# vmware_object_role_permission – Manage local roles on an ESXi host

New in version 2.8.

- Synopsis

- Requirements

- Parameters

- Notes

- Examples

- Return Values

- Status

## Synopsis

- This module can be used to manage object permissions on the given host.

## Requirements

The below requirements are needed on the host that executes this module.

- python >= 2.7

- PyVmomi

## Parameters

Parameter | Choices/Defaults | Comments
--- | --- | ---
group string |  | The group to be assigned permission. Required if `principal` is not specified.
hostname string |  | The hostname or IP address of the vSphere vCenter or ESXi server. If the value is not specified in the task, the value of environment variable `VMWARE_HOST` will be used instead. Environment variable support added in Ansible 2.6.
object_name string / required |  | The object name to assigned permission.

object_type
string

Choices:
- Folder ←
- VirtualMachine
- Datacenter
- ResourcePool
- Datastore
- Network
- HostSystem
- ComputeResource
- ClusterComputeResource
- DistributedVirtualSwitch

The object type being targeted.

password string |  | The password of the vSphere vCenter or ESXi server. If the value is not specified in the task, the value of environment variable `VMWARE_PASSWORD` will be used instead. Environment variable support added in Ansible 2.6. aliases: pass, pwd
port integer added in 2.5 | Default: 443 | The port number of the vSphere vCenter or ESXi server. If the value is not specified in the task, the value of environment variable `VMWARE_PORT` will be used instead. Environment variable support added in Ansible 2.6.
principal string |  | The user to be assigned permission. Required if `group` is not specified.
proxy_host string added in 2.9 |  | Address of a proxy that will receive all HTTPS requests and relay them. The format is a hostname or a IP. If the value is not specified in the task, the value of environment variable `VMWARE_PROXY_HOST` will be used instead. This feature depends on a version of pyvmomi greater than v6.7.1.2018.12
proxy_port integer added in 2.9 |  | Port of the HTTP proxy that will receive all HTTPS requests and relay them. If the value is not specified in the task, the value of environment variable `VMWARE_PROXY_PORT` will be used instead.

recursive
boolean

Choices:
- no
- yes ←

Should the permissions be recursively applied.

role string / required |  | The role to be assigned permission.

state
string

Choices:
- present ←
- absent

Indicate desired state of the object's permission.
When `state=present`, the permission will be added if it doesn't already exist.
When `state=absent`, the permission is removed if it exists.

username string |  | The username of the vSphere vCenter or ESXi server. If the value is not specified in the task, the value of environment variable `VMWARE_USER` will be used instead. Environment variable support added in Ansible 2.6. aliases: admin, user

validate_certs
boolean

Choices:
- no
- yes ←

Allows connection when SSL certificates are not valid. Set to `false` when certificates are not trusted.
If the value is not specified in the task, the value of environment variable `VMWARE_VALIDATE_CERTS` will be used instead.
Environment variable support added in Ansible 2.6.
If set to `yes`, please make sure Python >= 2.7.9 is installed on the given machine.

## Notes

Note

- Tested on ESXi 6.5, vSphere 6.7

- The ESXi login user must have the appropriate rights to administer permissions.

- Permissions for a distributed switch must be defined and managed on either the datacenter or a folder containing the switch.

## Examples

    - name: Assign user to VM folder
      vmware_object_role_permission:
        role: Admin
        principal: user_bob
        object_name: services
        state: present
      delegate_to: localhost

    - name: Remove user from VM folder
      vmware_object_role_permission:
        role: Admin
        principal: user_bob
        object_name: services
        state: absent
      delegate_to: localhost

    - name: Assign finance group to VM folder
      vmware_object_role_permission:
        role: Limited Users
        group: finance
        object_name: Accounts
        state: present
      delegate_to: localhost

    - name: Assign view_user Read Only permission at root folder
      vmware_object_role_permission:
        role: ReadOnly
        principal: view_user
        object_name: rootFolder
        state: present
      delegate_to: localhost

## Return Values

Common return values are documented here, the following are the fields unique to this module:

Key | Returned | Description
--- | --- | ---
changed boolean | always | whether or not a change was made to the object's role

## Status

- This module is not guaranteed to have a backwards compatible interface. [preview]

- This module is maintained by the Ansible Community. [community]

### Authors

- Derek Rushing (@kryptsi)

- Joseph Andreatta (@vmwjoseph)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.