OIT VMware Access Information

OIT's VMWare vShere service utilizes the campus' centralized authorization (KSAMS) and authentication systems (UCINetID/LDAP) for access. OIT DCI does not provision this access and is intended to be a self-service process.

KSAMS action items

KSAMS roles are used to provide authorization or permissions within vCenter.  vCenter permissions are granted to members of LDAP groups that are automatically populated from KSAMS roles. Even an individual who needs vCenter permissions on a single VM needs to have a KSAMS role to get those permissions. KSAMS roles usually come in pairs; one role is used for the permissions, and another to approve memberships to the permission role. Figure A shows the list of these Roles as they appear in KSAMS.

• Via KSAMS ZotPortal App, request the Approver role for those who will approve the "Admin" role to those needing vCenter access to VMs.  Generally, a manager and director would have Approver roles.  OIT recommends having 2 or more Approvers. Approvers do NOT gain access to VMs.
• After the Approver role is set up, direct everyone requiring vCenter access to VMs to the KSAMS ZotPortal App to request the "Admin" role.
  • NOTE: Requests for "Admin" roles submitted before the corresponding group's "Approver" request is completed will result in KSAMS ERRORS so please make sure at least one Approver is set up before adding Admins.
• For simplicity and expediency, all users will initially be assigned permissions per Figure B for their designated group of VMs. We welcome input for other permission levels, as well as different user groupings going forward.

KSAMS example:

• OIT's Data Center Infrastructure team uses the "vCenter - OIT vSphere Admins" and "vCenter - OIT vSphere Admins Approvers" roles.
• Using the KSAMS ZotPortal App, a request was made to add Ken Cooper and Brian Buckler to the "vCenter - OIT vSphere Admins Approvers" role.
• Each team member requested the "vCenter - OIT vSphere Admins" role.
• Ken approved each request using the app.
• vCenter access was granted.

DUO action items

Make sure all users requiring vCenter VM access have a DUO token set up through the DUO Enrollment App

vCenter Login Procedure

Can be found at New OIT VMware vCenter Login Procedure

Fig. A: KSAMS Roles

Fig. B: VM Permissions

Initially, all assigned users will have the set of permissions listed below:

• • Cryptographic Operations
    • Direct Access (allows console access to vTPM enabled VMs)
    • Encrypt (allows console power on/off vTPM enabled VMs)
    • Encrypt new (allows console power on/off vTPM enabled VMs)
    • Register VM (allows console power on/off vTPM enabled VMs)
  • Virtual Machine
    • Configuration
      • Modify Device Settings
      • Settings
      • Upgrade virtual machine compatibility
    • Interaction
      • Answer Questions
      • Configure CD Media
      • Console Interaction
      • Device Connection (NICs and removable media)
      • Power On
      • Power Off
      • Reset
      • VMware Tools Install
    • Snapshot Management
      • Create Snapshot
      • Remove Snapshot
      • Rename Snapshot
      • Revert Snapshot
  • Folder (This will only work on the sub-folders of where the role is assigned.)
    • Create
    • Delete
    • Rename
    • Move
  • Datastore (This is only to facilitate mounting ISO images from the shared ISO repository)
    
    • Browse datastore
    • Low level file operation

Fig. C: VM Tag data