Configure User Access in VMware Aria Operations for Intelligent Operations Management for VMware Cloud Foundation

To ensure that users log in with required role-based access controls, you configure the identity source groups that are synchronized in the clustered Workspace ONE Access deployment for VMware Aria Operations.

You assign the Administrator, ContentAdmin, and ReadOnly roles to the corresponding Active Directory groups according to your values in the VMware Cloud Foundation Planning and Preparation Workbook.

UI Procedure

1. Log in to the VMware Aria Operations interface at https://<aria_operations_fqdn> with a user assigned the Administrator role.
2. In the left pane, click Administration.

3. On the Administration page, click Access control.

4. Click the User groups tab and, from the ellipsis drop-down menu, select Import from source.

5. In the Import user groups dialog box, from the Import from drop-down menu, select the vIDMAuthSource - VMware Identity Manager instance as an authentication source.

6. In the Domain name text box, enter the domain name.

7. In the Search prefix text box, enter the name of the Active Directory group for the Administrator role according to your values in the VMware Cloud Foundation Planning and Preparation Workbook and click Search.

8. Select the group and click Finish.

9. On the Warning dialog box, Click Yes.

10. On the group name that was just added, click the ellipsis and click Edit.

11. On the Edit User Group page, in the Assign Roles and Scope section, configure the following settings and click Save.

    Setting	Value
    Role	Administrator
    Scope	All objects

12. Repeat this procedure for the ContentAdmin and the ReadOnly roles.

PowerShell Procedure

1. Start PowerShell.

2. Replace the values in the sample code with values from your VMware Cloud Foundation Planning and Preparation Workbook and run the commands in the PowerShell console.

   $sddcManagerFqdn = "sfo-vcf01.sfo.rainpole.io"
   $sddcManagerUser = "[email protected]"
   $sddcManagerPass = "VMw@re1!"
   
   $domainFqdn = "sfo.rainpole.io"
   $operationsAdminGroup = "gg-vrops-admins"
   $operationsContentAdminGroup = "gg-vrops-content-admins"
   $operationsReadOnlyGroup = "gg-vrops-read-only"

3. Perform the configuration by running the command in the PowerShell console.

   Import-vROPSUserGroup -server $sddcManagerFqdn -user $sddcManagerUser -pass $sddcManagerPass -domain $domainFqdn -groupName $operationsAdminGroup -role Administrator
   
   Import-vROPSUserGroup -server $sddcManagerFqdn -user $sddcManagerUser -pass $sddcManagerPass -domain $domainFqdn -groupName $operationsContentAdminGroup -role ContentAdmin
   
   Import-vROPSUserGroup -server $sddcManagerFqdn -user $sddcManagerUser -pass $sddcManagerPass -domain $domainFqdn -groupName $operationsReadOnlyGroup -role ReadOnly