### Author:  [@fayaz\_khan](https://forum.opennebula.io/u/fayaz_khan)
#### Post date: [February 20, 2018, 6:57am UTC](https://forum.opennebula.io/t/solved-one-template-instantiate-failed-to-clone-images-not-authorized-to-perform-use-image-0/5731/1 "2018-02-20T06:57:40Z")
hi
i am creating vm in via VDC user .i am facing this issue kindly let me know how to resolve this issue. can any body help me .
[one.template.instantiate] Failed to clone images: Not authorized to perform USE IMAGE [0]
---
### Author:  [@Almero\_Rademeyer](https://forum.opennebula.io/u/Almero_Rademeyer)
#### Post date: [March 28, 2019, 11:33am UTC](https://forum.opennebula.io/t/solved-one-template-instantiate-failed-to-clone-images-not-authorized-to-perform-use-image-0/5731/2 "2019-03-28T11:33:57Z")
I have the same problem . Did you manage to get this resolved ?
---
### Author:  [@ahuertas](https://forum.opennebula.io/u/ahuertas)
#### Post date: [March 28, 2019, 11:40am UTC](https://forum.opennebula.io/t/solved-one-template-instantiate-failed-to-clone-images-not-authorized-to-perform-use-image-0/5731/3 "2019-03-28T11:40:38Z")
Hello @Almero_Rademeyer
If you have a template with images associated, you need to give use permission to the template and also to all the images, so the user can use both.
---
### Author:  [@Almero\_Rademeyer](https://forum.opennebula.io/u/Almero_Rademeyer)
#### Post date: [March 28, 2019, 12:20pm UTC](https://forum.opennebula.io/t/solved-one-template-instantiate-failed-to-clone-images-not-authorized-to-perform-use-image-0/5731/4 "2019-03-28T12:20:58Z")
Hi Yes , I have been applying permissions for two days , even set Admin rights to the user group . Still no success . Here is an extract on the template and user examples \>
onetemplate show 10
TEMPLATE 10 INFORMATION
ID : 10
NAME : cssa-neb-template-win10
USER : oneadmin
GROUP : users
LOCK : None
REGISTER TIME : 03/27 15:20:04
PERMISSIONS
OWNER : uma
GROUP : u–
OTHER : u–
TEMPLATE CONTENTS
CONTEXT=[
NETWORK=“YES”,
SSH\_PUBLIC\_KEY="$USER[SSH\_PUBLIC\_KEY]" ]
CPU=“1”
DESCRIPTION=“Windows 10 Premium”
DISK=[
IMAGE\_ID=“0”,
OPENNEBULA\_MANAGED=“NO” ]
GRAPHICS=[
LISTEN=“0.0.0.0”,
TYPE=“VNC” ]
HYPERVISOR=“vcenter”
INPUTS\_ORDER=""
LOGO=“images/logos/windows8.png”
MEMORY=“4096”
MEMORY\_UNIT\_COST=“MB”
NIC=[
NETWORK\_ID=“0”,
OPENNEBULA\_MANAGED=“NO” ]
OS=[
BOOT="" ]
USER\_INPUTS=[
CPU=“O|fixed|| |1”,
MEMORY=“M|list||4096,6144,8192|4096”,
VCPU=“O|list||1,2,4|1” ]
VCENTER\_CCR\_REF=“domain-c49”
VCENTER\_INSTANCE\_ID=“f8f4fcdb-1361-4de5-a652-2e0ad7ef0018”
VCENTER\_TEMPLATE\_REF=“vm-109”
VCENTER\_VM\_FOLDER=“Nebula”
VCPU=“1”
And the test user using core authentication \>
oneuser show 5
USER 5 INFORMATION
ID : 5
NAME : JDT
GROUP : users
SECONDARY GROUPS: 1,102
PASSWORD : 034b4625c77b5a29719d4c491fec29bff7dd118e
AUTH\_DRIVER : core
ENABLED : Yes
TOKENS
USER TEMPLATE
TOKEN\_PASSWORD=“42f3b4f6ba6c3a3340fd06e4f10852c73c4868f0”
VMS USAGE & QUOTAS
```
VMS MEMORY CPU SYSTEM_DISK_SIZE
0 / 8 0M / 8M 0.00 / 8.00 0M / 8M
```
VMS USAGE & QUOTAS - RUNNING
```
RUNNING VMS RUNNING MEMORY RUNNING CPU
0 / 8 0M / 8M 0.00 / 8.00
```
DATASTORE USAGE & QUOTAS
NETWORK USAGE & QUOTAS
IMAGE USAGE & QUOTAS
```
ID RUNNING VMS
0 0 / 8
```
---
### Author:  [@Almero\_Rademeyer](https://forum.opennebula.io/u/Almero_Rademeyer)
#### Post date: [March 28, 2019, 12:23pm UTC](https://forum.opennebula.io/t/solved-one-template-instantiate-failed-to-clone-images-not-authorized-to-perform-use-image-0/5731/5 "2019-03-28T12:23:36Z")
I just tested while tailing oned.log , it clearly states access denied
Thu Mar 28 12:17:53 2019 [Z0][ReM][D]: Req:2304 UID:5 one.template.info invoked , 10, true
Thu Mar 28 12:17:53 2019 [Z0][ReM][E]: Req:2304 UID:5 one.template.info result FAILURE [one.template.info] User [5] : Not authorized to perform USE IMAGE [0].
