Skip to main content

Manage operators

About this task

Perform this task to configure and control various administrator accounts and their permissions, ensuring secure, orderly, and auditable system operations. Operators vary by whether role-based access control (RBAC) is enabled during hypervisor installation. The configuration cannot be changed after installation. You can identify whether RBAC is enabled according to the number and type of default operators and operator groups.

• With RBAC disabled, an operator can act as a super administrator with permissions to all resources.

○ The system has default system administrator admin.

○ The system has default operator groups System Administrator Group and Security Auditor Group.

• With RBAC enabled, an operator can have only one role among the system administrator, security administrator, and security auditor for role-based access control.

○ The system has three default operators:

▪ System administrator sysadmin, with the default password Sys@1234.

▪ Security administrator secadmin, with the default password Sec@1234.

▪ Security auditor secauditor, with the default password Aud@1234.

○ The system has default operator groups System Administrator Group, Security Administrator Group and Security Auditor Group.

After installation, the system preconfigures the default operator and the corresponding operator group. The system can assign all system operation permissions to a single operator.

• The system has default system administrator admin.

• The system has default operator groups System Administrator Group and Security Auditor Group.

You can assign appropriate groups and roles to operators to enable precise control and isolation of permissions for system management and configuration changes, meeting various security management requirements.

Features

• Manage operators

• Manage roles

• Manage online operators

• Manage operator groups

• Manage global data permissions

Manage operators​

About this task

Operators are administrators of the management platform. To ensure the system security, only operators who pass the identity authentication can log in to the management platform. The operations that an operator can perform are determined by the authorities assigned to the operator. Operator management enables you to view, add, edit, delete, and filter operators in the management platform. You can extract an operator as a role, and navigate to the authentication parameter settings page for an operator. Additionally, you can view resources that have been authorized to an operator.

Restrictions and guidelines

• With RBAC enabled:

○ Only system administrators can add operators.

○ Only security administrators can edit operators.

○ Only system administrators and security administrators can delete operators. Operators sysadmin, secadmin, and secauditor are created automatically during system installation and cannot be deleted.

• Operators who have three login failures are forbidden to log in for one minute. You can edit the maximum number of failed login attempts and the lockout period in "Edit an operator."

• The security microsegmentation permissions have been integrated into advanced network permissions. Users with advanced network permissions automatically have the security microsegmentation permissions.

• An operator has the assigned permissions as well as the permissions of the role assigned to the operator. With RBAC enabled, an operator added by a system administrator can manage host or VM resources. Security administrators can edit the operator role and assign permissions to it.

• After you edit an online operator, the new settings take effect when the operator logs in to the management platform again. After you delete an online operator, the operator cannot use the management platform any more.

• Operator admin is the super administrator of the system and have all authorities. It is automatically created when the system is installed and cannot be deleted.

Add an operator

An operator is an operator username in the system, which might belong to a system administrator or a user. You can assign permissions to an operator by setting its role.

  1. On the top navigation bar, click System.

  2. From the left navigation pane, Operators & Groups > Operators.

  3. Click Add.

  4. Configure the parameters as described in "Parameters."

  5. Click OK.

Edit an operator

Edit operators to change or adjust existing operator accounts. For example, you can adjust roles to edit access permissions, update personal information, or perform other related operations.

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Operators.

  3. Select the target operator and click Edit.

  4. Configure the parameters as described in "Parameters."

  5. Click OK.

Delete operators

The super administrator account cannot be deleted.

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Operators.

  3. Perform one of the following tasks:

    ○ To bulk delete operators, select the target operators, and then click Delete.

    ○ To delete an operator, click More in the Actions column for that operator, and then select Delete.

  4. In the dialog box that opens, click OK.

Change an operator password

Perform this task to modify the login password of an operator. When the super administrator changes the password of another operator, the super administrator does not need to enter the old password of that operator.

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Operators.

  3. Use one of the following methods to change the password: Method 1: a. Click the Edit icon in the Actions column for the operator for whom you want to change the password to access the Edit Operator page. b. Set the Edit Password parameter to Yes, enter the current password and the new password, and confirm the new password. c. Click OK. Method 2: d. Click the More dropdown menu in the Actions column for the operator for whom you want to change the password. Click Change Password to open the Change Password dialog box. e. Enter the new password and confirm it a second time. f. Click OK.

Extract as role

Extract the permissions of the current operator to create a new role. This role appears in the role list for other operators to bind and use.

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Operators.

