XenCenter

Calculating RBAC roles

May 25, 2023

Contributed by:

When I log in, how does Citrix Hypervisor compute the roles for the session?

The Active Directory server authenticates the subject. During authentication, Active Directory also determines if the subject belongs to any other containing groups in Active Directory.
Citrix Hypervisor then verifies the following information:
- The roles assigned to the subject
- The roles assigned to any Active Directory groups that the subject is a member of.
Citrix Hypervisor applies the highest level of permissions to the subject. Because subjects can be members of multiple Active Directory groups, they inherit all permissions of the associated roles.

A diagram showing that Users can be in Groups in Active Directory. Both Users and Groups in Active Directory are mapped to Subjects in XenCenter. Subjects can have a role. Roles have a set of Permissions.

This illustration shows the following information:

Subject 2 (Group 2) is the Pool Operator.
User 1 is a member of Group 2.
When Subject 3 (User 1) tries to log in, they inherit both Subject 3 (VM Operator) and Group 2 (Pool Operator) roles.
The Pool Operator role is higher, so the resulting role for Subject 3 (User 1) is Pool Operator and not VM Operator.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Calculating RBAC roles

May 25, 2023

Contributed by:

May 25, 2023

Contributed by:

Calculating RBAC roles

When I log in, how does Citrix Hypervisor compute the roles for the session?

In this article