Identity and Access Management as a Provider

You invite new users to your provider organization and manage their level of access to resources by assigning role-based permissions to their user accounts in Omnissa Cloud Services. You can remove users from your provider organization, edit their roles, or organize them in a group. Additionally, you can set up a federated identity for your corporate domain and manage user roles in batches by creating enterprise groups.

For information about the roles and permissions available to cloud provider users in Omnissa Cloud Services Console, see Roles and permissions.

You can also authenticate your applications and grant them regulated access to the resources of your Omnissa Cloud Services Console organization by creating OAuth 2.0 server to server apps.

How do I add users to my organization

You add new users to your provider organization and assign roles to their user accounts.

Prerequisites

Verify that you have the Organization Owner role in your organization.

Procedure

1. On the Cloud Services Console toolbar, click Identity & Access Management > Active Users.
2. Click Add Users.
3. In the Users text box, enter the email address of the user you want to add to your organization.
   • You can add multiple users at once but you cannot assign different roles to them.
   • If you want to add users with different roles, you must add them separately.
4. From Role Assignment, select the roles you want to assign to the user.
5. To add the user, click Save.

Results

If a user has Omnissa ID set up with their email, they are immediately added to your organization and appear in the Active Users tab.

If a user does not have Omnissa ID set up with their email, they receive an invitation to create an Omnissa ID and join your organization. You can view the status of current invitations in the Pending Invitations tab, where you can also revoke invitations sent by mistake, or resend expired invitations. Invitations expire after seven days.

How do I remove users from my organization

You can remove users from your provider organization.

Prerequisites

Verify that you have the Organization Owner role in your organization.

Procedure

1. On the Omnissa Cloud Services Console toolbar, navigate to Identity & Access Management > Active Users.
2. Select the users you want to remove from your organization and click Remove Users.
3. To confirm the removal, click Remove.

Results

The selected users are immediately removed from your organization and can no longer access Omnissa Cloud Services Console with their credentials.

How do I authenticate applications with OAuth 2.0 as a Cloud Services Provider

Omnissa Cloud Services Console uses OAuth 2.0 so that you can grant your applications secure delegated access to the resources of your provider organization or customers organizations. Omnissa Cloud Services Console supports OAuth 2.0 server to server apps which authorize actions through an access token, issued directly to your application.

What is OAuth 2.0?

OAuth 2.0 is an authorization protocol that lets you grant your applications secure access to your resources. Your client is authorized through an access token. The access token has a scope which defines which resources the app can access. For information about OAuth 2.0, see https://tools.ietf.org/html/rfc6749#page-8, or look at this blog post called OAuth 2.0 Simplified at https://aaronparecki.com/oauth-2-simplified/.

How does OAuth work with Omnissa Cloud Services Console?

Omnissa Cloud Services Console supports the OAuth 2.0 client credentials grant type, which grants your applications access to the resources of your organization without the need of user authorization. To supply credentials for your applications, you create a server to server OAuth 2.0 app in Omnissa Cloud Services Console and define the scope of its access token. Then your applications use the supplied OAuth credentials to retrieve the access token and gain access to the resources defined in the scope.

How do I set up an OAuth server to server app?

The process of setting up an OAuth app is two-fold. First, you create the OAuth app in an organization of yours and define the scope of its access token. Then, to enable the app's access to the organization's resources, you add the app to the same organization in which it was created. You cannot add OAuth apps created in different organizations.

To create an OAuth app:

1. On the Omnissa Cloud Services Console toolbar, click Organization > OAuth Apps.
2. Click Create App > Continue.
3. Complete the OAuth app details and define its scope.
   1. Enter a name and description for the app.
   2. Set the time to live of the OAuth app's access token.
   3. To define the scope of the OAuth app's access token, select organization and service roles.
      Depending on the organization roles selected, you may not be able to assign any service roles.
   4. Click Create.
4. Copy the received credentials or download a JSON file, and click Continue.

At this point the OAuth app has been created in your Omnissa Cloud Services Console organization but not yet granted access to its resources. To grant it access, you must add the app to your organization.

Important: As a Cloud Services Provider, you can create and manage OAuth apps with or without restrictions. When you add an OAuth app to an organization, the scope of its access token might differ from the one set in the Organization > OAuth App settings. The actual scope is a result of the intersection of three criteria - the OAuth app scope settings, the available permissions in your organization, and the assigned organization and service roles of the user performing the procedure.

To add an OAuth app to an organization:

1. On the Cloud Services Console toolbar, click Identity & Access Management > OAuth Apps.
2. Click Add App.
3. Select your organization, then browse and select an OAuth app.
   The page lists the organization and service roles that will be assigned to the OAuth app instance.
4. Review the OAuth app details and click Add.

The OAuth app is added to your Omnissa Cloud Services Console organization and granted access to its resources.

To authorize the actions of your applications, use the provided OAuth credentials in your script's API calls.

How do I manage OAuth apps?

Refer to the following table for a list of OAuth management functions you can perform.