Hello Martin,

I was able to get mostly there with the API. There are a few permissions you cannot give out; however, I was told it was on the development track to get it fixed. So for now what you need to do is use the API to list all the permissions that are associated with the “Super Admin” and then use these details to assign them to a new group. I used the API explorer to get code examples and to build the group. Remember the API explorer is live, so even though it says “try it” it will really run the code against your environment. I hope this helps you.

Thanks,

Scott

Hi Scott.

Thanks for the reply, appreciated. I’ll give it a go with the API explorer - I have been tinkering quite a bit with the Nutanix API’s during our POC so with a bit of luck I’ll get there.

@Alona - can you give an update on the status of this bug? The RBAC of Prism Central/Calm loses a bit of its usefulness if I have to “hack” it to get it to work as intended.

Thanks.

Hi @skeeter!

I got a new role created via API with as far as I can tell all the same rights as the Super Admin role. 

When logging in with a user that has the new role I notice that I still can’t access settings in Prism Central. Is this one of the few permission you mention in your previous reply that can’t be assigned at all to a new role?

-- Martin

Hello @Martin Edelius  yes this is one for sure. From what I was told it is not a bug but something that Nutanix has not brought into the GUI and as for the permissions probably not something they are going to bring in as they want to limit the number of accounts with that level of permissions. I was alsotold it might be changed in the next release so you might see it there.

Thanks,

Scott

Hi Scott.

Ok, I guess it is what it is.

I can understand that they don’t want a multitude of people having extra, mega, super, duper admin access - but in the end that should be my mistake to make, and if nothing else I think it should be possible to use groups for this access. I really dislike having to assign rights to specific users and especially local users.

Thanks for the help!

-- Martin

I agree 100% for sure. I have used AD groups to provide access through Prism Central, but it is limited to the permission sets you have found. In my opinion Nutanix has a lot of work to do to get us clients down what I call the “last mile”. They started providing powershell modules as a snap-in. This was going to be re revised and rewritten, but then it just died. So now you have half a powershell module written in a form that will be deprecated soon and the API. With all of that said it has been a good product so far for me. I’m new to it, so take that for what it is.

glad I could help a little.

Thanks,

Scott