Manage Users of Tanzu Observability on VMware Cloud Services

VMware Cloud services provides identity access management for the users of your services, including Tanzu Observability. For example, see our tutorial Invite New Users from the VMware Cloud Services Console.

Adding Users to Your Service Instance

To add a user to your Tanzu Observability service instance, you must assign that user:

1. An organization role for the VMware Cloud organization running the service instance.

   Note: If you are a VMware Cloud Organization Administrator, you can assign only the VMware Cloud Organization Member role. Only a VMware Cloud Organization Owner can add VMware Cloud Organization Owners and VMware Cloud Organization Administrators.

2. An Tanzu Observability service role for the service instance.

   You can assign a combination of service roles. For example, if the user that you want to invite will set up integrations, make sure that you assign that user both the Integrations and the Proxies service roles.

   If you plan to assign that user a custom role, you must assign that user at least the Viewer Tanzu Observability service role, so that the user can access the service instance.

   Note: In a multi-tenant environment, you assign service roles on a tenant basis. You can assign different service roles for different Tanzu Observability instances (tenants). The users have access only to the tenants for which they have service roles. The users receive the 401 Unauthorized: User has no access to service error message when trying to access a tenant for which they don’t have service roles.
   Important: Make sure that you assign the Super Admin service role to at least one user of your Tanzu Observability service instance. There are some Super Admin tasks that no one else can perform.

3. Optionally, a custom role with an Tanzu Observability permission.

   Important: In a multi-tenant Tanzu Observability environment, custom roles apply to all service instances (tenants) to which the user has access, that is, for which the user has at least one Tanzu Observability service role.

You can assign users with these roles in the following ways:

Adding Users to Your Organization

When you are adding an individual user or a list of users to the VMware Cloud organization running the service instance, you must assign that users organization roles. To grant the users access to the Tanzu Observability instance, you assign that users service roles. Optionally, you can also assign the users custom roles, which apply only in combination with service roles.

For details, see How do I add users to my Organization.

The newly added users receive an invitation email with an account activation link to sign up to the service instance. The invitations you send are valid for seven days. You can view the status of the invitation on the Identity and Access Management > Pending Invitations page.

Creating or Editing a Group

When you are creating or editing a group in the VMware Cloud organization running the service instance, you can add a list of users as members of the group and you can assign organization, service, and custom roles to the group.

You can add users who already belong to the VMware Cloud organization as well as new users who don’t belong to the VMware Cloud organization yet. You can add users from your federated domain as well as users that are outside your federated domain.

For details, see How do I work with groups in the VMware Cloud services documentation.

The newly added users receive an invitation email with an account activation link to sign up to the service instance. The invitations you send are valid for seven days. You can view the status of the invitation on the Identity and Access Management > Pending Invitations page.

Editing a User’s Roles

If a user already belongs to the VMware Cloud organization running the service instance, you can edit the user’s roles to assign that user with Tanzu Observability service or custom roles.

For details, see How do I change user roles in the VMware Cloud services documentation.

Remove a User

• To remove a user from your service instance, you must remove their Tanzu Observability service roles.
  • If the roles are individually assigned to the user, edit the user’s roles. See How do I change user roles in the VMware Cloud services documentation.
  • If the roles are inherited from a group, edit the group and remove that user from the list of members. See How do I work with groups in the VMware Cloud services documentation.
• To remove a user from your organization, therefore from all services in the organization, see How do I remove users from my Organization in the VMware Cloud services documentation.

Sign Out a User

As a user with the Super Admin service role, you can sign out other users by using the REST API. To sign out a user while you enabled Super Admin mode, simply run a POST request with the logout API call. For example:

POST https://<your_instance>.wavefront.com/api/logout/{identifier}

You must specify the {identifier}, which is the email address of the user that you want to log out. If you are not logged in to your service instance, when you run the POST request, you must also provide a valid API token.