DocsKnowledge BaseAPI Explorer
Documentation›Explore more›ZStack ZSphere›User GuideZVF
Document navigation

Identity and Access Management

Identity and Access Management provides unified user identity management and access control. Administrators can manage user identities, user groups, roles and permissions, and SSO servers. You can create local users or connect to OIDC, AD, or LDAP authentication servers to synchronize users from external authentication systems to the platform.

Roles define the operations that users and user groups can perform. By assigning roles to users or user groups and combining them with resource sharing relationships, administrators can control the scope of platform resources that different users can access.

Prerequisites

Before you use ZSphere Identity and Access Management, make sure the license meet the following requirements:

  • To use Single Sign-On, roles, and user groups, make sure ZSphere is installed with a valid Advanced Edition license.

User Management

A user represents an individual and is the basic unit in identity and access management. Users are created by admins or synchronized from a unified authentication system, and are managed by admins. By sharing resources with users and assigning roles to them, you can achieve fine-grained control over resource ownership and permissions.

Some key features of users include:

  • Users can be either local users or SSO users. Local users are created directly by admins, while SSO users are synchronized from a unified authentication server to the platform.
  • User quotas are standards set by admins to control the total amount of resources allocated to users, including compute resources, data storage resources, network resources, and so on.
  • Users can be members of one or more user groups.
  • Users can be assigned one or more roles. When a user is assigned multiple roles, the user has the combined permissions of those roles. After a user joins a user group, the user inherits the roles assigned to that group in addition to any roles already assigned to the user.

Create a User

Create a local user, assign resource ownership and roles, and then use the user to log in.

Before you begin

  • You need to have admin permissions.
  • If you need to use the roles and user groups functionality, Make sure ZSphere is installed with a valid Advanced Edition license.

Procedure

  1. In the navigation pane, choose System Management > User Management > User.
  2. On the User page, click New User.
  3. In the New User dialog, configure the following options:
    Basic Information
    Option Description
    Username Set a username for the regular user, which serves as the unique identifier for logging into the platform. The username cannot be changed after the user is created.
    Description Enter a brief description for the user.
    Password Set a login password for the user. You can adjust the password setting requirements by modifying Platform Login Password Strength. For more information, see Security Setting Options.
    Confirm Password Re-enter the login password for confirmation.
    Role Assign roles to the user. After roles are assigned, the user has the permissions granted by those roles.
    User Group Add the user to a user group. After joining, the user will inherit all roles and shared resources from the user group.
    Share Resource
    Option Description
    Share Resource Specify the resources to be shared with the current user, including virtual machines, images, templates, distributed switches, and distributed port groups.
  4. Review the configuration and click OK.

Disable or Enable a User

After disabling a regular user, the user will not be able to log in to ZSphere unless the admin enables the user.

Before you begin

You need to have admin permissions.

Procedure

  1. In the navigation pane, choose System Management > User Management > User.
  2. On the User page, select the target user and then click Actions > Disable.
  3. Review the selected items and click OK.
  4. To enable the user later, click Actions > Enable.

Modify User Configuration

Edit the user's basic information, such as the roles assigned to the user, the user groups they joined, and the resources shared with the user.

Before you begin

You need to have admin permissions.

Procedure

  1. In the navigation pane, choose System Management > User Management > User.
  2. On the User page, select the target user and then click Actions > Modify Configuration.
  3. In the Modify Configuration dialog, make the necessary changes to the configuration.

Change a User Password

Before you begin

You need to have admin permissions.

Procedure

  1. In the navigation pane, choose System Management > User Management > User.
  2. On the User page, select the target user and then click Actions > Change Password.
  3. In the Change Password dialog, enter the new password and confirm it again, then click OK.

Convert a User to an Admin User

Procedure

  1. In the navigation pane, choose System Management > User Management > User.
  2. On the User Management page, select the target user, and then click Actions > Change to Admin User.
  3. After you read and confirm the risk information, click OK.

Results

Note:
  • Once a regular user is changed to an admin user, the change cannot be undone.
  • After the change, the previously assigned roles, user group memberships, and shared resources will be automatically removed from the regular user.

Delete a User

Before you begin

You need to have admin permissions.

Procedure

  1. In the navigation pane, choose System Management > User Management > User.
  2. On the User page, select the target user and then click Actions > Delete.
  3. In the Delete User? dialog, carefully read the risk warnings.

