Roles & Permissions

Role management allows you to control the roles that have access to your resources using the defined permissions for each role. They can Create, Read, Update, Delete and Execute resources. You can also add new roles with customized permissions from the Admin section.

What are Permissions ?

Permissions are the rights and privileges given by the cloudspace owner that define access rights to the cloud resources. Permissions can be the same for multiple roles and unique for others, this depends on every role's responsibilities.

Steps to add a new role

1. Click Admin in the left menu, then click Roles.

2. You can see the list of the available roles on your cloudspace. Click Add Role at the top of the page.

3. Enter the new role Name, Description (optional), Permissions, then click Add Role.

   

4. You will find your new role with its permissions added successfully to the roles list page.

Authorization Required

If your account does not yet have the IAM owner scope, the portal first shows an Authorization Required dialog ("The user:ownerof:organization scope for organization ... is needed to continue the operation!") with AUTHORIZE and CLOSE buttons. Click AUTHORIZE to continue.

How to assign a role to a specific user ?

1. Select the new role that you have created in the roles list and you will be redirected to the role details page.

2. Click Manage Members at the top of the page.

3. You will be redirected to the sub-organizations window inside the Identity and Access Management (IAM) section.

4. Click Invite User at the top of the page to add a new user under the new role that we have previously created.

5. Select whether the new user will be an owner or a member in your organization, then enter his email and click Add User.

   Tip

   Owner/member here is an IAM organization distinction and only controls who can invite or remove members of the organization. It is not what grants access to the portal's Admin section: the Admin section (Roles, Service Accounts, DNS, Certificate Store, License Notifications) is shown only to platform admins and to users who hold an admin role grant on the customer (see "Customer-Level Role Grants" below).

6. You will be redirected back to the users of your organization list where you can find the new user that you invited with a pending status until he accepts your invite to the organization.

7. If you want to delete a user just click and click Confirm to confirm this action.

Now our user has a role with defined permissions that allows him to do multiple operations on the portal.

Granting customer access to your new role

1. Open the New Role Details Page.

2. Click Grant Customer Access at the top of the page.

3. Click Confirm to confirm the action.

4. You will see a New Customer Grant added to your Role Grants List.

Granting access within resources

Cloudspaces

1. Open your Cloudspace, then click More.
2. Choose Roles & Permissions from the menu.
3. Click Grant Role Access at the top of the page.
4. You will be redirected to the roles granting page where you can choose the role you want to grant access to the Cloudspace.
5. Select the desired role from the roles list, then click Grant Access.
6. You will find the new role added to your Roles & Permissions section in your cloudspace.

Tip

You can revoke the access from roles within Roles & Permissions section in your cloudspace by clicking on the X icon under the actions of each role.

Virtual Machines

1. Open your cloudspace, then choose the VM that you want to grant the role access to.
2. Click Roles & Permissions.
3. Click Grant Role Access at the top of the page.
4. You will be redirected to the roles granting page where you can choose the role you want to grant access to the VM.
5. Select the desired role from the roles list, then click Grant Access.
6. You will find the new role added to your Roles & Permissions section in your VM.

Tip

You can revoke the access from roles within Roles & Permissions section in your VM by clicking on the X icon under the actions of each role.

Objectspaces

1. Open your Objectspace, then select its Roles & permissions tab.
2. Click grant role access at the top of the page.
3. Select the desired role from the roles list (shown by Name and Id), then click Grant access.
4. You will find the new role added to your objectspace's Roles & permissions section.

VDI Profiles

1. Open your VDI Profile, then select its Roles & permissions tab.
2. Click Add role at the top of the page.
3. Select the desired role from the roles list, then click Grant access.
4. You will find the new role added to your VDI profile's Roles & permissions section.

Note

Granting a role directly to a VDI profile only covers end-user session access to that profile. It's one half of the recommended VDI access setup — see VDI: Recommended Role Setup for the broader cloudspace-level role a service account needs to provision VMs for the profile.

Grantable Resource Types

Roles can be granted to the following resource types: Customer, Cloudspace, Objectspace, Location, Disk, Virtual Machine, and VDI Profile. (The "Granting access within resources" section above covers Cloudspaces, VMs, Objectspaces, and VDI Profiles; Disks and Locations are also supported.)

Customer-Level Role Grants

In addition to granting a role to a specific resource, you can grant a role at the customer level (from the customer's Roles & Permissions page), which applies to all resources under that customer.