DocsKnowledge BaseAPI Explorer
Documentation›ZCF›ZStack Cloud›Explore more›Account Management TutorialZCF

Overview

ZStack Cloud supports multi-accont management, which resembles Amazon's Identity and Access Management (IAM). A multi-account architecture contains accounts, users, and user groups, empowering you with fine-grained control over the user's permissions for resource operations.
Note: For most private cloud scenarios, you can achieve resource isolation using accounts, with no need to use users.

This tutorial provides an introduction of sub-account management in a multi-account architecture.

Sub-Account

Sub-account is a new concept introduced by ZStack Cloud for resource control, which is used to define and isolate resource owners.

Each sub-account can use, modify, share, and revoke its own resources, as well as use resources shared with it by other sub-accounts (Specifically, "use" stands for operations such as creating a VM instance or creating a volume). Sub-account is created and managed by the admin, is given the permission to manage the virtual resources it creates.

After installing ZStack Cloud, you need to log in to the Cloud through the admin to add and configure key resources following the wizard. Then you can create sub-accounts. By default, a sub-account has no access to key resources created by the admin, such as instance offerings, disk offerings, hosts, images, and networks. For the sub-account to create a VM instance, the admin needs to share with it the necessary resources including instance offerings and networks. A sub-account has the permissions to create, delete, and manage VM instances, images, volumes, security groups, user groups, and users.

The following table elaborates on the differences and connections between the admin and a sub-account.
Attribute Admin Sub-Account
Life Cycle Always exists and cannot be deleted. Created by the admin and can be deleted.
Default Permission Global super permission. Partial permission.
Resource Quota Global use. Quotas are managed by the admin.
Available Resources Global resources (except for user groups). VM instances, images, volumes, security groups, user groups, and users.
Sharable/Revokable Resources Disk offerings, volume offerings, networks, and images. Images shared by the admin.
VM Instances Created by Other Accounts Global view and control. Cannot view or control resources of other accounts.
Images Added by Other Accounts Global view and control.
  • Only visible after being shared by the admin.
  • Read-only permission.
Sharing/Revoking Method Single account / Accounts in Batches / Global.
  • Cannot share/revoke resources.
  • Resources created by a sub-account can be shared/revoked by the admin.
Supported Operations Global operations (except for creating and modifying permissions for common users). All operations on the resources it creates, including VM instances, images, volumes, security groups, user groups, and users.
Prerequisites for Creating a VM Instance Configure the basic environment by the wizard.
  • The admin completes the Cloud initialization by the wizard.
  • The admin shares resources including instance offerings and networks.
  • The sub-account adds an image or uses an image shared by the admin. (For the sub-account to install an image, the admin needs to share disk offerings.)
Consequences of Deletion Cannot be deleted. Once the sub-account is deleted, all resources owned by the sub-account are also deleted, including VM instances, images, volumes, security groups, user groups, and users.
Naming Uncustomizable. Customizable. Account names must be unique.

Typical Scenarios

Create a VM Instance with a Local Sub-Account

About this task

This scenario introduces how to create a VM instance with a local sub-account. Follow these steps:
  1. The platform manager of ZStack Cloud (the admin) creates a local sub-account.
  2. (Optional) The admin modifies quotas for the local sub-account.
  3. The admin shares resources with the local sub-account.
  4. The local sub-account logs in to the Cloud.
  5. The local sub-account creates a VM instance.

Procedure

  1. The platform manager of ZStack Cloud (the admin) creates a local sub-account.

    On the main menu of ZStack Cloud, choose Settings > Sub-Account Setting > Sub-Account Management. On the Sub-Account page, click Create Sub-Account. Then, the Create Sub-Account page is displayed.

    On the displayed page, set the following parameters:
    • Type: Select the sub-account type.
      Note: ZStack Cloud supports two sub-account types.
      • Local Sub-account: The account information is stored locally. If you add a ZStack IAM server, you cannot create a local sub-account.
      • SSO Sub-account: The account information is synchronized to the SSO server for cross-platform SSO. You can create an SSO sub-account only after you add a ZStack IAM server.
    • Name: Enter a name for the local sub-account.
    • Description: Optional. Enter a description for the local sub-account.
    • Password: Enter a password for the local sub-account.
    • Confirm Password: Confirm the local sub-account password.
    • Pricing List: Optional. Select a pricing list. If left blank, the default pricing list is used.
    Figure 1. Create Local Sub-account


  2. The admin modifies quotas for the local sub-account.

    The Cloud assigns default resource quotas for each local sub-account. You can customize the quotas to fit your needs. To modify the quotas, navigate to the Sub-Account page and click on a sub-account to access its details page. Under the Sub-Account Quota section, you can see the resource quotas, or the upper resource limit, available to the sub-account. Select a resource type and adjust the quota as needed.

    Figure 2. Modify the Local Sub-Account Quotas


  3. The admin shares resources with the local sub-account.

    By default, the resources created by the admin, including instance offerings, images, and networks, are not shared with sub-accounts. For a sub-account to create a VM instance, the admin must first share these resources with the sub-account. Here is an example of how to share an instance offering, and the same steps can be followed for other resources.

