3.2 Entity Management, Categories, and Role-Based Access Control

Entity Management, Categories, and Role-Based Access Control

Quick Summary: In modern multicloud environments, managing virtual machines and infrastructure using static identifiers (such as machine names, host placement, or individual IP addresses) causes administrative bottlenecks and configuration drift. Nutanix Prism Central solves this through Categories—a flexible Key:Value metadata tagging framework that underpins policy automation, security microsegmentation, and disaster recovery. Combined with enterprise Role-Based Access Control (RBAC) and external Directory Services (Active Directory / OpenLDAP) federation, administrators can enforce strict least-privilege security boundaries across thousands of virtual entities.

---

1. Entity Management and Prism Central Categories

As enterprise virtual machine counts expand from dozens into thousands across multiple Nutanix clusters, traditional perimeter-based and manual operational management breaks down. If a security team needs to apply firewall rules or a backup team needs to establish snapshot schedules, hardcoding individual VM names or IP addresses into policies creates brittle architectures that break when workloads scale, migrate, or re-IP.

The Category Metadata Architecture

Nutanix solves this governance challenge through Categories in Prism Central. A Category is a system-wide or user-defined metadata tag structured as a Key:Value pair:

• Category Key: Represents the logical attribute, classification boundary, or governance parameter (for example, Environment, AppTier, or Compliance).
• Category Value: Represents the specific instance, classification assignment, or designation within that key (for example, Production, Staging, Database, PCI-DSS).

   Category Key                    Category Values
+-----------------+          +-------------------------+
|                 |--------->| Production              |
|   Environment   |--------->| Staging                 |
|                 |--------->| Development             |
+-----------------+          +-------------------------+

+-----------------+          +-------------------------+
|                 |--------->| WebServers              |
|     AppTier     |--------->| Application             |
|                 |--------->| Database                |
+-----------------+          +-------------------------+

Entity Types Supported by Categories

While virtual machines are the most common categorization target, Categories can be assigned across a diverse array of Nutanix entities:

• Virtual Machines (AHV and ESXi): Workload tagging for security, backup, and automation.
• AHV Virtual Networks & Subnets: Network classification and isolation policies.
• Physical Clusters and Hosts: Geographic, regulatory, or hardware tier grouping.
• Storage Containers: Tiered service-level agreement (SLA) classification.

Downstream Integration with Nutanix Policy Engines

Categories are not passive informational labels; they serve as the foundational declarative hooks for core Nutanix automation engines:

1. Nutanix Flow Network Security (Microsegmentation): Flow does not inspect physical VLANs or static IP lists to enforce zero-trust security. Instead, security policies are formulated between categories (e.g., allow traffic between AppTier:WebServers and AppTier:Application on TCP port 8443, but block all direct incoming traffic to AppTier:Database except from AppTier:Application). When a newly provisioned VM is tagged with AppTier:Database, it immediately inherits zero-trust microsegmentation protection.
2. Nutanix Leap (Disaster Recovery Orchestration): Protection policies use categories to dynamically assign recovery point objectives (RPO). For example, any VM assigned the category DR-Tier:MissionCritical is automatically replicated every 15 minutes to the secondary datacenter.
3. Nutanix Cloud Manager (NCM) Self-Service & Cost Governance: Resource quotas, budgetary chargeback models, and automated lifecycle runbooks leverage categories to track resource consumption per department or project.

---

2. Role-Based Access Control (RBAC) Framework

Enterprise security compliance requires strict adherence to the Principle of Least Privilege: users and administrators must only be granted the minimum operational permissions necessary to perform their job duties.

Nutanix provides a comprehensive Role-Based Access Control (RBAC) engine that operates at both the local cluster level (Prism Element) and across the enterprise multi-cluster plane (Prism Central).

Built-in Administrative Roles

Nutanix includes pre-configured, immutable built-in roles that cover common operational profiles:

Custom Roles and Scoped RBAC in Prism Central

While Prism Element supports built-in roles, Prism Central introduces granular Custom Roles allowing enterprises to define bespoke security profiles tailored to multi-tenant or departmental boundaries.

A custom role in Prism Central is composed of three interconnected dimensions:

1. Operations (Permissions): Specific granular tasks selected from hundreds of discrete operations (e.g., VM:View, VM:Create_Snapshot, VM:Launch_Console, Alert:Acknowledge).
2. Entity Types: The types of resources the permissions apply to (e.g., Virtual Machines, Subnets, Recovery Plans).
3. Entity Scope (Category Filtering): Restricts the execution of the selected operations strictly to entities tagged with specific Categories.

