Creating custom roles and assigning custom permissions for users to restrict access only to required NSX resources

Products

• VMware NSX

Issue/Introduction

Procedure to create users with only required permission that is needed to access only required NSX resources. The steps mentioned here are to create a customer user role with specific permission to operate only on NSX license management. 

This procedure could be referred to create similar other RBAC roles with custom permissions assigned.

Environment

4.x

Resolution

Steps to create users with custom roles to provide restricted access to the environment in NSX GUI 

1. Login to NSX GUI as admin
2. Go to System --> Settings --> User Management --> Roles --> Add Role
3. Add a new role.  For ex., "test-license-admin"
4. Expand the role created and from the Permissions section, Select System "Read-only".  It opens a window to set License configuration . Set "Full Access" and then apply which changes the system config as "Mixed .Thus a new user-role is created with only access granted for license management alone.
5. Now add new user, by going to Local Users tab --> Local User
6. Then activate the user by selecting 3 dots and set & confirm password to login
7. Then go to User Role Assignment , Edit the user created by selecting 3 dots next to the user created and select 1 under roles section
8. Add roles and select the new Role created to admin only license management "test-license-admin" and apply & save it
9. Check the new user created is assigned the new role created
10. Test the new user created should have only license management by logging in to NSX GUI and check if you could add new license only and no other actions config are possible

Refer RBAC for more information 

https://techdocs.broadcom.com/us/en/vmware-cis/nsx/vmware-nsx/4-2/administration-guide/authentication-and-authorization/role-based-access-control.html