XenCenter

Assign roles to users and groups

November 16, 2023

Contributed by:

All Citrix Hypervisor users must have an RBAC role. In Citrix Hypervisor, you must first assign a role to the newly created user before they can use the account. Citrix Hypervisor does not automatically assign a role to the newly created user. As a result, these accounts do not have any access to the Citrix Hypervisor pool until you assign them a role.

Note:

Before you can assign a role to a user or group, you must add the user or group’s Active Directory account to the Citrix Hypervisor pool. Add the AD account after joining the associated domain. For more information, see Join a domain and add RBAC users.

You can assign a user a different role by one of the following methods:

Change the role assigned to the user in the Select Roles dialog in XenCenter. This action requires the Assign/modify role permission, which is only available to a Pool Administrator.
Modify the user’s group membership in your Active Directory to make the user part of a group that is assigned a different role.

If an administrator indirectly applies multiple roles to a user, Citrix Hypervisor grants the user the permissions from the highest role that the user is assigned to.

To change or assign a role to a user or group

In the Resources pane, select the pool or server that contains the user or group.
Select the Users tab.
In the Users and Groups with Access pane, select the user or group to which you want to assign permissions.
Select Change Role.
In the Select Roles dialog, select the role you want to apply and click Save. For information about the permissions associated with each role, see Definitions of RBAC roles and permissions.

Tip:

When you are assigning a role, you can select multiple users simultaneously by pressing the CTRL key and selecting the user accounts.
(Optional) When changing a role, if the user is logged on to the pool and you want them to receive their new permissions immediately, click Logout User. This action disconnects the user’s sessions on the pool so the user receives a new session with the modified role.

Note:

When changing a role, the user must log out and log back in again for the new role to take effect. Force this log out by clicking the Logout User button. To force a logout, the user requires the Logout active user connections permission. This permission is available to a Pool Administrator or Pool Operator.

Note:

If you remove the Pool Admin role from a user, consider also changing the server root password and rotating the pool secret. For more information, see Pool Security.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Assign roles to users and groups

November 16, 2023

Contributed by:

November 16, 2023

Contributed by:

Assign roles to users and groups

To change or assign a role to a user or group

In this article