[!TIP] Practical Example: An administrator can create a custom role titled DevOps-Lead. The role is granted VM:Power_Cycle and VM:Take_Snapshot permissions, but its scope is constrained strictly to the category Environment:Development. Users assigned this role can freely reboot development virtual machines, but they cannot view, modify, or reboot any virtual machines categorized under Environment:Production.

---

3. External Directory Services Integration

Relying on local user accounts on individual Nutanix clusters introduces severe operational and security liabilities, including password sprawl, lack of centralized credential revocation, and non-compliance with enterprise identity standards. Nutanix mandates integrating with centralized Directory Services.

Supported Directory Types & Network Protocols

Nutanix Prism natively supports two major enterprise directory protocols:

• Microsoft Active Directory (AD)
• OpenLDAP (and compatible directory services)

To safeguard sensitive credentials transmitted across enterprise networks, administrators must select secure communication protocols:

Directory Service Configuration Parameters

Navigating to Settings > Directory Services in Prism Element or Prism Central allows administrators to configure the identity provider by defining:

1. Directory Name & Type: Descriptive identifier and selection of Active Directory vs. OpenLDAP.
2. Directory URL: The secure URI pointing to the Domain Controller or LDAP server (e.g., ldaps://dc01.corp.example.com:636). Multiple URLs can be entered for domain controller redundancy.
3. Service Account (Bind DN): A dedicated domain service account and password used by Nutanix to perform directory lookups (e.g., CN=svc-nutanix,OU=ServiceAccounts,DC=corp,DC=example,DC=com).
4. User Search Base: The Distinguished Name (DN) of the container or organizational unit (OU) where user objects reside (e.g., OU=Employees,DC=corp,DC=example,DC=com).
5. User Search Filter: The LDAP query string used to match user login names, typically (&(objectClass=user)(sAMAccountName={0})) for Active Directory or (&(objectClass=inetOrgPerson)(uid={0})) for OpenLDAP.
6. Group Search Base & Filter: The DN where security groups reside, enabling group membership resolution via attributes such as member or memberOf.
7. SSL Certificate Chain: When configuring LDAPS, the enterprise root and intermediate CA certificates must be uploaded to validate the domain controller's identity and prevent man-in-the-middle (MITM) attacks.

---

4. Role Mapping and Identity Federation

Configuring the directory connection merely establishes authentication (verifying that a user's password is correct). To enforce authorization (determining what actions that user can perform), administrators configure Role Mapping.

Mapping Directory Groups to Nutanix Roles

Rather than mapping individual user accounts—which creates heavy administrative overhead when personnel join, leave, or change roles—administrators map centralized enterprise Active Directory Security Groups directly to Nutanix roles:

+-------------------------------------------------------------------------+
|                     Active Directory Domain Controller                  |
|                                                                         |
|   +--------------------------+         +--------------------------+     |
|   | Security Group:          |         | Security Group:          |     |
|   | "Nutanix-Cluster-Admins" |         | "Nutanix-Tier1-Support"  |     |
|   +--------------------------+         +--------------------------+     |
+-----------------+-----------------------------------+-------------------+
                  |                                   | (LDAPS / TCP 636)
                  v                                   v
+-------------------------------------------------------------------------+
|                     Nutanix Role Mapping Engine                         |
|                                                                         |
|   Active Directory Group               Mapped Nutanix Role              |
|   ----------------------------         ----------------------------     |
|   CN=Nutanix-Cluster-Admins    ====>   Cluster Admin (Full Control)     |
|   CN=Nutanix-Tier1-Support     ====>   Viewer (Read-Only)               |
|   CN=DevOps-Engineers          ====>   Custom Role: Dev-VM-Operator     |
|                                        (Scoped: Environment:Dev)        |
+-------------------------------------------------------------------------+

Authorization Evaluation and Multi-Group Membership

When an enterprise user authenticates against Prism:

1. The user enters their corporate credentials (jdoe@corp.example.com or jdoe).
2. Prism binds to the configured Domain Controller over LDAPS (port 636), verifies the password, and queries the user's group memberships via memberOf.
3. Prism evaluates the returned groups against its local role mapping table.
4. Cumulative Permissions Model: If a user belongs to multiple mapped groups (for example, one group mapped to Viewer and another mapped to Cluster Admin), Nutanix evaluates permissions using a union / cumulative model. The user is granted the highest level of administrative privilege (Cluster Admin).

Break-Glass Local Administrative Access

While federated directory authentication is standard for daily operations, external dependencies introduce risks: domain controllers may become unreachable due to network partition, DNS failures, or maintenance.

To prevent administrative lockout, Nutanix maintains a built-in local admin account stored directly inside the local cluster metadata. This account serves as an emergency "break-glass" mechanism, enabling infrastructure engineers to authenticate and resolve connectivity or domain controller issues directly on the cluster.