vmware vApp permissions

[shnelson]

Running into a slight issue with assigning user privileges to a vApp...

Domain\User is assigned VM Power user permissions at the top level of the vApp & set to propogate. When launching the VIC, they can only see the VM's that are within said vApp & not the vApp itself.

I don't mind this as much, but they are unable to perform any power functions against the VM. IE - attempting to power on a VM, it appears to work without issue, but the VM never comes up.

If I I let these rights remain, and give the user read access at the top level of the cluster, the machine actually turns on without issue.

It seems I'm missing something somewhere, any hints? My virtual machine power user profile includes the ability to Power on/off & suspend a vapp.

 

[shnelson]

After smashing my head against the keyboard a couple more times, I figured it out.

Granting Ready-Only rights against the cluster and not propogating it allowed them to have full power control over the desired vapp, and not see the rest of the objects under the cluster.

 

[lopoetve]

I'm guessing you had drs turned on? I THINK you have to see the compute resource to be able to do a power op.

 

[shnelson]

DRS is turned on, this was my first time working with permissions against a vApp so it threw me for a loop. I'm assuming Resource pools would be the same?

What didn't work:
[Datacenter] No Rights
.....[Cluster] No Rights
..........[vApp] Power User, propagated (included selective rights under vApp category)

The top level vApp was not visible. The user could see the VM(s), work within the console, mount media and manage snapshots. It appeared they could control power (it even prompted about making sure to obey the vApp power on sequence), but never actually committed the event.

What did work:
[Datacenter] No Rights
.....[Cluster] Read Only, not propagated
..........[vApp] Power User, propagated

User now sees the Cluster tree & the vApp. All power control appears to work, so I think it's safe to say you are correct.

Would having DRS turned off result in a different behavior?

 

[lopoetve]

I believe it might, as it's not a resource pool then, but vApps are weird for that as they contain "resources" regardless of DRS settings.