Results

Note:
  • The deleted user will no longer be able to log in to the platform, and ownership of their resources will be transferred to admin.
  • Deleting an SSO user does not affect the user information in the source authentication server.

User Group Management

A user group is a collection of users that supports permission control at the group level. With user groups, you can assign permissions to multiple users for easier management. For example, if you have a user group named UserGroup-1 and assign storage-related roles to this user group, all users in the group automatically inherit the role permissions from UserGroup-1. If a new user needs storage-related permissions, you can grant the permissions by adding the user to UserGroup-1. When users change, you do not need to modify permissions for each user. You can remove users from the user group as needed.

Some key features of user groups include:

  • A user group can contain multiple users, and a user can belong to multiple user groups.
  • User groups cannot be nested. User groups can contain only users, not other user groups.
  • A user group can be assigned multiple roles. When a user group is assigned multiple roles, users in the group inherit the combined permissions of those roles.

Create a User Group

Create a user group, add users to the group, so that all users under the user group can obtain the corresponding permissions, facilitating unified permission management.

Before you begin

  • You need to have admin permissions.
  • Make sure ZSphere is installed with a valid Advanced Edition license.

Procedure

  1. In the navigation pane, choose System Management > User Management > User Group.
  2. On the User Group page, click New User Group.
  3. In the New User Group dialog, set the following parameters:
    Basic Information
    Option Description
    Name Set a name for the user group.
    Description Enter a brief description for the user group.
    User Add users to this user group. After joining, users will inherit all roles and shared resources from this user group.
    Role Assign roles to the user group. After roles are assigned, all users within the group will inherit the permissions granted by these roles.
    Share Resource
    Option Description
    Share Resource Share resources with the user group. After sharing, all users within the user group have read access to the shared resources.
  4. Review the configuration and click OK.

Modify User Group Configuration

Edit the basic information of a user group, such as the users within the group, roles assigned to the group, and resources shared with the group.

Before you begin

  • You need to have admin permissions.
  • Make sure ZSphere is installed with a valid Advanced Edition license.

Procedure

  1. In the navigation pane, choose System Management > User Management > User Group.
  2. On the User Group page, select the target user group and then click Actions > Modify Configuration.
  3. In the Modify Configuration dialog, make the necessary changes as required.

Delete a User Group

Before you begin

  • You need to have admin permissions.
  • Make sure ZSphere is installed with a valid Advanced Edition license.

Procedure

  1. In the navigation pane, choose System Management > User Management > User Group.
  2. On the User Group page, select the target user group and then click Actions > Delete.
  3. In the Delete User Group? dialog, carefully read the risk warnings.

Results

Note: After a user group is deleted, all users within the group will no longer have the roles and shared resources inherited from that group.

Role and Permission Management

A role is a collection of permissions. By assigning roles to users or user groups, administrators grant them the ability to call related APIs and perform resource operations. ZSphere adopts a Role-Based Access Control (RBAC) authorization model, defining resource permissions based on the user's job function, or role. Through roles, you can achieve fine-grained control over user permissions.

Built-in Roles

ZSphere provides the following built-in roles.

User Type Role Name Description
Admin User System Administrator Maintains daily system operations.
Security Administrator Manages users, security policies, and security attributes.
Auditor Manages system event information and auditing.
Read-Only Role Has read-only access to system resources without write permissions.
Regular User VM User Allows regular users to create VMs and perform basic VM management.

Create a Custom Role

To meet diverse access control requirements, you can create custom roles.

Before you begin

Make sure ZSphere is installed with a valid Advanced Edition license.

Procedure

  1. In the navigation pane, choose System Management > Role.
  2. On the Role page, click New Role.
  3. In the New Role dialog, set the following parameters:
    Basic Information
    Option Description
    Name Set a name for the role.
    Description Enter a brief description for the role.
    Permission Configuration
    Option Description
    Permission Configuration Select the UI permissions you want to grant to this role as required. Dependencies may exist between different UI permissions. It is recommended to use platform predefined roles or select all UI permissions.
  4. Review the configuration and click OK.

Clone a Role

To meet diverse access control requirements, in addition to creating custom roles, you can clone existing roles.

Before you begin

Make sure ZSphere is installed with a valid Advanced Edition license.