  3. Click the More dropdown menu in the Actions column for the operator for whom you want to extract as a role. Click Extract as Role. The Extract as Role dialog box opens.

  4. Set the role name and description, and then click OK.

Configure the authentication server

Perform this task to access the authentication parameter settings page. You can configure the authentication server and single sign-on (SSO) on this page. Configure the authentication server to set LDAP authentication server parameters. When an operator logs in to the management platform by using LDAP authentication, the operator must perform identity authentication on this server. The SSO configuration feature integrates the management platform with the Central Authentication Service (CAS) and implements a SSO solution. To configure the authentication server:

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Operators.

  3. Click the Authentication Server button to access the authentication parameter settings page.

  4. Set the relevant parameters. For more information about parameters, see "Configure authentication parameters."

  5. After setting the parameters, click Save.

Filter operators

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Operators.

  3. Set filter criteria as described in "Parameters," and then click Filter.

  4. To display more filters, click More. To collapse the Filters area, click Collapse.

Reset operator filters

Perform this task to reset operator information that matches the filters to the system default settings.

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Operators.

  3. Click Reset.

Display detailed operator information

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Operators.

  3. Select the target operator, and then click View.

View authorized resources of an operator

You can perform this task to view resources that have been authorized to an operator. To view authorized resources of an operator:

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Operators.

  3. Select the target operator. The Authorized Resources area displays host pools, clusters, hosts, VMs, and VM groups authorized to the operator on the Data Centers, Clusters, Hosts, VMs, and VM Groups tabs, respectively.

Parameters

• Login Name: Username of the operator.

• 2FA Authentication: Select whether to enable 2FA, It has the following types: Certificate Authentication, OTP, Verification Code, and SMS CAPTCHA. This field is displayed only after you enable 2FA on the System > AuthN Management > 2FA Authentication page.

• Authentication: Authentication mode used by the operator to log in to the management platform.

○ Password Authentication—Local authentication based on the operator username and password.

○ LDAP Authentication—LDAP authentication based on the operator username and password. For more information about configuring LDAP authentication, see "Configure authentication parameters."

○ SSO Authentication—SSO authentication based on the operator username and password. For more information about configuring SSO authentication, see "Configure authentication parameters."

• Operator Name: Name of the operator.

• Role: Role for the operator. You can manage the operators' data resource permissions by assigning roles to operators.

• Operator Group: Name of the operator group to which the operator belongs.

• Email: Email address of the operator. Make sure the email address format is correct, for example, account@example.com. If the email address is incorrect, the user cannot receive the notifications that the system sends to the user group to which the user belongs.

• Phone: Enter a correct phone number. If the phone number is incorrect, the user cannot receive the notifications that the system sends to the user group to which the user belongs.

• Permission Integrity: Signature verification result of the operator's permissions, which can be Unsigned, Verification Success, or Tampered. This parameter is displayed only after CASE is configured.

• Info Integrity: Whether the operator's information has been tempered with. Values include Unsigned, Verification Success, or Tampered. This parameter is displayed only after CASE is configured.

• Password Policy: Select the password policy that the operator must follow when setting the login password. For more information about password policies, see "Configure the password policy."

• Access Policy: Access policy applied to the operator.

• Max Online Operators: Set the maximum number of users that can use the operator username to access the management platform simultaneously. The value of 0 indicates that no limit is set.

• Operator Expiration Date: Set the date after which the operator username will expire. For example, if you set the expiration date to 2023/4/30, the operator username will expire at 00:00 in 2023/5/1. If you leave this field empty, the operator username will never expire.

• Change Password: Change the password for the operator to use this username to log in to the system. This parameter is displayed only when you edit an operator.

○ Old Password: Enter the current password of the operator.

○ New Password: Enter the new password. Make sure the new password is compliant with the password policy.

○ Confirm: The confirm password must the same as the new password.

• Forbid Operator: Whether the operator is forbidden from logging in to the management platform.

Manage roles​

About this task

The role management feature is the core of the system permission framework. Use this feature to uniformly extract and centrally manage operators, operator groups, and permissions through the middle layer of roles. This feature provides a flexible, controlled, and easy-to-maintain access control model. In this model:

• Operator: An individual account used to log in to the system and execute various operations, typically associated with a specific employee or system account.

• Operator group: Categorizes operators with similar responsibilities or organizational affiliations, such as Ops team or test team.

• Permission: Finest granularity of operation authorization in the system. It determines what actions an operator can execute on the specific function pages, such as view clusters, create VMs, delete hosts, and view logs.

