Forum Discussion

ldoodle's avatar
ldoodle
Icon for Advisor rankAdvisor
10 months ago

vmWare vCenter Server - permissions

Hi, We have the MSP version of LM. We have a vCenter dashboard in a customer group, which is a duplicate of the default vCenter dashboard. When I login (I am an LM admin) I can see all the widgets ...
  • Mike_Moniz's avatar
    Mike_Moniz
    10 months ago

    What is your defaultResourceGroup token set to (if anything)? You can check it for the dashboard itself in the upper-right down arrow > Manage. It will have a section for tokens. You would want it to point to be your customer folder (from the resource page), and at the dashboard group level and let it be inherited by the customer dashboard(s).

    Tokens are like variables/properties that you can assign to the dashboard or dashboard group letting you more easily template dashboards, cloning them across multiple customers for example.

    https://www.logicmonitor.com/support/dashboards-and-widgets/managing-dashboards/how-are-dashboards-created#tokens

ldoodle's avatar
ldoodle
Icon for Advisor rankAdvisor
10 months ago

Thanks.

The way we have it structured is every customer gets their own top level ‘folder’. Let’s say this one is GOOGLE.

GOOGLE will have a Dashboard group
GOOGLE will have a Resource group

All resources for GOOGLE get added to GOOGLE resource group
All dashboards for GOOGLE get created in the GOOGLE dashboard group

GOOGLE get a Role called GOOGLE Users
Customer Roles are places in a ‘Customer’ role group
GOOGLE Role has ‘Manage private’, ‘View GOOGLE’ dashboard group under ‘Dashboards’
GOOGLE Role has ‘Allowed to manage Resource Dashboards’, ‘Allowed to view Map Tabs’, ‘View GOOGLE resource group’ (and all children Resource Groups) under ‘Resources’

Then for users, we create them and assign them only to their Role. So…

Joe.Bloggs@google.co.uk is assigned to GOOGLE Role.

This customer vCenter Server / vSphere is definitely inside the GOOGLE resource group

Customer users don’t get ‘Manage’ permissions in the Role. But as a test, I gave this one Manager for everything and it still doesn’t work. It’s only if I make the user directly added to one of the built in LM groups.