Part 4 – Configuring Role Based Access Control in XenServer Pool

In this article we will learn how to configure role based access control for Citrix XenServer pool joined to a Active Directory domain.

We will be creating below two groups in Active Directory and configuring respective permissions on the XenServer Pool. Then we will create users and add them to these groups effectively giving them those particular permissions on the XenServer hosts.

Group Name	Permission	Purpose
citrixadmins	Pool Admin	Pool administrators
citrixreadonly	Read only	Read only users

Log into the domain controller, click on Start Menu, Administrative Tools and then double click on Active Directory Users and Computers.

Expand the domain (virtshinobi.local), right click Users, click on New and then Group.

Enter the group name as citrixadmins and click on OK to create the group, Similarly create one more group citrixreadonly.

Open Citrix XenCenter and connect to the XenServer pool. Select the XenServer pool then click on Users tab and click on Add.

Enter the group name citrixadmins and click on Grant Access.

Click Close.

Follow above steps and add the group citrixreadonly as well.

Next we will configure the two roles for the respective groups. Select the group VIRTSHINOBI\citrixadmins and click on Change Role.

On the Select Role window, select the checkbox against Pool Admin and click on Save.

You can see the permission reflecting against the group as shown below.

Similarly configure the read only role for the group citrixreadonly. Select Read Only role for the group.

Now you can create users in Active Directory and make them members of the any of the above two groups effectively giving them those permissions on the XenServer pool. You can also explore other roles and their permissions.

For example I have created user citrixadmin01 and added it to the group citrixadmins giving it pool admin rights. Also I have added user citrixreadonly01 and added it to the group citrixreadonly giving it read only rights on the pool.

As you can see below, when I connect to the XenServer pool using the user citrixreadonly01 and try to put host xenhost01 in maintenance mode, it doesn’t allow and asks for the Pool Admin, Pool Operator roles.