• Role: A collection and encapsulation of permissions, serving as the link between operator/operator group and permissions. A role can include multiple permissions, and an operator can be bound to multiple roles.

In summary, role management uses roles to link underlying resource permissions with operators. It simplifies permission management, enhances permission consistency and security, and serves as a core function of the system's access control and security framework.

Application scenarios

• When you create a new business team or project team, you need to assign appropriate operation permissions to its members.

• Assign hierarchical management permissions for clusters, hosts, or VMs to different administrators.

• When you adjust the operations policy, you need to uniformly update the permission settings for a group of operators.

• Create custom roles with combined permissions when default roles do not meet precise permission assignment requirements.

Restrictions and guidelines

• The system provides the following five default roles, which cannot be edited or deleted:

○ SystemAdministrator: Has full permissions for system management.

○ ReadOnly: Has full viewing permissions for system management.

○ ClusterResourceManager: Has full permissions to manage the specified clusters, including their hosts and VMs.

○ HostResourceManager: Has full permissions to manage the specified hosts and the VMs under them.

○ VMResourceManager: Has full permissions to manage the specified VMs.

• After you edit the permissions of a role, the following rules apply:

○ All operators bound to this role must log in again for the new permission settings to take effect.

○ As a best practice, clear your browser cache before logging in again to avoid accessing cloud resource pages without permissions due to cached data.

Add roles

Perform this task to add new roles to the system and assign the corresponding function permissions. Add roles to manage permissions for different positions or groups, making it easier to assign appropriate permission scopes to operators later.

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Roles.

  3. Click Add to open the Add Role dialog box.

  4. Set the role name and description, and select the permissions to assign to the role from the permission tree on the right.

  5. Click OK to complete the operation.

Edit a role

Perform this task to edit information of an existing role, including the role description and its permissions. When business functions or permission requirements change, edit roles to adjust system permissions flexibly without recreating roles.

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Roles.

  3. Click Edit in the Actions column for the role to be edited. The Edit Role dialog box opens.

  4. You can edit the role description and its permissions.

  5. Click OK.

Clone a role

Perform this task to quickly clone an existing role. The new role inherits the permission settings of the original role. Cloning roles reduces repetitive configurations and easily fine-tunes and expands the existing permission model.

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Roles.

  3. Click the Clone icon in the Actions column for the role to be cloned. The Clone Role dialog box opens.

  4. Edit the role name and description.

  5. Click OK to complete the operation.

Delete roles

Perform this task to delete roles no longer in use from the system. You can delete roles separately or in bulk. Deleting roles can clean up redundant configurations and maintain a simple and standardized role system. To delete a role already bound to operators, first unbind it from those operators before deleting that role.

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Roles.

    ○ Delete a single role: Click the Delete button in the Actions column for the role to be deleted. The confirmation dialog box opens.

    ○ Bulk delete roles: Select one or more roles to be deleted. Click the Delete button above the list. The confirmation dialog box opens.

  3. Click OK to complete the operation.

Add bound operators

Perform this task to bind one or more operators to a specific role to automatically assign them all permissions of that role. By binding operators to a role, you can assign permissions based on the role to improve efficiency and consistency in permission assignment.

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Roles.

  3. In the role list, select the target role. Click the Add button in the bound operator area below the list to open the Select Operator dialog box.

  4. Select one or more operators to be bound to the current role.

  5. Click OK to complete the operation.

Delete bound operators

Perform this task to unbind operators from the specified role and reclaim the permissions associated with that role for those operators. You can delete bound operators to promptly control and reclaim system permissions during personnel position adjustments, resignations, or permission reductions.

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Roles.

  3. In the role list, select the target role and then select the operators to be unbound in the bound operators area below the list.

  4. Click the Delete button. The confirmation dialog box opens.

  5. Click OK to complete the operation.

Manage online operators​

Online operator management enables you to view and filter online operators and forcibly log off the

specified online operators.

Restrictions and guidelines

With RBAC enabled:

• Only security administrators and security auditors can view online operators.

• Only security administrators forcibly log off operators.

With normal mode, only authorized operators can forcibly log off other operators.

Filter online operators

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Online Operators.

  3. Configure the parameters as described in "Parameters," and then click Filter. All online operators matching the criteria are displayed in the list.

Forcibly log off online operators

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Online Operators.