Thu Mar 28 12:17:56 2019 [Z0][ReM][D]: Req:240 UID:0 one.zone.raftstatus invoked
Thu Mar 28 12:17:56 2019 [Z0][ReM][D]: Req:240 UID:0 one.zone.raftstatus result SUCCESS, “\-1\<…”
---
### Author:  [@ahuertas](https://forum.opennebula.io/u/ahuertas)
#### Post date: [March 28, 2019, 1:11pm UTC](https://forum.opennebula.io/t/solved-one-template-instantiate-failed-to-clone-images-not-authorized-to-perform-use-image-0/5731/6 "2019-03-28T13:11:49Z")
Could yo please send me the output of `oneimage show 0`?
---
### Author:  [@Almero\_Rademeyer](https://forum.opennebula.io/u/Almero_Rademeyer)
#### Post date: [April 1, 2019, 4:47am UTC](https://forum.opennebula.io/t/solved-one-template-instantiate-failed-to-clone-images-not-authorized-to-perform-use-image-0/5731/7 "2019-04-01T04:47:23Z")
Hi There , as expected it appears there is no 0 .
onetemplate show 0
[one.template.info] Error getting virtual machine template [0].
---
### Author:  [@ahuertas](https://forum.opennebula.io/u/ahuertas)
#### Post date: [April 1, 2019, 7:06am UTC](https://forum.opennebula.io/t/solved-one-template-instantiate-failed-to-clone-images-not-authorized-to-perform-use-image-0/5731/8 "2019-04-01T07:06:14Z")
Hi @Almero_Rademeyer
I meant the image, no the template, the command is `oneimge show 0`.
---
### Author:  [@Almero\_Rademeyer](https://forum.opennebula.io/u/Almero_Rademeyer)
#### Post date: [April 1, 2019, 7:38am UTC](https://forum.opennebula.io/t/solved-one-template-instantiate-failed-to-clone-images-not-authorized-to-perform-use-image-0/5731/9 "2019-04-01T07:38:06Z")
Hi there , i re deployed vONE appliance to get a clean start .
Attached is the new windows 10 template . I noticed I have to add my individual users to oneadmin group to deploy . So i guess I would need a separate template for each user group
IMAGE 0 INFORMATION
ID : 0
NAME : cssa-neb-template-win10 - CSSA-STB-ESX-99-LOCAL [template 1]
USER : oneadmin
GROUP : oneadmin
LOCK : None
DATASTORE : CSSA-STB-ESX-99-LOCAL(IMG)
TYPE : OS
REGISTER TIME : 04/01 06:12:58
PERSISTENT : No
SOURCE : cssa-neb-template-win10/cssa-neb-template-win10.vmdk
PATH : vcenter://cssa-neb-template-win10/cssa-neb-template-win10.vmdk
SIZE : 25G
STATE : rdy
RUNNING\_VMS : 0
PERMISSIONS
OWNER : um-
GROUP : —
OTHER : —
IMAGE TEMPLATE
DEV\_PREFIX=“sd”
VCENTER\_IMPORTED=“YES”
VIRTUAL MACHINES
---
### Author:  [@ahuertas](https://forum.opennebula.io/u/ahuertas)
#### Post date: [April 1, 2019, 7:40am UTC](https://forum.opennebula.io/t/solved-one-template-instantiate-failed-to-clone-images-not-authorized-to-perform-use-image-0/5731/10 "2019-04-01T07:40:08Z")
Hi @Almero_Rademeyer
You don’t need to add your user to the oneadmin group. You just need to give **use** permission to **others** on that image.
---
### Author:  [@Almero\_Rademeyer](https://forum.opennebula.io/u/Almero_Rademeyer)
#### Post date: [April 1, 2019, 7:50am UTC](https://forum.opennebula.io/t/solved-one-template-instantiate-failed-to-clone-images-not-authorized-to-perform-use-image-0/5731/11 "2019-04-01T07:50:17Z")
Then I am missing a step .
Below is a screenshot of the test user for POC . ( as seen by CloudAdmin )
And when I test with a new user called JDT I still get access denied to image 0
---
### Author:  [@ahuertas](https://forum.opennebula.io/u/ahuertas)
#### Post date: [April 1, 2019, 7:51am UTC](https://forum.opennebula.io/t/solved-one-template-instantiate-failed-to-clone-images-not-authorized-to-perform-use-image-0/5731/12 "2019-04-01T07:51:27Z")
Because, your template has an image associated, so the user needs use permission on that image too, you have to go to the image and give that use permission.
