Red Hat Virtualization

Objectives

After completing this section, you should be able to use roles to control resource access and management in Red Hat Virtualization.

Managing User Access

New users are typically created in a directory service that is configured in Red Hat Virtualization as an external domain, using native administration mechanisms for that directory service. This configuration was discussed in the preceding section of this chapter.

New users created in a directory service are not initially authorized to access to the Red Hat Virtualization environment. User accounts must be granted permission to perform actions in the Red Hat Virtualization environment before they can be used. In this section, you learn how to manage user access using preconfigured settings called roles.

The Red Hat Virtualization authorization model is based around users, actions, and objects. Actions are tasks that can be performed, such as starting or stopping a virtual machine, creating a new template, or migrating a virtual machine to a different host.

Each type of action corresponds to a permission. Users have permissions that allow them to perform actions on objects. Objects are things like data centers, clusters, hosts, networks, or virtual machines.

To simplify maintenance, multiple permissions can be combined into a role. A role, in Red Hat Virtualization environment, is a set of privileges permitting access to physical and virtual resources at various levels. The system comes with multiple predefined roles, such as SuperUser and PowerUserRole. These roles make it easier to provide a specific level of access to a user.

Figure 4.2: Roles and permissions

Users can be assigned roles that apply to the entire Red Hat Virtualization environment, or only to a specific object (such as a virtual machine or a data center). If a user is assigned a role on an object that contains other objects, then the user gets the same role on all objects in the container. For example, if a user is assigned the HostAdmin role on a cluster, then the user gets the HostAdmin role on all hosts in that cluster.

When a user performs an action on an object, the user is identified as an entity. This entity is a combination of the user account, and its permissions on the target object. If both the user account information and permissions are correct, the user is allowed to perform the requested action on the target object; otherwise, the request is denied.

The following graphic shows how permissions are inherited between objects.

Figure 4.3: The hierarchical layout of objects in Red Hat Virtualization

Role Types

Red Hat Virtualization comes with a variety of preconfigured roles. Two types of roles that exist in the Red Hat Virtualization environment are:

The following roles come predefined in a standard Red Hat Virtualization environment. Users can be assigned multiple roles at multiple levels in the RHV hierarchy. The complete set of actions a user can accomplish is defined by the union of all roles assigned at a particular level.

Use these roles to better manage user access and to delegate administrative authority. For example, assign SystemAdmin to specific users without giving them access to the admin@internal account. Users with roles can be properly tracked and managed for compliance.

Assign less comprehensive roles to appropriate users in order to offload administrative tasks. The DataCenterAdmin, ClusterAdmin, and PowerUserRole roles are useful for this purpose.

Assigning Roles to Users

Confirm that the user exists using the administrative tools supported by your directory service domain. After confirming the user, grant any desired permissions or roles using the Administration Portal.

Assigning System-wide Roles to Users

To assign a role to a user applicable to all objects in the Red Hat Virtualization environment, log in to the Administration Portal as a user that has the SuperUser role, for example as admin@internal user.

In the web interface, assign the system-wide roles to the users using the Configure dialog box. To access this dialog box, navigate to Administration → Configure. You can find the Administration menu on the navigation pane displayed on the left.

Figure 4.4: Accessing configure dialog box

In the Configure dialog box, under System Permissions, the Add button is used to assign roles to the users.

Figure 4.5: Adding users

The Add button in the Configure dialog box opens the Add System Permission to User dialog box. The Add System Permission to User dialog box allows you to select the appropriate profile to use, under the Search field. In the Add System Permission to User dialog box the GO button retrieves the list of users and groups from the appropriate source, based on the selected profile.

From the returned list of users, enable the check box for the specific user and select the appropriate role from the drop-down menu under Role to Assign. Confirm the role assigned to the selected user and then click the OK button.

Figure 4.6: Adding permissions

To verify that the user has been granted the correct permissions, log in to the appropriate portal using the user's credentials.

Assigning Resource-specific Roles to Users

Sometimes users should be assigned a role that only applies to a subset of resources in the Red Hat Virtualization environment. Depending on the role assigned, users are able to access and use resources as described earlier in this chapter.

To assign roles to users at the resource level, determine the resource and then add permissions specific to that particular resource. The following screenshot considers Data Centers as the determined resource.

Figure 4.7: Accessing Resources

Each type of resources has its own page. This page lists the available resources of the specific type. For example, all the available data centers are listed on a page that is different from the page that lists all the networks.

Click on the name of the resource to access the objects associated with the resource. Among the associated objects are Permissions, which enables adding users with specific roles at the resource level. These permissions define the rights of a user with a specific role on the resource and its children resources, if any. The user does not inherit the same permissions on other resources at the same level as the resource to which permissions were applied.

Figure 4.8: Accessing the resource objects

For the selected resource, the Permissions tab returns a list of assigned users, user roles, and inherited permissions. The Add button on the Permissions tab leads you to the Add Permission to User dialog box where you can assign roles to the users for the resource.

Figure 4.9: Adding Permissions

The Add Permission to User dialog box allows you to select the appropriate profile to use from the Search field. In the Add Permission to User dialog box, the GO button retrieves the list of users and groups from the appropriate source, based on the selected profile.

From the list of returned users, enable the check box for the specific user and select an appropriate role from the drop-down menu under Role to Assign. The OK button in this dialog box is used to confirm the role assignment to the selected user for the resource.

Figure 4.10: Assigning Role to users at resource level

To verify that the user has been added with the correct permissions, log in to the appropriate portal with the user's credentials and access the resource for which you added the permissions.

Removing Roles from Users

To remove a role from a user in the Red Hat Virtualization environment, clear the box for the user in the Add System Permission to User or Add Permission to User dialog box, and then click OK to confirm. The SuperUser role is required to perform this action.

Resetting the Internal Administration User's Password

The admin@internal account is created at installation time as a default user that has the system-wide SuperUser role. Like root on a Red Hat Enterprise Linux system, this can be useful as an emergency administration account if your external directory service is down.

From time to time, you may need to change or reset the password for this account. Use the ovirt-aaa-jdbc-tool command to perform the reset. There is no need to restart the ovirt-engine service in your RHV environment for this change to take effect.

The following command changes the password of the admin@internal user to redhat123, and sets the password validity to 2025-08-01 12:00:00Z.

[root@rhvm-demo ~]# ovirt-aaa-jdbc-tool user password-reset admin \
--password-valid-to="2025-08-01 12:00:00Z"
Password: redhat123
Reenter password: redhat123
updating user admin...
user updated successfully

User accounts in the internal local domain use the following complexity criteria for the password, by default.

You can list or change the default policy using ovirt-aaa-jdbc-tool with the settings subcommand. Detailed information on how to do so is beyond the scope of this course.

[root@rhvm-demo ~]# ovirt-aaa-jdbc-tool user unlock admin
updating user admin...
user updated successfully