In order to run vCenter operations from VLA workflows, it is necessary to add a new user to VMware vRealize Orchestrator administrators group. This will provide administrator access to the VMware vRealize Orchestrator Server, enabling you to perform general administration tasks there. This group name is set in the Admin group text box during vRealize Orchestrator authentication provider configuration in vRealize Orchestrator Control Center.
vCenter Single Sign-On supports storing the user and group data in Active Directory or locally to the operating system of the machine where vCenter Single Sign-On is installed. If your vCenter Server has been associated with an Active Directory Server, create a user and add the user to the VMware vRealize Orchestrator administrators group there. Skip steps 3-11 in this procedure and perform the rest of the steps to configure the new user access to the vSphere inventory.
Procedure
Log in to the VMware vSphere Web Client (VWC) using administrator credentials.
Select Administration (highlighted for emphasis) from the Menu.
Figure 1. Administration
Click Users and Groups.
The browser displays a screen similar to the following:
Figure 2. Users and Groups
Select the SSO domain to which you wish to add the user from the Domain dropdown (e.g., vsphere.local)
Click ADD USER to add a user.
The browser displays the
Add User dialog similar to the following:
Figure 3. Add User
Complete the fields in the dialog, giving the user the name vla_user and assigning a conforming password, and then click ADD.
The browser closes the dialog and displays the
Users and Groups page with your new user added.
Select from the Domain the SSO domain to which vRealize Orchestrator administrators group belongs.
Click the Groups tab.
Find the
vRealize Orchestrator administrators group in the list of existing groups and click on it.
Figure 4. vCenter Users and Groups
Click ADD MEMBERS.
The browser displays the
Edit Group dialog similar to the following:
Figure 5. Edit Group
In the Add members field select the user's SSO domain from the domain dropdown and the user.
The user is added to the group members.
Click Add member (The only icon under Group Members)
The browser displays the
Add principals dialog similar to the following:
Figure 6. Add Member - Add principals
Select the user in the User/Group list and then click Add.
Click SAVE.
The browser closes the dialog and displays the
Groups tab with your new user added to the
vRealize Orchestrator administrators group.
Click Roles in the Navigation pane.
Click the plus icon in the pane to the right of the Navigator pane (pointed to by the arrow for emphasis).
Figure 7. Administration - Roles
The browser displays the
New Role dialog.
In the New Role dialog find and check the following privileges for the role:
Table 1. Role Privilege Settings
Privilege Settings
Datastore-> Allocate space
Global-> Log event
Network-> Assign network
Resource-> Assign virtual machine to resource pool
In the Role name field, type: VMware LaMa Appliance.
Click Finish to create the role.
The browser closes the
New Role dialog. You should now see the new role in the list similar to the following:
Figure 8. Roles
Note: The
VMware LaMa Appliance role is selected for emphasis.
Click Hosts and Clusters from the Menu.
Click on the vCenter Server you want the VMware VLA to manage.
Click Permissions.
Your browser displays a page similar to the following:
Figure 9. Hosts and Clusters-Manage-Permissions
Click the green plusplus icon to add permission.
Your browser displays a page similar to the following:
Figure 10. Add Permission
Click Add...
Your browser displays a page similar to the following:
Figure 11. Add User
Choose your SSO domain, and select the user vla_user.
Click OK.
In the Assigned RoleRole list box, select VMware LaMa Appliance.
Your browser displays a page similar to the following:
Figure 12. Add Permission
Make sure the Propagate to children check box is checked.
Click on
View Children and verify that permission was granted to the following inventory objects:
vCenter Server (The Hosts and Clusters view)
Datacenters and Datacenter Folders (The Hosts and Clusters view)
Clusters and ESXi hosts within the Clusters, and Hosts and Clusters Folders (The Hosts and Clusters view)
Resource Pools and vApps (The Hosts and Clusters view)
Virtual Machines, VM Templates and VM Folders (The VMs and Templates view)
Datastores and Datastore Folders (The Storage view)
Networks and Distributed Switches (The Networking view)
Click OK.
This saves the permission.
Note: A lack of permission for some of the aforementioned objects may result in execution errors of LaMa operations or absence of the objects in LaMa Virtualization Landscape.
Note: If the permission is set not for the
vCenter Server you want the
VMware VLA to manage, then it may result in execution errors of LaMa operations or absence of the objects in LaMa Virtualization Landscape.
Results
You have successfully created a single user for the whole setup, added it to the VMware vRealize Orchestrator administrators group and added required permission for this user.
Note: The VMware LaMa Appliance role is selected for emphasis.
