Manage roles

Each cloud user has a role to define how they can work with resources. Each user role has a set of privileges to allow access to different cloud features.

There are four default user roles in the system: Cloud administrator, Enterprise administrator, User, and Enterprise viewer. See Default roles. You can clone the default roles and modify them to create your own roles.

The Privileges page lists all the privileges and shows the default roles that they belong to. 
The default roles are global roles so they are available to all enterprises but it is also possible to create a role that belongs to a single enterprise.

Privileges are generally independent. For example, if your user role does not have the Access Infrastructure view privilege, the UI will not display the Infrastructure icon. But if your role has the Manage datacenters and View datacenter details privileges, you can use the API to access the datacenter infrastructure that you cannot access in the UI.

You can specify directory groups for user roles. When users log in, the platform will automatically create users and assign the matching roles to them. You can use LDAP, Active Directory, OpenID Connect, and SAML.

In addition to user roles, each user also has an administration scope to define the resources that a user can view, access, and administer. See Manage scopes. And each user's enterprise has a list of allowed datacenters and public cloud regions that users can work in.

For details of the Abiquo concepts of enterprises and users, see Tenants and users in the Abiquo Walkthrough. 

For information about creating a reseller, see Abiquo cloud reseller guide | Create resellers.

For information about creating a tenant administrator, see Create a tenant administrator user.

Abiquo provides a set of default roles and you can clone and modify them to create new roles. See Default roles. For a list of the privileges for each role, see Privileges.

A user can only have one role, but a role can be associated with multiple OpenID, AD, or LDAP groups. 

When you clone a role, by default the new role will have Copy: as a prefix to its name, for example, Copy: CLOUD_ADMIN.

To create or modify a role:

1. Go to Users → Roles

   • To clone a role, click the duplicate clone button. Select the cloned role and click the pencil edit button

   • To create a new role, click the + add button

2. Complete the dialog.

   1. Enter the Name of the role. The names of global roles must be unique

      • To create a local role, select the Enterprise that the role will belong to

      • To create a global role, select the Make this role global checkbox

   2. Optionally, to create a list of network addresses from which users with this role can access the platform, enter Allowed CIDRs.
      The CIDRs from a user’s role and scope will apply to the user but the allowed CIDRs of the user will have the highest priority.

   3. Enter the corresponding External roles, such as the LDAP group, for the user. This is required in external authentication modes (openid, ldap).
      A user's external roles must map to a single role (local or global).
      See LDAP and Active Directory integration and Abiquo OpenID Connect integration .
      You can also set external scopes.

      • Examples of external roles for LDAP:

        • ldap_group_01

        • ldap_group_02

      • Example for OpenID:

        • id=admins,ou=group,o=qa,ou=services,dc=openam,dc=forgerock,dc=org

Open

Create a role and set external roles

After you create or clone a role, select the role name in the list and edit the privileges as required, then click Save.

To modify the privileges of a user role:

1. Go to Users → Roles

2. For a local role, select the enterprise that the role belongs to

3. From the Roles list select the role

4. In the Privileges pane, select or deselect the privileges 

   • To add or remove groups of privileges, click the All privileges checkbox beside the group name

   • You cannot undo, but you can discard the changes

5. Save the changes by clicking Save

   •  The platform will discard your changes if you do an action outside of the Privileges pane, for example, clicking on a another role name