Membership in multiple user groups

If a user belongs to more than one user group, the user’s permissions are derived from the resource and action permissions of all of the groups. The way the permissions are derived depends on whether or not the resources are folders.

If the resources are not folders, then the derived permissions are a cross-product of the resource and action permissions of all groups to which the user belongs. With a cross-product, all action permissions apply to all resource permissions. For example, Jane Doe belongs to both of the Atlanta and Portland groups, which have the permissions listed in the following table. Because the derived permissions are a cross-product, Jane can perform the System Diagnosis task on the managed servers associated with the Widget Inc. customer, even though neither the Atlanta nor Portland group has this capability.

Example of cross-product permissions

Resource or Action	Atlanta User Group Permission	Portland User Group Permission
Resource: Customer: Widget, Inc.	Read & Write	None
Resource: Customer: Acme Corp.	None	Read & Write
Action: System Diagnosis	No	Yes

If the resources are virtualization containers, then the derived permissions for the user are cumulative but do not cross user groups. For example, John Miller belongs to both the San Diego and Raleigh groups shown in the following table. If John has Write permissions to Server X in Virtualization Inventory Folder A, John can run power control operations on it. If John has Write permissions to Server Y in Virtualization Inventory Folder B, he can Modify the VM configuration. However, he cannot run a power control on Server Y or Modify the VM configuration of Server X.

Example of Permissions for Virtualization Containers

Resource or Action	San Diego User Group Permission	Raleigh User Group Permission
Resource: Hypervisor Container B	None	List
Resource: Virtualization Inventory Folder A	Read	None
Resource: Virtualization Inventory Folder	None	Read & Write
Action: VM Lifecycle Management: Power Controls	Yes	None
Action: VM Lifecycle Management: Modify VM	None	Yes

If the resources are folders (or their contents), then the derived permissions for the user are cumulative but do not cross user groups. For example, Joe Smith belongs to both the Sunnyvale and Dallas groups shown in the following table. Joe can create packages under the Webster folder because the Sunnyvale group has Read & Write permissions for that folder and for the Manage Package action. However, Joe cannot create packages under the Kiley folder, because neither user group can do so. Joe can create Build Plans under the Kiley folder, but not under the Webster folder.

Table 6. Example of cumulative permissions

Resource or Action	Sunnyvale User Group Permission	Dallas User Group Permission
Resource: Folder Webster	Read & Write	None
Resource: Folder Kiley	None	Read & Write
Action: Manage Packages	Read & Write	None
Action: Manage Build Plans	None	Read & Write