vmWare vCenter Server - permissions

Sounds like you need to look at the role permissions you provided to this user. The dashboards will only show data the user has access to via the role’s resource, website and maps sections. The dashboard will “filter” out data the user doesn’t have access to directly. I suggest first making sure the user can view the data you want to show in the resource, website and/or map pages.

Should have been more specific on the properties. I’m not using ALL of the vcenter ones.

vcenter.user
vcenter.pass
vcenter.hostname

Thanks.

The way we have it structured is every customer gets their own top level ‘folder’. Let’s say this one is GOOGLE.

GOOGLE will have a Dashboard group
GOOGLE will have a Resource group

All resources for GOOGLE get added to GOOGLE resource group
All dashboards for GOOGLE get created in the GOOGLE dashboard group

GOOGLE get a Role called GOOGLE Users
Customer Roles are places in a ‘Customer’ role group
GOOGLE Role has ‘Manage private’, ‘View GOOGLE’ dashboard group under ‘Dashboards’
GOOGLE Role has ‘Allowed to manage Resource Dashboards’, ‘Allowed to view Map Tabs’, ‘View GOOGLE resource group’ (and all children Resource Groups) under ‘Resources’

Then for users, we create them and assign them only to their Role. So…

Joe.Bloggs@google.co.uk is assigned to GOOGLE Role.

This customer vCenter Server / vSphere is definitely inside the GOOGLE resource group

Customer users don’t get ‘Manage’ permissions in the Role. But as a test, I gave this one Manager for everything and it still doesn’t work. It’s only if I make the user directly added to one of the built in LM groups.

That setup sounds correct and pretty typical. Are these customer groups static or dynamic? Can a user with that role view the vmware data on the Resource page specifically? May need to temporarily allow the user to view the page if you turned that off (that setting is per-user and not in the role).

What do you mean by ‘Are these customer groups static or dynamic’? Users/roles/role groups are static.

We have a static ‘All devices’ group as a direct child of the customer main group, which is where all devices get added to. For some apps like AD, we then have a dynamic group (custom query: hasCategory(“MicrosoftDomainController”)) along side ‘All devices’ (not inside it as a child).

Good shout on seeing the data directly on the Resource page. I think you mean Resources > relevant Resource Group > relevant device:

PS: There is currently only 1 vCenter added, so my login for example won’t be getting those widgets via another vCenter (that this customer doesn’t have access to)

Another thing… for vCenter alerts Widget, customer sees Green tick. My login see’s the actual alerts, and there are errors and warnings.

Sorry, I meant if the customer’s groups which contain the devices on the resources page were static, and sounds like they are.

Since the user can review the graphs and data of the vmware device on the resources page, it doesn’t sound like a role issue. I would try taking one of those graphs from the resource page, clicking on the down arrow and “add to dashboard” to place it on that customer dashboard unmodified. See if that then shows up. If it does, then it might just be the settings on those specific widgets with issues. LM widgets can get picky on how the groups are entered in. Sometimes you need to end with with a “/” or “/*”. If you are attempting to use tokens (like ##defaultResourceGroup##), you may want to enter in groups directly just to rule out an issue with that.

You want also want to reach out to support which can look at your specific setup.

Ahhh… I just added that first one from the resource (Top 10 Clusters by CPU Utilization (1 day) to the same customer dashboard, and that works. I then tweaked the new widget to look like the one in my OP and it still works.

However, I noticed the new one, for Graph Data, is All > devicename.domainname > VMware Cluster Performance (VMware_vCenter_ClusterPerformance) > All > UsedCPUPercent whereas the original one is ##defaultResourceGroup## > All > VMware Cluster Performance (VMware_vCenter_ClusterPerformance) > All > UsedCPUPercent