Assign NSX-T Data Center Roles to Active Directory Groups for Identity and Access Management for VMware Cloud Foundation

To manage administrative access to NSX-T Data Center after you integrate NSX Manager with Workspace ONE Access, you assign the NSX-T Data Center roles to Active Directory groups.

You assign access to Active Directory groups for the following roles in NSX Manager:

• Enterprise Admin

• Network Admin

• Auditor

Attention:

For an environment with NSX Federation, you must use the component's user interface to assign NSX roles for NSX Global Manager in Active Directory. The current version of SDDC Manager includes limited integration with NSX Federation and the PowerShell cmdlets cannot configure an NSX Global Manager instance.

UI Procedure

1. Log in to NSX Local Manager for the management domain at https://<management_domain_nsx_local_manager_fqdn>/login.jsp?local=true as admin.
2. On the main navigation bar, click System.

3. In the left pane, click Users management.

4. Click the Users Role Assignment tab.

5. From the Add drop-down menu, select Role assignment for VIDM, select the group and the role you want to assign, and click Save.

6. Repeat this step fo each role you want to assign.

7. Repeat this procedure for all NSX Local Managers in each workload domain.

8. Repeat this procedure for the NSX Global Manager of the management domain and each workload domain.

PowerShell Procedure

1. Start Windows PowerShell.

2. Replace the values in the sample code with values from your VMware Cloud Foundation Planning and Preparation Workbook and run the commands in the PowerShell console.

   $sddcManagerFqdn = "sfo-vcf01.sfo.rainpole.io"
   $sddcManagerUser = "[e-mail]"
   $sddcManagerPass = "VMw@re1!"
   
   $sddcDomainName = "sfo-m01"
   
   $nsxEnterpriseAdminGroup = "[e-mail]"
   $nsxNetworkEngineerGroup = "[e-mail]"
   $nsxAuditorGroup = "[e-mail]"

3. Perform the configuration by running the command in the PowerShell console.

   Add-NsxtVidmRole -server $sddcManagerFqdn -user $sddcManagerUser -pass $sddcManagerPass -domain $sddcDomainName -type group -principal $nsxEnterpriseAdminGroup -role enterprise_admin
   
   Add-NsxtVidmRole -server $sddcManagerFqdn -user $sddcManagerUser -pass $sddcManagerPass -domain $sddcDomainName -type group -principal $nsxNetworkEngineerGroup -role network_engineer
   
   Add-NsxtVidmRole -server $sddcManagerFqdn -user $sddcManagerUser -pass $sddcManagerPass -domain $sddcDomainName -type group -principal $nsxAuditorGroup -role auditor

4. Repeat this procedure for each NSX Local Manager in each workload domain.

5. Repeat this procedure for the NSX Global Managers of the management domain and each workload domain.