How Users, Roles, and Organizations Relate

Platform Roles and Organization Roles

Organization and organization role features require the appropriate license.

Under Affiliation Information on a user's details page, view Platform Role and Organization Role separately. Their scope and assignment methods are described below.

A user without an organization role cannot log in to ZCenter in Organization View. When assigning an organization role, specify both the organization and the role.

View User Information and Roles

Find the account by username in the user list and review the following information:

• Authentication Type: Check the account's authentication source.
• Status and Locked?: Check whether the account is enabled and whether it is locked.
• Administrator Role: Check whether the user has an associated platform role.

Click the username to open the details page. View basic account information on Overview. Under Affiliation Information, switch between Platform Role and Organization Role to view the assigned platform role and the user's role in each organization.

To add or remove organization members or change a member's organization role, see Manage Organizations and Members.

Create a Local User Manually

Manual user creation requires permission both to create users and to assign roles to them. Before creating a user, identify the role to assign. Use an existing role if suitable; to define custom page permissions, first see Create a Role. To select an organization role, your license must support organization features, and the organization the user will join must already exist.

1. In the user list, click Create User.
2. Set Creation Method to Add Manually.
3. Complete the configuration using the following descriptions.

   Parameter	Description
   Role	Select an existing platform or organization role based on the user's platform administration or organization responsibilities.
   Organization	After selecting an organization role, select the organization the user will join.
   Username	Enter the name the user will use to log in to ZCenter. It must be 2–20 characters long and can contain Chinese characters, English letters, digits, and the following symbols: -, _, ., (, ), :, and +. It must not duplicate an existing username.
   Password	Set an initial login password or click Auto-generate. The password must meet the requirements shown on the page.
   Require Password Change	Choose whether the new user must change the initial password at first login.
   Require Periodic Password Changes	Choose whether the user must change the password periodically. If enabled, specify Password Validity Period. After the password expires, the user must contact an administrator to change it.
   Password Validity Period	Required when Require Periodic Password Changes is enabled. The unit is days, and the minimum value is 1.
   Phone Number, Email	Enter the user's contact information. Email is required; the phone number is optional.

4. Verify the role, organization, and account information, then click Confirm Creation.
5. After creation succeeds, save the account and password information shown in the success dialog box, then confirm to return to the user list.
6. Find the new account in the user list, check its status, and open its details page to confirm the assigned role and organization.

If a message says that the account was created but role binding failed, follow the message and click Confirm Creation again. If a message says that the creation result is unconfirmed, first check the user list to determine whether the account was created, then assign a role to that account.

Import Users in Batches

To create multiple users at once, prepare user information using the CSV template provided on the creation page.

1. In the user list, click Create User and set Creation Method to Batch Import.
2. Click Download Template, enter user information according to the current template's fields and requirements, and save it as a CSV file.
3. Select or drag the prepared CSV file into the upload area, verify it, and click Confirm Creation.
4. Return to the user list, find the imported accounts, and check their status, assigned roles, and organizations.

Assign or Change a User's Platform Role

To change a user's platform administration permissions, add or change the platform role on the user's details page. You cannot change your own platform role or the platform role of a super administrator account here.

1. Click the target username in the user list. Open Affiliation Information and select Platform Role.
2. If no platform role is assigned, click Add. To change an existing platform role, click Edit.
3. In the Add Platform Role or Modify Platform Role dialog box, select the required Platform Role and click OK.
4. Return to Platform Role and confirm that the role you assigned is displayed.

To change the page permissions included in a role, see Modify Page Permissions.

Maintain Existing Users

The following operations are unavailable for the account you are currently logged in with and for super administrator accounts.

View Roles and Their Use

Find roles in the list by name, description, and Type. Predefined roles have a Predefined Role label. Click a role name to open its details page.

You can assign predefined roles directly to users, but cannot change their names, descriptions, or page permissions, or delete them. To configure permissions for specific responsibilities, create a custom role.

If an existing role suits the user's responsibilities, assign it directly to the user.

Create a Role

1. In the role list, click Create Role.
2. Enter a Name and, optionally, a Description. The name is required, must not exceed 50 characters, and must not duplicate an existing role name. The description must not exceed 255 characters.
3. Choose the role's scope as follows.

   Scope	Selection
   Platform administration	Set Type to Platform Role.
   Responsibilities within an organization	If your license supports organization features, set Type to Organization Role, then select Organization Manager or Organization Member.

4. Under Page Permissions, expand the function list and select the permissions to grant to this role. The available permissions depend on the role type.
5. Verify the role type and page permissions, then click Confirm Creation.
6. Return to the role list, find the new role, and open its details page to check its type and page permissions.

Users can use a role after it is assigned to them. Choose the assignment method based on the role type:

• Platform roles: Assign them on the user's details page. For instructions, see Assign or Change a User's Platform Role.
• Organization roles: Select them when adding organization members. For instructions, see Add Existing Users and Assign Organization Roles.

Modify Page Permissions

Before modifying a custom role's page permissions, check Associated Users to identify the users who have the role.

1. Click the target role name in the role list and open the Page Permissions tab.
2. Click Modify Page Permissions to open the editing page.
3. Select the permissions to grant and clear the permissions to revoke.
4. Verify the changes and click OK.
5. Return to Page Permissions on the role's details page and confirm that the updated permissions are displayed.

Change a Role's Name and Description

On a custom role's details page, click Edit, change the Name or Description, and click OK. To change page permissions, open the Page Permissions tab and click Modify Page Permissions.

