How does XenServer compute the roles for the session?
1.The subject is authenticated via the Active Directory server to verify which containing groups the subject may also belong to.
2.XenServer then verifies which roles have been assigned both to the subject, and to its containing groups.
3.As subjects can be members of multiple Active Directory groups, they will inherit all of the permissions of the associated roles.
In this illustration, since Subject 2 (Group 2) is the Pool Operator and User 1 is a member
of Group 2, when Subject 3 (User 1) tries to log in, he or she inherits both Subject 3 (VM Operator) and Group 2 (Pool Operator) roles. Since the Pool Operator role is higher, the resulting role for Subject 3 (User 1) is Pool Operator and not VM Operator.
18