Procedure

  1. In the navigation pane, choose System Management > Role.
  2. On the Role page, select the target role and then click Actions > Clone Role.
  3. In the Clone Role dialog, enter a name and description.
  4. Review the configuration and click OK.

Modify Role Permissions

Edit the interface and API permissions of custom roles.

Before you begin

  • Make sure ZSphere is installed with a valid Advanced Edition license.
  • The selected role is not a system default role.

Procedure

  1. In the navigation pane, choose System Management > Role.
  2. On the Role page, click the target role name to enter the Overview details page.
  3. On the Overview tab, click the Edit icon, and then modify the role's UI permissions as needed.
  4. Click API Permissions to enter the API Permissions tab.
  5. On the API Permissions tab, click the Edit icon, and then modify the role's API permissions as needed.

Delete a Role

Before you begin

  • Make sure ZSphere is installed with a valid Advanced Edition license.
  • Make sure the selected role is not a built-in system role.
  • Make sure the selected role is not assigned to any user or user group.

Procedure

  1. In the navigation pane, choose System Management > Role.
  2. On the Role page, select the target role and then click Actions > Delete.
  3. Review the selected items and click OK.

Single Sign-On

ZSphere provides unified identity authentication login services and supports access to unified authentication login systems. SSO users can directly log in to the platform and use platform resources. Currently, OIDC, AD, and LDAP authentication servers are supported.

  • OIDC authentication: OIDC (OpenID Connect) is an authentication protocol built on the OAuth2 framework. It allows clients to verify user identities and obtain basic user profile information. Through an OIDC authentication server, user information can be synchronized to the platform according to mapping rules, and OIDC users can log in to the platform without a password.
  • AD authentication: AD (Active Directory) is a directory service for Windows Standard Server, Windows Enterprise Server, and Windows Datacenter Server, providing an independent and standardized login authentication system for increasingly diverse enterprise office applications. Through an AD authentication server, AD users can be synchronized to the platform and can log in to the platform by using the specified AD login attribute.
  • LDAP authentication: LDAP (Lightweight Directory Access Protocol) is a protocol for accessing directory services, providing a standardized directory service for increasingly diverse enterprise office applications. Through an LDAP authentication server, LDAP users can be synchronized to the platform and can log in to the platform by using the specified LDAP login attribute.

You can add up to two SSO servers. Only one SSO server of each type can be added.

Add an OIDC SSO Server

Before you begin

  • Make sure ZSphere is installed with a valid Advanced Edition license.
  • Make sure fewer than two SSO servers have been added. When the limit is reached, the Add SSO Server button is disabled.
  • Make sure no OIDC SSO server exists. Only one SSO server of each type can be added.

Procedure

  1. In the navigation pane, choose System Management > Single Sign-On.
  2. On the Single Sign-On page, click Add SSO Server.
  3. In the Add SSO Server dialog, configure the following options:
    Basic Information
    Option Description
    Name Set a name for the unified authentication server.
    Description Enter a brief description for the unified authentication server.
    Type Select OIDC. If an OIDC SSO server already exists, this option is disabled.
    Configuration Information
    Option Description
    Client ID The unique identifier assigned to the platform by the unified authentication system.
    Client Secret The secret key assigned to the platform by the unified authentication system.
    Authorization Request URL The request URL used to obtain authorization under the authorization code grant type.
    Token Request URL The request URL used to obtain an access token from the authentication server.
    User Mapping Rules Establishes the mapping relationship between unified authentication attributes and local attributes, including username.
    • Username: Maps the virtualization platform user name to a specific attribute of users in the unified authentication server.
  4. Review the configuration and click OK.

Add an AD SSO Server

Before you begin

  • Make sure ZSphere is installed with a valid Advanced Edition license.
  • Make sure fewer than two SSO servers have been added. When the limit is reached, the Add SSO Server button is disabled.
  • Make sure no AD SSO server exists. Only one SSO server of each type can be added.