    On the main menu of ZStack Cloud, choose Resource Center > Resource Pool > Compute Configuration > Instance Offering. On the Instance Offering page, locate an instance offering and choose Actions > Set Sharing Mode. Then select the target local sub-account and click OK. You will be able to see this instance offering when you create a VM instance with the local sub-account.

    Figure 3. Share Instance Offering using Admin


    Note: The admin can create various resources and selectively share them with different sub-accounts. This strategy enables efficient resource isolation among multiple accounts.
  4. The local sub-account logs in to the Cloud.

    Click the Logout button in the upper right corner of the browser to log out of the admin account. Then, log in to the Cloud using the newly created local sub-account.

    Figure 4. Sub-Account Login


    Upon logging in with the sub-account, the dashboard will display the available resource information for this account. This information is in line with the quotas managed by the admin.

    Figure 5. Dashboard of the Local Sub-Account


  5. The local sub-account creates a VM instance.
    After you log in to the Cloud with the local sub-account, you can create a VM instance following these steps: Choose Resource Center > Resource Pool > Virtual Resource > VM Instance. On the VM Instance page, click Create VM Instance and finish relevant configurations. For more information, refer to Create a VM Instance in User Guide.
    Note: When you use a sub-account to create a VM instance, you need to either use the admin account to share relevant resources including instance offerings, images, and networks, or create/upload new resources using the sub-account.

What to do next

Now, you have learned how to create a VM instance with a local sub-account.

Create a VM Instance with a 3rd-Party Sub-Account

About this task

ZStack Cloud supports seamless access to OIDC third-party authentication systems, allowing OIDC sub-accounts to log in to the Cloud without the password and manage cloud resources.

This scenario introduces how to create a VM instance with an OIDC sub-account. Before you begin, make sure you have added an OIDC authentication server to ZStack Cloud and synchronized its sub-account information. Then, follow these steps:
  1. The OIDC authentication system admin configures ZStack Cloud to be the client of the authentication system.
  2. The platform manager of ZStack Cloud (the admin) adds an OIDC authentication server to the Cloud.
  3. (Optional) The admin modifies quotas for an OIDC sub-account.
  4. The OIDC sub-account logs in to the Cloud without a password.
  5. The OIDC sub-account creates a VM instance.

Procedure

  1. The OIDC authentication system admin configures ZStack Cloud to be the client of the authentication system.

    To configure ZStack Cloud as a client of the authentication system, you need to log in to the OIDC authentication system using the administrator account and generate a unique Client ID and a Client Secret for the Cloud.

  2. The admin adds an OIDC authentication server to the Cloud.
    Set the following parameters:
    • Name: Enter a name for the OIDC server.
    • Description: Optional. Enter a description for the OIDC server.
    • Type: The third-party authentication server type. Currently, only OIDC is supported. It authenticates and authorizes third-party users to log in to the Cloud without a password and syncs user information to the Cloud based on the mapping rule.
    • Client ID: Enter the unique ID that the authentication system assigns to the Cloud.
    • Client Secret: Enter the secret that the authentication system assigns to the Cloud.
    • Authorization Request URL: Enter the request URL used to obtain an authorization grant in authorization code mode.
    • Token Request URL: Enter the request URL used to obtain an access token from the authentication server.
    • User Mapping Rule: Through the mapping rule, the third-party user has local user attributes after it is synced to the Cloud. The rule is used to map third-party attributes of a third-party user to Cloud local attributes.
      • Name: Specify a rule to map the attribute of OIDC users to the name of Cloud users. The name is the unique identification of a user. Make sure that the name that you fill in also has a unique identity in the authentication system.

        For example: If a Name maps name, the Name whose user is synced to the Cloud can use the value (such as John) matching name.

      • Description: Optional. Specify a rule to map the attribute of OIDC users to the description of Cloud users.

        For example: If a Description maps description, the Description whose user is created in the Cloud can use the value (such as dev-backend) matching description.

  3. (Optional) The admin modifies quotas for an OIDC sub-accounts.

    The Cloud assigns default resource quotas for each OIDC sub-account. You can customize the quotas to fit your needs. To modify the quotas, navigate to the Sub-Account page and click on a sub-account to access its details page. Under the Sub-Account Quota section, you can see the resource quotas, or the upper resource limit, available to the sub-account. Select a resource type and adjust the quota as needed.

    Figure 6. Modify the OIDC Sub-Account Quotas


  4. The OIDC sub-account logs in to the Cloud without a password.

    Once an OIDC authentication server is added to ZStack Cloud, a Password-free Login URL will be generated. The administrator of the business application system can configure this URL into the application system, such as a unified portal website. OIDC sub-accounts can then click on the corresponding application icon to log in to the Cloud password-freely.

    Figure 7. Password-free Login URL


  5. The OIDC sub-account creates a VM instance.

    After you log in to the Cloud with the OIDC sub-account, you can create a VM instance following these steps: Choose Resource Center > Resource Pool > Virtual Resource > VM Instance. On the VM Instance page, click Create VM Instance and finish relevant configurations. For more information, refer to Create a VM Instance in User Guide.

What to do next

Now, you have learned how to create a VM instance with an OIDC sub-account.
PreviousNetwork QoS & Disk QoS TutorialNextTheme & Appearance Customization Tutorial
Account Management Tutorial | 4.8.38 | ZStack Cloud · ZCF | ZStack Resource Center