much, or as little administration as they require. Or they can create roles for specific administrative functions (e.g a Network Admin). You can link Abiquo roles to those in an external directory system such as LDAP, AD, or OpenID.
An Enterprise Admin can manage configurations at the enterprise level and provide access to standard users within the enterprise. Typically, this role is assigned to users who are responsible for administration of Cloud services for a specific group. You can also create a reseller user that will manage their own customers and the associated users.
In some environments, you may wish to create additional roles to support the desired models for system administration. You may also need to modify the access rights of existing roles.
The Admin can also define Administration scopes. These define groups of enterprises or data centers (Abiquo datacenters or public cloud regions) that can be administered by a user. This allows for more control over the infrastructure and it enables service providers to support a reseller model. Each reseller can manage a scope hierarchy that contains their customers. Admins can also create a scope hierarchy for sharing resources, such as VM templates and application blueprints, down a "tree branch" that includes the Admin's resellers, their customers and the customers' departments, and so on.