This command assigns a permission and/or LDAP groups to a role. To add multiple permissions to a role, run the command once for each permission.
Tip
Use the VAST Web UI to see which permissions are assigned to a role.
Go to Roles tab of the Administrators page, and choose the Edit option from the Actions menu for the role. The Update Roles dialog shows which permissions are currently assigned to the role.
Do not modify default roles. If you'd like to alter a default role, create a copy of the default role and modify the copy as needed.
Usage
role assign --id ID [--realm REALM | {--object-type OBJECT_TYPE --object-id OBJECT_ID}]
[--permissions create|view|edit|delete]
[--ldap-groups GROUPS]
[--tenant-ids IDs]
Required Parameters
| Specifies the role by its ID. |
Options
| Specify a realm of VMS objects. Possible values:
|
| Use this parameter together with Examples of objects are:
For example, if you want to grant permission on a given view, you would specify |
| Specify an object ID to assign permission to access a specific object. For example: |
| Include this parameter to specify a specific type of permission. Omit this parameter to grant all types. |
| Specifies one or more groups to associate the group(s) with the role. Users who belong to groups that are associated with the role will be able to log into VMS using their LDAP user name and password. They will be authorized based on the role(s) associated with their group. Each group can be any group on any connected LDAP-based provider, including Active Directory. Groups can be associated with multiple roles and vice versa. |
| Determines the tenant(s) for the role. You can specify one tenant ID or a comma-separated list of tenant IDs. |
Example
This example assigns to role 2 create permission for the logical realm on tenant 2:
vcli: admin> role assign --id 2 --realm logical --permissions create --tenant-ids 2