Permissions

Mon, 01 Jan 0001 00:00:00 +0000

Permissions are assigned to group and special roles. Each role is assigned default permissions, which you can add to or remove from group and special roles. This is a separate set of permissions from those associated with admin roles.

View permissions

Select Admin > Permissions.
Use the search box or page arrows to find specific permissions.

Use permissions

See Groups, roles, and permissions for details on how permissions are used.

Permissions

Orders

Name	Label	Description
order.approve	Approve Orders	Allows the user to approve and deny orders.
order.view	View Orders	Grants the user view-only permission for orders.
order.submit	Submit Orders	Allows the user to order servers and blueprints.
order.change_attributes	Change Order Attributes	Change the order name.
order.choose_recipient	Choose Recipient for Orders	Allows the user to choose a recipient other than themselves to own the servers or resources created by an order.

Servers

Name	Label	Description
server.view	View Servers	Grants the user view-only permission for servers.
server.manage_snapshots	Manage Snapshots	Create, delete, and restore from server snapshots.
server.manage_nics	Manage NICs	Add and remove NICs on servers.
server.console	Console	Open a console session to a server.
server.remote_terminal	Remote Terminal	SSH/RDP access to servers from the CMP UI.
server.manage_applications	Manage Apps	Install and uninstall configuration manager applications on servers.
server.change_attributes	Change Attributes	Change the environment, group, OS Family, and OS Build associations for servers.
server.manage_labels	Manage Labels	Add and remove labels on servers.
server.manage_parameters	Manage Server Parameters	Add, remove, and modify parameters (Custom Fields) on servers.
server.delete	Delete Server	Allows the user to delete servers.
server.manage_credentials	Manage Server Credentials	Allows the user to view and manage the credentials used to run remote actions on servers.
server.view_handler_specific_details	View Handler-Specific Details	Allows the user to see resource handler-specific details for servers, such as the VMware cluster or AWS region.
server.all_actions	Run All Server Actions	Allows the user to run any server action available on the server.
server.view_power_schedule	View Server’s Power Schedule	Allows the user to view the schedule for recurring power control on the server.
server.manage_power_schedule	Manage Server’s Power Schedule	Allows the user to edit the schedule for recurring power control on the server.
server.add_disks	Add Disks	Allows the user to add disks to a server.
server.remove_disks	Remove Disks	Allows the user to remove disks from a server.
server.resize_disks	Resize Disks	Allows the user to resize disks on a server.
server.resize	Resize VM	Change the type (size) of a virtual machine.
server.define_remote_script	Define Remote Script	Allows the user to choose servers when creating a remote script action.

Resources

Name	Label	Description
resource.view	View Resources	Allows the user to view resources.
resource.change_attributes	Change Resource Attributes	Change attributes for resources.
resource.manage_parameters	Manage Resource Parameters	Add, remove, and modify parameters (Custom Fields) on resources.
resource.all_actions	Run All Resource Actions	Allows the user to run any resource action available on the resource.
resource.view_power_schedule	View Resource’s Power Schedule	Allows the user to view the schedule for recurring power control on the resource.
resource.manage_power_schedule	Manage Resource’s Power Schedule	Allows the user to edit the schedule for recurring power control on the resource.
resource.manage_labels	Manage Labels	Add and remove labels on resources.

Groups

Name	Label	Description
group.view	View Group Details	Allows the user to view a group’s details.
group.change_attributes	Change Group Attributes	Allows the user to change a group’s attributes.
group.delete	Delete Group	Allows the user to delete groups.
group.create_subgroup	Create Subgroup	Allows the user to create a subgroup within an existing group.
group.manage_members	Manage Group Memberships	Allows the user to manage group memberships.
group.manage_networks	Manage Group Networks	Allows the user to manage group networks.
group.manage_parameters	Manage Group Parameters	Allows the user to manage group parameters.
group.manage_subgroup_quotas	Manage Subgroup Quotas	Allows the user to manage quotas for subgroups of a group.
group.manage_members_view_unassigned_users	Manage Group Memberships - View Unassigned Users	Allows the user to view and add users to groups they manage that do not currently have a group assigned (such as new users). Requires the group.manage_members permission.
group.edit_parameter_values	Change Value Of Parameters	Allows the user to change the values of existing parameters.

