AzMan concepts

There are basic concepts in AzMan that you need to be familiar with before we go into details on how Hyper-V implements/use it for delegation. I will not describe the architecture of AzMan here, you can find some excellent materials from the references listed above.

• Operation: Low-level permission that a resource manager uses to identify security access. Examples of operations in Hyper-V: “Pause and Restart Virtual Machine”, “Start Virtual Machine”, “Create Virtual Switch”, “Read Service Configuration”….
• Task: Group of operations. Task is used to define which operations are required for an admin person. For example, in Hyper-V AzMan , you can create a task called VM-Control which groups the following operations: “Pause and Restart Virtual Machine”, “Start Virtual Machine”…
• Role Definition: Group of tasks and operations that are needed for a particular role. For example, you can create a role definition called “VM Operator” which includes the VM-Control task defined above and the “Read Service Configuration” operation
• Role: Set of permissions a user must have to perform a particular job. Role is assigned to users or group and is applied to a set of objects through scope
• Scope:  Defines a boundary for a distinct authorization policy. You create roles in a given scope and and apply this scope to a set of objects.

So the scope is really the “link” between AzMan and Hyper-V, you apply a set of permissions ( created thru tasks and roles) of a scope to a set of Hyper-V objects. Hyper-V provides a Default Scope that applies to all Hyper-V objects, so if an object has no custom scope defined, then it will use the Default Scope. Hyper-V’s default scope is named “Hyper-V Services”.

Scopes can be created from the default scope and they inherits tasks, roles definition and roles assignment from the parent scope. For example, if you create a new scope and apply to a set of objects, the objects will get all permissions ( through roles) defined in this scope and the default scope.

Hyper-V objects and Scope

All Hyper-V objects use the Default Scope but I find out that very few of them can accept user-defined scopes in the current release ( RC1) of Hyper-V. So far the following classes can have customized scopes:

• Msvm_SwitchPort
• Msvm_Switch
• Msvm_VirtualSystemGlobalSettingData
• Msvm_VirtualSystemManagementService

Basically, only virtual machines, virtual switch and the Virtual Machine Management Service can accept custom AzMan scopes. Those objects have the property ScopeOfResidence defined in their base classes.

To apply an Azman scope to those objects, you set their ScopeOfResidence to the name of the scope defined in AzMan. In the current release of Hyper-V , there is no GUI interface to apply a scope. You have to use scripts!

Summary

This is an overview of AzMan and how it is used in conjunction with Hyper-V. In the next posts, I will go through the AzMan interface and shows some scripts to create scopes and apply them to Hyper-V objects.

Enjoy!

/Dung

HyperV WMI PowerShell