11.5. Managing Roles¶

11.5.1. Viewing Roles¶

Roles are system objects created to embody a certain multitude of permissions, i. e. the parameters that ultimately define the scope of the privileges the user is endowed with. In other words, roles are users’ attributes and are made up of permissions. Permissions are all possible actions that a user or administrator is allowed to perform in the physical server or virtual environment context. You can create any number of roles at your discretion - as long as your own permissions allow you to do so.

To view a list of roles currently existing on the physical server, follow the Security link on the Virtuozzo Automator menu and then click the Roles tab on the Security screen. The information on each role is presented in the table having the following columns:

By default, 20 roles are displayed on a page. To change the number of roles shown per page, click the appropriate link below the table. You can also filter the roles shown in the Roles table. To do that, click Show Search, enter search patterns in the search fields, and click Search. To change what search fields are displayed, click Customize. To have the full list of roles back, click Reset Results. To change the roles order in the table, click the corresponding column name.

On the Roles tab you can complete the following tasks:

• Create a new role by following the New Role link at the top of the Roles table.

• Clone a role by selecting the check box near the corresponding role and clicking the Clone button. Upon the operation completion, the cloned role will be displayed in the Roles table with Copy of preceding the role name. To clone all the roles at once, select the uppermost check box and click the Clone button.

• Remove an existing role by selecting the check box near the corresponding role and clicking the Delete button. To delete all the roles at once, select the uppermost check box and click the Delete button. When deleting roles, please keep in mind the following:

  • You cannot delete a role which is still assigned to any existing user.

  • You cannot delete any of the built-in roles.

If you have already developed a well-designed taxonomy of roles and are going to further maintain it using the built-in roles remember that you cannot modify or rename the built-in roles to fit them in. If you want to have a modified built-in role to be assigned to a user, clone this role first, and then change the cloned role.

11.5.2. Creating New Roles¶

You can create any number of roles at your discretion provided your own permissions allow you to do so. You can create a new role on the New Role page which can be accessed by following the Security link on the Virtuozzo Automator menu, clicking the Roles tab on the Security screen, and then clicking the New Role button over the Roles table.

Under the General Parameters group of parameters, you must enter the name to be assigned to the role in the Name field and can provide the role description in the Description field.

The Privileges and Included Roles groups allow you to define the privileges to be assigned to the role:

• If the privileges of an existing role represent a subset of the privileges to be assigned to the new role, you can save your time by adding the previously created role to the new one. To this effect, expand the Included Roles group by clicking the triangle icon, select the name of the role you wish to include in the new one in the Available table and click the >> button. The selected role will be moved to the Selected table. To cancel your action, select the role in the Selected table and click the << button.

• If there are no roles that can be used as the basis for the role being created, you can manually specify what privileges are to be assigned to the role. In this case, you should browse through the hierarchy of available privileges under the Privileges group and select the check boxes near those privileges that you wish to have included in the role. Each privilege represents the possibility (if the corresponding check box is selected) or impossibility (if the corresponding check box is cleared) to perform a certain action in the scope context. For example, you can select the check box near the Virtual Environment Management privilege to include the right of performing any operations in the virtual environment context (e.g. to create or destroy a virtual environment) in the role. Please keep in mind that selecting a check box which stands for a higher level set of privileges will automatically add the privileges from all lower level sets to the role. So, the Virtual Environment Management privilege includes all the lower level privileges (Configure Virtual Environment, Delete Virtual Environment, etc.).

When setting up VA roles, you should have a clear idea about the scope where these roles will be assigned to users/groups to form permissions. Thus, it is necessary to know in what scope this or that privilege can be applied and what exactly is implied by the privilege. E.g. it bears little sense to include the Log in to Virtuozzo Automator privilege in the role intended for virtual environment administrators and, therefore, used in the virtual environment scope only.

The table below describes all the available privileges and indicates the scopes where they can be used:

The table indicates whether using a particular privilege makes sense in each of the 4 available scopes:

• G - the Global scope;

• U - the scope of a single logical or infrastructure Unit;

• PS - the scope of a single physical server;

• VE - the scope of a single virtual environment.

When you are ready, click the Submit button to start creating the role with the specified parameters.

11.5.3. Configuring Role Parameters¶

The Manage Role page allows you to configure the parameters of any roles existing in Virtuozzo Automator. To display this page, follow the Security link on the Virtuozzo Automator menu, click the Roles tab on the Security screen, and then click the name of the role you wish to edit in the Roles table.

In this window you can configure the following parameters of a role:

• The General Parameters group of parameters allows you to change the name and description of the role by typing the desired information in the fields provided.

• The Privileges and Included Roles groups of parameters enable you to modify the role privileges:

  • Browse through the hierarchy of available privileges under the Privileges group and select or clear the check boxes of those privileges that you wish to include in the role or to exclude from the role, respectively.

  • Expand the Included Roles group and use the >> and << buttons to include/exclude any of the existing roles to the role you are editing, respectively.

When setting up VA roles, you should have a clear idea about the scope where these roles will be assigned to users/groups to form permissions. Thus, it is necessary to know in what scope this or that privilege can be applied and what exactly is implied by the privilege. E.g. it bears little sense to include the Log in to Virtuozzo Automator privilege in the role intended for virtual environment administrators and, therefore, used in the virtual environment scope only.

The list of settings, you can reconfigure in the Privileges section is the same one that you set up when create a new role.

After you have configured the role parameters, click the Submit button for the changed to take effect.