Blueprints

Name	Label	Description
blueprint.manage	Manage Blueprints	Allows the user to perform most management actions on blueprints the group can manage, such as setting the resource type, allowing additional groups to manage or deploy it, and adding build items. Exceptions handled by other permissions include configuring the blueprint so any group can deploy (blueprint.any_group_can_deploy) and creating a new parameter from the blueprint (blueprint.create_parameters).
blueprint.any_group_can_deploy	Configure Blueprints So Any Group Can Deploy	Allows the user to modify a blueprint’s settings so it is available for deployment by all groups on the instance, current and future. This permission can have a broad impact; we recommend limiting it to Resource Admin or a similar role.
blueprint.create_parameters	Create Blueprint Parameters	Allows the user to create blueprint parameters only.
user.create_parameters	Create User Parameters	Allows the user to create user parameters only.
environment.create_parameters	Create Environment Parameters	Allows the user to create environment parameters only.

Jobs

Name	Label	Description
job.view	View Jobs	Allows the user to view jobs.
job.view_logs	View Job Logs	Allows the user to view and download job logs.
job.cancel	Cancel Jobs	Allows the user to cancel in-progress jobs.
job.rerun	Re-run Jobs	Allows the user to re-run failed jobs.

Data protection

Name	Label	Description
dataprotection.manage_parameter_dataprotection_plan	Manage Data Protection Plan	Allows the user to manage servers’ data protection plans.
dataprotection.restore_from_snapshot	Restore Data Protection Snapshots	Allows the user to restore a host from a data protection snapshot.

OneFuse

Name	Label	Description
module.view	View Modules	Allows the user to view modules.
policy.list	List Policies	Allows the user to list OneFuse policies.
policy.manage	Manage Policies	Allows the user to create, edit, and delete OneFuse policies.
policy.execute	Execute Policies	Allows the user to run OneFuse policies.

Global roles

Mon, 01 Jan 0001 00:00:00 +0000

A user can be granted one or more of these roles:

Super Admin
Devops Admin
Global Viewer

A fourth role, CloudBolt Admin, is available only when it is explicitly enabled. See CloudBolt Admin.

Manage global roles

Select Admin > Users.
Select the user’s email address to open their profile, where you can view their active global roles.
Select Manage profile.
Enable or disable global roles using the checkboxes.

Do not remove the Super Admin role from a user unless at least one other user is a Super Admin. Once a user is no longer a Super Admin, they cannot grant themselves or others that role.

User permission and attribute synchronization

Mon, 01 Jan 0001 00:00:00 +0000

How it works

When an external user (one authenticated against an external source) logs in, CMP runs every action enabled for the External Users Sync trigger point. These actions fetch the user’s permissions and attributes from an external system such as Active Directory, then add or remove the user from the appropriate groups and roles. This runs synchronously: the user cannot use the UI until it completes.

Use the User Permission Sync From LDAP action

CMP includes a sync action, enabled by default, that grants a user roles based on their LDAP OU and group membership. For each LDAP utility you create, map its OUs and groups to the equivalent groups and roles.

Admin roles

Mon, 01 Jan 0001 00:00:00 +0000

Combine admin roles with group, special, and global roles to give users exactly the administrative capabilities they need, such as a slice of what a Super Admin can do.

Example: to let a user manage resource handlers but nothing else an administrator can do, create an admin role with only the Manage Resource Handlers permission.

With multi-tenancy, admin roles control the management permissions users have within their tenant. For users who are not part of a tenant, their admin roles apply everywhere: across all tenants and to global objects.

Password policies and admin password reset

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) enforces password requirements, history, and expiration through settings you configure in customer_settings.py.

Password policy settings

Configure these settings in customer_settings.py:

PASSWORD_HISTSIZE: The number of previous passwords a user cannot reuse. The default is 10.
AUTH_PASSWORD_VALIDATORS: Password requirements such as length and complexity. By default, Cloud Management Platform requires at least 9 characters and a mix of character types. See the Django password validation documentation.
PASSWORD_EXPIRATION_HOURS: The number of hours after which a password expires, and the user must set a new one. The default is 0, which disables expiration.
PASSWORD_RESET_TIMEOUT: How long, in days, a password reset token stays valid. The default is 86400.
EMAIL_VERIFICATION_TIMEOUT_DAYS: The number of days a user has to use an email verification link before it expires. The default is 1.

Reset the administrator password

If you are locked out or need to reset an administrator’s password, use Django’s built-in changepassword command. SSH into your CMP instance and run:

Groups, roles, and permissions on CloudBolt Documentation

Permissions

View permissions

Use permissions

Permissions

Orders

Servers

Resources

Groups

Blueprints

Jobs

Data protection

OneFuse

Global roles

Manage global roles

User permission and attribute synchronization

How it works

Use the User Permission Sync From LDAP action

Admin roles

Password policies and admin password reset

Password policy settings

Reset the administrator password