Set up multi-tenancy

Prerequisites

• A Super Admin account, plus two users you can log in as who are not Super Admins (for testing).

Set up tenants

1. Log in to CMP as a Super Admin.

2. Create a CNAME alias for each tenant, pointing to the CMP server and named for the tenant. (External to CMP.)

3. Create a group role with the blueprint permissions your tenant admins need, plus order.view and job.view_logs so tenant-specific admin roles can view orders and jobs within their tenant to troubleshoot and monitor.

4. Create a branded portal for each tenant.

5. Create a user to administer each tenant.

6. Create a top-level group for each tenant. The group can have the same name as the tenant.

7. Add each tenant’s admin user to its group, with the appropriate roles. If you are not sure which roles to assign, add the user to all roles on the group.

8. Go to Admin > Roles and create at least one admin role with the admin permissions you want to assign to your tenant users. See Admin roles.

9. Select Admin > Multi-tenancy, add a tenant, and add the users to the tenant with the appropriate admin roles. Use the branded portal.

   (opens full-size image in a new tab)

10. Add the tenant admin to the tenant’s admin role.

11. Add a resource handler named for the tenant. This is needed if you want the top-level folder in vCenter to match the tenant name or group; otherwise, you can use a global resource handler for all tenants.

12. Configure the network for the tenant. This is only needed if you want a separate IPAM or IP pool for the tenant’s machines; otherwise, use the global networks configured on the main CMP instance.

13. Finish setting up an environment for each tenant.

14. Create a blueprint for each environment. You can also use a global blueprint with different environments. Configure the build step environments as well.

Test the setup

1. Log in to three different browser sessions:
   1. One as a Super Admin.
   2. One as the admin-role user from the first tenant.
   3. One as the admin-role user from the second tenant.
2. As the tenant-specific admin role for the first tenant, go to Admin > Resource Handlers.
   1. Create a new resource handler. It is automatically assigned to the first tenant because it was created by a user who belongs to that tenant.
3. As the tenant-specific admin role for the second tenant, go to Admin > Resource Handlers and confirm the resource handler created above is not visible.

You can repeat these steps for other kinds of objects, such as container orchestrators and blueprints.

Security recommendations

1. Make sure no tenant-accessible role can make blueprints available to all groups, which would expose them across tenants.
   • Ensure roles such as Resource Admin do not have the blueprint.any_group_can_deploy permission. Go to Admin > Roles, edit the role, and remove that permission if present. On new installations, this permission is not in any role by default, but it can be present on instances upgraded from older releases. See Blueprint ordering permissions for more information.
2. Disable the Cost Dashboard report to prevent information leakage across tenants.
   • Go to Admin > Miscellaneous Settings and open the UI tab. Select to edit the Settings. Under Disabled Reports, select Cost Dashboard from the dropdown, and Save.
3. To prevent servers from being created with the same default password across multiple tenants, remove the default password for new Windows VMs.
   • Go to Admin > Parameters, open New Password, and remove the global default. You must then set it at another level (group or environment) for Windows VM provisioning to work in VMware resource handlers.

Optional setup steps

Set up branded portals

If you want each tenant to have a differently branded or white-labeled experience, create a branded portal for each tenant.

1. Go to Admin > Branded Portals.
2. Create a portal for each of your tenants.
3. Go to the tenant’s detail page.
4. Select Edit and select the portal you created for it.

When a tenant user logs in to the designated portal, that portal’s branding is used for the UI. If the user has no associated tenant, or the tenant has no associated portal, CMP selects a portal using its normal logic based on the host part of the URL and falls back to the default portal if no match is found.

Automatically associate users with a tenant

Users within a tenant who do not need administrative privileges do not strictly need a tenant set on them; their group membership prevents them from seeing anything that belongs to groups they are not members of. However, you may want users to belong to a tenant for at least two reasons:

1. The user manages blueprints and needs to use tenant-specific OS builds in them.
2. You want the tenant-specific portal to appear after the user logs in, but you do not have separate hostnames set up for each tenant that point to the CMP server.

Add users to a tenant

You can add users to tenants from the tenant’s details page. To automatically assign all users to a tenant, update the External Users Sync or SSO User Update plugin:

1. Go to Admin > Orchestration Actions.
2. Find the SSO User Update or External Users Sync plugin and modify it to suit your needs.