View and Modify Organization Information

Find the organization by name, ID, and description, then review the following information on its details page:

Click Edit on the organization's details page, change the Name, ID, or Description, verify the changes, and click OK.

Create a Subordinate Organization

Create a subordinate organization from its parent organization's details page. The Create Subordinate Organization menu item is not displayed for level-10 organizations.

1. Open the parent organization's details page and select Create Subordinate Organization from Actions.
2. On the Create Organization page, check Parent Organization to confirm where the new organization belongs in the hierarchy.
3. Enter a Name of up to 128 characters. Optionally, enter an ID and Description. The ID must not duplicate another organization's ID, and the description must not exceed 255 characters.
4. Under Organization quotas, enter resource allowances and choose whether to enable Enforce resource application quotas. For requirements, see Quota Settings.
5. Verify the organization hierarchy, basic information, and quotas, then click Confirm Creation.
6. Open the new organization's details page, check its basic information and quotas, then add members.

Add Existing Users and Assign Organization Roles

Before adding an existing user who has not joined the target organization, decide which organization role to assign. To create an account and select its organization, see Create a Local User Manually.

1. Open the User tab on the target organization's details page and click Add User.
2. In the window that opens, select an existing User and a Role. Choose an organization manager role, an organization member role, or an existing custom organization role.
3. Verify the selected user and organization role, then click OK.
4. Return to the organization's User list and confirm the member and role.

To define custom page permissions for an organization role, first see Create a Role.

Change a Member's Organization Role

Under Affiliation Information on a user's details page, you can change the user's role in an organization. This operation requires permission to modify user roles and is unavailable for your current login account and super administrator accounts.

1. Find the user under System Configuration > Account Management > User and click the username to open the details page.
2. Open Affiliation Information and select Organization Role.
3. Find the target organization in the Organization column, check the current role, and click Edit in that row.
4. In the Edit Organization Role dialog box, verify the organization name, select the new Role, and click Confirm.
5. Return to the organization role list and confirm that the user's role in the target organization has been updated.

Remove Organization Members

When a user no longer works within an organization, you can remove the user from that organization.

1. Open the User tab on the target organization's details page and find the member.
2. Select Remove from Actions in the member's row.
3. In the Remove User confirmation dialog box, verify the username, read the message, and click OK.
4. Return to the organization's user list and confirm that the user is no longer listed as a member.

View Quotas and Usage

1. In the navigation pane, choose System Configuration > Account Management > Organization and open the target organization's details page.
2. Under Quota Management on the Overview tab, view Quota, Used, and Available for vCPU, memory, and data storage.
3. To modify quotas or check whether Enforce resource application quotas is enabled, click Modify Quota to open the Edit Quota dialog box.

Quota Settings

When creating or modifying organization quotas, enter the allowances described below.

Organization Quota is the allowance assigned to the organization itself. Total Quota limits the allowance that can be allocated to the organization and its subordinate organizations. Whether total quotas are displayed depends on the organization type. When displayed, they can be modified only by the built-in admin account in Platform View. After modifying a total quota, check whether the organization quota also needs adjustment.

When modifying an existing organization's quotas, newly entered allowances must be within the current allocatable range. You can retain existing allowances that you have not changed, even if the allocatable range has changed.

Modify an Existing Organization's Quotas

1. Open the target organization's details page. Under Overview > Quota Management, click Modify Quota.
2. In the Edit Quota dialog box, review the current allowances and allocatable ranges for vCPU, memory, and data storage.
3. Modify the allowances that need adjustment. If Unlimited is selected, clear it before entering a value within the range. To set no numeric upper limit, select Unlimited if the option is displayed. If you can modify Total Quota, check both the total and organization quotas.
4. Choose whether to enable Enforce resource application quotas.
5. Verify the organization, allowances, units, and whether Enforce resource application quotas is enabled, then click OK.
6. Return to the details page to review the quotas, then reopen Edit Quota to confirm that the allowances and Enforce resource application quotas setting have been saved.

When creating an organization, enter allowances under Organization quotas, choose whether to enable Enforce resource application quotas, and click Confirm Creation.

Check the Saved Settings

After saving, check both the allowances and whether Enforce resource application quotas is enabled. Configured allowances are retained when this option is disabled, so the quota values alone do not indicate whether enforcement is enabled.

If a message says an allowance is outside the allocatable range, adjust it according to the latest range shown on the page. If quota information or allocatable ranges fail to load, click Reload and wait for the information to appear before making further changes.

View AccessKey Information

Find the AccessKey by AccessKey ID, Owner, and Created At, then check its State.

The AccessKey Secret is hidden by default. Click the show icon to view the Secret, or click the copy button to copy it.

Generate and Save an AccessKey

1. Click Generate AccessKey above the list.
2. Find the new record in the list and check its Owner, Created At, and State.
3. Select and copy the AccessKey ID text, then click the copy button next to AccessKey Secret. Save the ID and Secret together.

Enable or Disable AccessKeys

Find the AccessKey by AccessKey ID and Owner, then open Actions in its row. Select Enable for a disabled AccessKey or Disable for an enabled AccessKey. Then check State in the list.

Delete an AccessKey

Before deleting an AccessKey, confirm that the relevant systems no longer need it. After deletion, the AccessKey can no longer be used for API access.

1. Select Delete from Actions in the target AccessKey's row.
2. In the Delete AccessKey confirmation dialog box, verify the AccessKey ID and read about the effect of deletion.
3. Select I understand the risks. and click OK.
4. Return to the list and confirm that the AccessKey has been deleted.