Posted by: Texiwill
We all know that the VMware Infrastructure Client (VI Client) connects to either a VMware vCenter Server, VMware ESX host, or a VMware ESXi host. There is confusion on which users or users is used to run all commands issued by the VI Client either directly or indirectly through vCenter.
For example, when you join a VMware ESX host to vCenter you must enter the root username and password. Any username and password can be used as long as that username is a member of the administrator role that exists on every VMware ESX host by default. With a standard install, the root user is the only member of the administrator role.
The roles and permissions within the VI Client do not necessarily map to users and groups within the service console or management appliance. Roles and permissions are quite a bit different actually and do not always map one to one.
When you directly connect the VI Client to a VMware ESX or VMware ESXi host you will use a local username and password to log in. But after that, all actions depend on your roles and permissions within the VI Client. The VI Client does not run any command as the user to which you logged in. Instead it runs those commands you are entitled to run as the root user. Since the root user is also the super user, it can run any command available to the system. This translation happens automatically as the vmware-hostd daemon runs as the root user.
The same happens when you log in using the VI Client to VMware vCenter Server. VMware vCenter Server uses the vpxuser to contact the vmware-hostd daemon which in turn runs all the necessary commands as the root user.
For a direct connection, a user must exist on the VMware ESX or VMware ESXi host, but for an indirect connection, no user must exist on the hosts. This implies that when you use vCenter there is no real need to manage multiple user account systems. Unfortunately, in reality you often have to have users on your VMware ESX and VMware ESXi hosts to perform support actions.
The use of the root user also implies several other things. The current permissions granularity that you set up for files and directories within the VMware ESX and VMware ESXi hosts is ignored. Roles and permissions are not that granular yet. In other words, if you want to restrict a user from accessing a specific ISO. While I can set that up for specific users within the host, I can not set this up for specific users once the VI Client is employed. I lose some granularity when using the VI Client.