Procedure

  1. In the navigation pane, choose System Management > Single Sign-On.
  2. On the Single Sign-On page, click Add SSO Server.
  3. In the Add SSO Server dialog, configure the following options:
    Basic Information
    Option Description
    Name Set a name for the SSO server.
    Description Enter a brief description for the SSO server.
    Type Select AD. If an AD SSO server already exists, this option is disabled.
    Server Information
    Option Description
    SSL/TLS Encryption Choose whether to enable SSL/TLS encryption. This option is enabled by default. When enabled, port 636 is used by default and can be changed. When disabled, port 389 is used by default and can be changed.
    Primary Server IP/Domain Enter the primary server IP address or domain and the corresponding port.
    Backup Server IP/Domain Enter the backup server IP address or domain and the corresponding port.
    Configuration Information
    Option Description
    Base DN Enter the base DN used to search for AD users' root nodes, defining the scope of synchronized AD users.
    User DN Enter the DN of a special user who has permission to query all users within the base DN scope. This user is used to log in to the AD server and retrieve relevant data.
    Password The password corresponding to the User DN for logging in.
    Filter Rule Enter the filter rule used when synchronizing user information to filter users within the base DN. By default, the (objectClass=person) rule is added.
    Note:
    • Filter rules can be set as single or combined rules, with syntax matching AD filter syntax.
    • You can control whether the filter acts as a allowlist or blocklist using the ! symbol. With allowlist filtering, only the user information configured in the filter rules will be synchronized to the platform. With blocklist filtering, user information specified in the filter rules will not be synchronized.
    • The length of filter rules is subject to AD server configuration limits. Exceeding these limits may cause the filter rule to fail, so please confirm in advance.
    Login Attribute Specify the AD user attribute used for logging into the platform.
  4. Review the configuration and click OK.

Add an LDAP SSO Server

Before you begin

  • Make sure ZSphere is installed with a valid Advanced Edition license.
  • Make sure fewer than two SSO servers have been added. When the limit is reached, the Add SSO Server button is disabled.
  • Make sure no LDAP SSO server exists. Only one SSO server of each type can be added.

Procedure

  1. In the navigation pane, choose System Management > Single Sign-On.
  2. On the Single Sign-On page, click Add SSO Server.
  3. In the Add SSO Server dialog, configure the following options:
    Basic Information
    Option Description
    Name Set a name for the SSO server.
    Description Enter a brief description for the SSO server.
    Type Select LDAP. If an LDAP SSO server already exists, this option is disabled.
    Server Information
    OptionDescription
    SSL/TLS EncryptionChoose whether to enable SSL/TLS encryption. This option is enabled by default. When enabled, port 636 is used by default and can be changed. When disabled, port 389 is used by default and can be changed.
    Primary Server IP/DomainEnter the primary server IP address or domain name and the corresponding port.
    Backup Server IP/DomainEnter the backup server IP address or domain name and the corresponding port.
    Configuration Information
    Option Description
    Base DN Enter the base DN used to search for LDAP users' root nodes, defining the scope of synchronized LDAP users.
    User DN Enter the DN of a special user who has permission to query all users within the base DN scope. This user is used to log in to the LDAP server and retrieve relevant data.
    Password The password corresponding to the User DN for logging in.
    Filter Rule Enter the filter rule used when synchronizing user information to filter users within the base DN. By default, the (objectClass=person) rule is added.
    Note:
    • Filter rules can be set as single or combined rules, with syntax matching LDAP filter syntax.
    • You can control whether the filter acts as a allowlist or blocklist using the ! symbol. With allowlist filtering, only the user information configured in the filter rules will be synchronized to the platform. With blocklist filtering, user information specified in the filter rules will not be synchronized.
    • The length of filter rules is subject to LDAP server configuration limits. Exceeding these limits may cause the filter rule to fail, so please confirm in advance.
    Login Attribute Specify the LDAP user attribute used for logging into the platform.
  4. Review the configuration and click OK.

Manage SSO Servers

Procedure

  1. In the navigation pane, choose System Management > Single Sign-On.
  2. On the Single Sign-On page, locate the target SSO server card and click the arrow icon on the right to open the server details.
  3. Perform the following operations as needed:
    • If you need to modify the general information, configuration information, or user information mapping rules of the unified authentication server, click Edit Configuration.
      Note: After modifying the configuration information, unified authentication users who have been synchronized to the platform may no longer be able to log in without a password.
    • To edit the name and description of the unified authentication server, select More Actions > Edit Name and Description.
    • To delete the unified authentication server, select More Actions > Delete.
      Note: Deleting the unified authentication server will also remove related existing unified authentication user information from the platform, while users in the source unified authentication server remain unaffected.
PreviousOverviewNextPlatform Access Security
User Guide | ZStack ZSphere · ZVF | ZStack Resource Center