---
### Author:  [@Almero\_Rademeyer](https://forum.opennebula.io/u/Almero_Rademeyer)
#### Post date: [April 1, 2019, 7:55am UTC](https://forum.opennebula.io/t/solved-one-template-instantiate-failed-to-clone-images-not-authorized-to-perform-use-image-0/5731/13 "2019-04-01T07:55:24Z")
THANK YOU VERY MUCH , that was the missing step . Your excellent support will go a long way for me to motivate us getting paid for support for vONE .
---
### Author:  [@ahuertas](https://forum.opennebula.io/u/ahuertas)
#### Post date: [April 1, 2019, 7:57am UTC](https://forum.opennebula.io/t/solved-one-template-instantiate-failed-to-clone-images-not-authorized-to-perform-use-image-0/5731/14 "2019-04-01T07:57:18Z")
Nice! And remember, this case is the same for NICS, if you have any NIC in your template, you need to give use permission to others.
---
### Author:  [@devops](https://forum.opennebula.io/u/devops)
#### Post date: [February 14, 2020, 6:12am UTC](https://forum.opennebula.io/t/solved-one-template-instantiate-failed-to-clone-images-not-authorized-to-perform-use-image-0/5731/15 "2020-02-14T06:12:00Z")
Hi, I’m just getting started with open nebula and I’m running into the issue mentioned by @ahuertas for NIC permissions but can’t find the correct settings for NICs.
My error is “[one.template.instantiate] User [10] : User Template includes a restricted attribute NIC.”
Tried the following:
commenting out this line from oned.conf based on another thread - #VM\_RESTRICTED\_ATTR = “NIC/MAC”
removing the NIC from the template and adding on deployment
Went thru permissions and settings for the template and image and tried finding the info in the docs but no luck so far.
Thanks in advance for your help.
---
### Author:  [@ahuertas](https://forum.opennebula.io/u/ahuertas)
#### Post date: [February 14, 2020, 8:32am UTC](https://forum.opennebula.io/t/solved-one-template-instantiate-failed-to-clone-images-not-authorized-to-perform-use-image-0/5731/16 "2020-02-14T08:32:14Z")
Hello @devops
[Restricted attributes](http://docs.opennebula.org/5.10/operation/references/template.html?highlight=restricted#restricted-attributes) are attributes that can be only changed by oneadmin user (or users that belong to that group)
If you try to instantiate a template modifying some of that attributes as a normal user you get that error.
So please, check that user 10 is not changing any restricted attribute when instantiating the VM template. If you want that the user can modify it, comment the restricted attribute in the oned.conf file.
Best,
Álex.
---
### Author:  [@devops](https://forum.opennebula.io/u/devops)
#### Post date: [February 27, 2020, 10:16pm UTC](https://forum.opennebula.io/t/solved-one-template-instantiate-failed-to-clone-images-not-authorized-to-perform-use-image-0/5731/17 "2020-02-27T22:16:53Z")
Hi Alex,
Thanks for the quick response. I made these changes in oned.conf and restarted the service:
#VM\_RESTRICTED\_ATTR = “NIC/MAC”
#VM\_RESTRICTED\_ATTR = “NIC/VCENTER\_INSTANCE\_ID”
#VM\_RESTRICTED\_ATTR = “NIC/VCENTER\_NET\_REF”
#VM\_RESTRICTED\_ATTR = “NIC/VCENTER\_PORTGROUP\_TYPE”
#VM\_RESTRICTED\_ATTR = “DISK/OPENNEBULA\_MANAGED”
#VM\_RESTRICTED\_ATTR = “DISK/VCENTER\_DS\_REF”
#VM\_RESTRICTED\_ATTR = “DISK/VCENTER\_INSTANCE\_ID”
#VM\_RESTRICTED\_ATTR = “DISK/SIZE”
#VM\_RESTRICTED\_ATTR = “RANK”
#VM\_RESTRICTED\_ATTR = “SCHED\_RANK”
#VM\_RESTRICTED\_ATTR = “REQUIREMENTS”
#VM\_RESTRICTED\_ATTR = “SCHED\_REQUIREMENTS”
#IMAGE\_RESTRICTED\_ATTR = “SOURCE”
#IMAGE\_RESTRICTED\_ATTR = “VCENTER\_IMPORTED”
My user account is still not able to create a VM.
[one.template.instantiate] User [10] : User Template includes a restricted attribute NIC.
I can deploy the VM as oneadmin and assign it to my user account. My user account can see the VM, so I powered it off and tried to save it as a new template but still getting error:
[one.template.update] Cannot update template. User Template includes a restricted attribute NIC
Any help you can offer will be greatly appreciated.
Thank you.
---
### Author:  [@ahuertas](https://forum.opennebula.io/u/ahuertas)
#### Post date: [March 4, 2020, 5:27pm UTC](https://forum.opennebula.io/t/solved-one-template-instantiate-failed-to-clone-images-not-authorized-to-perform-use-image-0/5731/18 "2020-03-04T17:27:19Z")
Hello @devops
Could you please share your VM Template (`onetemplate show -x`) and your user info (`oneuser show -x`)?
Best,
Álex.