topic Re: Make vCenter Plug-in Read-Only in Application Integration

Make vCenter Plug-in Read-Only

jeberhardt42 — Wed, 17 Jun 2015 14:06:26 GMT

Is there a way to install the vCenter plug-in, but make it read-only so no changes can be made within? We have 2 accounts configured on each of our SANs that we deploy for customers, 1 for our engineers (full admin) and one for our support techs (read-only). I would prefer that the plug-in into vCenter acts the same way as the read-only account where our support techs are able to look at volumes and view statistical information, but not modify them.

We have all vCenter servers configured with active directory integration and currently, the AD account that we use to install the plug-in is a vCenter admin. I was going to try to put that user account into a read-only group within the vCenter server, but I wasn't sure if that user would be able to install the plug-in at that time and it would break or not even install.

Has anyone tried this before and had it work as i'm describing?

Thanks everyone

Re: Make vCenter Plug-in Read-Only

marktheblue45 — Thu, 18 Jun 2015 16:21:09 GMT

Hi Joe, Just go into the Vcentre Permission for the Nimble storage extension and you can change its permissions for a particular role. I have a role called Vcentre_SAN_Admin that has full permissions whereas general Vcentre Admins or lesser have only browse. It is flexible and my initial concern was the same as yours. Regards, Mark.

Re: Make vCenter Plug-in Read-Only

marktheblue45 — Thu, 18 Jun 2015 16:24:04 GMT

Create a Role like Vcentre SAN Admin first with FULL permissions. Add the appropriate users to that and then tune the other roles to not have full monty to the Nimble plugin for vCentre. I appreciate the default role Admin is not tuneable.

Re: Make vCenter Plug-in Read-Only

jeberhardt42 — Thu, 18 Jun 2015 20:34:34 GMT

EXCELLENT! Thank you Mark, this is exactly what I was looking for. I didn't realize that we could manage the extension in that way to be able to trim down the functions. I'm going to play around with some of the settings to see what else I can configure with it but again, perfect answer!