Citrix Systems 6 Definitions of permissions, Permission Allows Assignee To Rationale/Comments

Role		Pool Admin	Pool	VM Power	VM Admin	VM Operator	Read Only
permissions			Operator	Admin
Connect	to	X	X	X	X	X	X
pool	and
read all pool
metadata

Definitions of Permissions

The following table provides additional details about permissions:

Table 2. Definitions of permissions

Permission	Allows Assignee To						Rationale/Comments
Assign/modify roles	•	Add/remove users					This permission lets the user grant
	• Add/remove roles from users						himself or herself any permission
							or perform any task.
	•	Enable	and		disable	Active
		Directory		integration		(being	Warning:	This	role	lets	the
		joined to the domain)					user disable the Active Directory
							integration and all subjects added
							from Active Directory.
Log in to server consoles	•	Server console access through					Warning: With access to a root
		ssh					shell, the assignee could arbitrarily
	•	Server console access through					reconfigure	the	entire	system,
							including RBAC.
		XenCenter
Server backup/restore VM create/	•	Back up and restore servers					The ability to restore a backup
destroy operations	• Back		up	and	restore	pool	lets the assignee revert				RBAC
							configuration changes.
		metadata
Import/export OVF/OVA packages	• Import OVF and OVA packages
and disk images	•	Import disk images
	• Export			VMs	as OVF/OVA
		packages
Log out active user connections	•	Ability to disconnect logged in
		users
Create/dismiss alerts							Warning: A user with this
							permission can dismiss alerts for
							the entire pool.
							Note: The ability to view alerts is
							part of the Connect to Pool and
							read all pool metadata permission.
Cancel task of any user	•	Cancel any user's running task					This permission lets the user
							request XenServer cancel an in-
							progress task initiated by any user.

14