  3. Select the target online operators, and then click Log Off.

  4. In the dialog box that opens, click OK.

Manage operator groups​

About this task

Use the operator group function to flexibly group and manage operators based on actual business needs. NOTE: System permissions are controlled through roles. Groups themselves do not directly determine permissions. Applicable scenarios:

• Administrators create roles based on different positions or functions and configure the corresponding function permissions in the roles.

• When you create a new operator, you can assign a role or bind an existing role to the operator. The role controls the operator's access scope and permissions in the system.

• Based on this, assign operators to different operator groups by department, project team, region, etc., for classification, statistics, and operations collaboration without changing their existing permissions.

For example, in a large enterprise, the IT department requires full administrative permissions for system management, while the finance department only needs permissions to finance-related functions. Create an IT administrator role and assign full system management permissions to the role. Then, create a finance role and assign only permissions to finance-related functional modules to the role. Then, bind operators from each department to their respective roles and add them to groups like IT group and finance group for clear classification and daily maintenance.

Restrictions and guidelines

With RBAC enabled:

• You cannot add or delete any operator groups.

• Only security administrators can edit operator groups. They can edit only the names and descriptions for operator groups.

With normal mode:

• You cannot add subgroups for the security auditor group.

• The default system administrator group and security auditor group cannot be deleted.

• Operator groups that have subgroups cannot be deleted. To delete such groups, delete their subgroups first.

Add an operator group

Perform this task to customize operator groups as required and manage operator categories by associating new or existing operators with operator groups.

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Operator Groups.

  3. Click Add.

  4. Configure the parameters as described in "Parameters."

  5. Click OK.

Add a subgroup for an operator group

You can add a maximum of 99 subgroups for an operator group to implement more refined category management. However, you cannot add subgroups for the system-defined security auditor group. A parent group is a higher-level operator group. It manages the subgroups belong to it. A subgroup is a lower-level operator group that belongs to a parent group and is used to further refine and customize operator categories.

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Operator Groups.

  3. To add a subgroup for a parent group, click Add Subgroup in the Actions column for that group.

  4. Perform the following tasks as needed:

    ○ To add a subgroup for a parent group, click Add Subgroup in the Actions column for that group.

    ○ To add a subgroup for a child group, click on the left of its parent group, and then click Add Subgroup in the Actions column for that child group.

  5. In the dialog box that opens, configure basic settings, and then click Next:Authorization.

  6. Configure the parameters as described in "Parameters."

  7. Click OK.

Edit an operator group or subgroup

Perform this task to edit the parameters of existing operator groups or subgroups.

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Operator Groups.

  3. Perform the following tasks as needed:

    ○ To edit a parent group, click Edit in the Actions column for that group.

    ○ To edit a subgroup, click on the left of its parent group, and then click Edit in the Actions column for that subgroup.

  4. In the dialog box that opens, configure basic settings, and then click Next:Authorization.

  5. Configure the parameters as described in "Parameters."

  6. Click OK.

Delete an operator group or subgroup

Perform this task to delete existing operator groups or subgroups. You cannot delete the system-defined system administrator group and security auditor group, but you can delete the subgroups of them.

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Operator Groups.

  3. Perform the following tasks as needed:

    ○ To delete a parent group, click Delete in the Actions column for that group.

    ○ To delete a subgroup, click on the left of its parent group, and then click Delete in the Actions column for that subgroup.

  4. In the dialog box that opens, click OK.

Manage global data permissions​

Use this feature to control and manage data access and operation permissions on the management

platform. It allows the administrator to configure specific access permissions for different operators or operator groups, which ensures data security and integrity. This prevents unauthorized users from accessing or editing sensitive data and improves system management efficiency. For example, in a medical institution, only doctors and nurses can access the medical records of patients and staff from the finance department can edit financial report data. This ensures both data security and service efficiency.

Restrictions and guidelines

This feature is not supported in the RBAC scenario.

Add permissions

Perform this task to add data access and operation permissions to operators or operator groups, which makes sure appropriate users can obtain necessary data access permissions.

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Global Data Permission.

  3. Click Add Permissions.

  4. Select operators or operator groups as required on the Operator or Operator Group tab, respectively.

  5. Click OK.

Delete permissions

Perform this task to delete the data access and operation permissions for an operator or operator group. The administrator can adjust user permissions immediately to ensure data security. You cannot delete permissions for the super administrator (admin) or security auditor group.

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select Operators & Groups > Global Data Permission.

  3. To delete permissions for operators or operator groups in bulk, select the operators or operator groups, and then click Remove.