Test DriveTCO CalculatorBook Demo

Wildcards and inheritance (*.*, module wildcards)

VMease WebUI supports wildcard-based permissions so administrators can grant broad access without listing every single permission key.

Back to documentation

Wildcards and inheritance (*.*, module wildcards)

Wildcard Types

  1. *.*: Global super-admin wildcard. Grants access across all domains/modules/actions
  2. *.*.read: Global read wildcard. Grants read/view access across all modules that support read
  3. domain.module.* (example: compute.vms.*): Full access within one module. Includes all actions for that module
  4. Pattern wildcards by segment (example styles: compute.*, accesscontrol.*.read): Match permission keys by structure. Useful for grouping related capabilities

Inheritance Behavior

  1. Exact match wins immediately: If the user has the exact required permission, access is granted.
  2. Create implies read (module-level implicit inheritance): If a route checks *.read, and the user has corresponding *.create, read access is treated as granted.
  3. Wildcard pattern matching: If exact and implicit checks do not apply, wildcard patterns are evaluated against the required permission key.

Practical Examples

  1. User has compute.vms.create: Can access compute.vms.read-gated pages (implicit read)
  2. User has networking.firewalls.*: Can access firewall read/create/admin flows
  3. User has *.*.read: Can view pages across domains, but cannot perform write operations unless separately granted
  4. User has *.*: Full platform access (super admin)

Governance Guidance

  1. Use targeted module wildcards (for example networking.firewalls.*) before global wildcards.
  2. Use *.*.read for audit/observer roles that require broad visibility.
  3. Restrict *.* to tightly controlled break-glass or platform-admin roles.
  4. Periodically review wildcard-heavy roles to prevent privilege creep.

Common Misconfiguration Pattern

  1. Admin grants read keys manually but forgets broader wildcard effects from another assigned role.
  2. Result: user appears to have "unexpected access."
  3. Resolution: evaluate effective permissions across all assigned roles, not just one role definition.

Ready to rethink private cloud?

Lower costs. Simplify operations. Deliver more.