Role Based Access Control – RBAC.  Basically whenever we would like to create user in Netapp cluster mode, Create a role and assign capabilities. Map roles to users.

As you see above screen based on Access level we add capabilities to role and map created role to group. Create users and add them to group so that assigned capabilities will be applicable to members of group. Above mentioned role based access control is applicable only in 7-Mode DATA ONTAP. 

In DATA ONTAP Cluster mode groups are eliminated. We just create an role and assign role directly to user.

Creating Role and assign capabilities – Role Based Access Control

ArkCluster::> security login role create -role AdminRole -vserver ArkCluster -cmddirname "volume" -access all

above command will create role called AdminRole and assign volume directory permission so that AdminRole can only execute volume level command

ArkCluster::> security login role show -vserver ArkCluster -role AdminRole
 Role Command/ Access
Vserver Name Directory Query Level
---------- ------------- --------- ----------------------------------- --------
ArkCluster AdminRole DEFAULT none
ArkCluster AdminRole volume all

2 entries were displayed.

To create role with all the privileges like admin we have to enable DEFAULT all. To modify the role we have to use below command

Modify Role

ArkCluster::> security login role modify -role AdminRole -cmddirname "DEFAULT" all

Delete Role

Below command will delete capability volume from role AdminRole

ArkCluster::> security login role delete -role AdminRole -cmddirname volume -vserver ArkCluster
ArkCluster::> security login role show
 Role Command/ Access
Vserver Name Directory Query Level
---------- ------------- --------- ----------------------------------- --------
ArkCluster AdminRole DEFAULT all
ArkCluster AdminRole security login password all

Create User and Assign role

Users are segregated into 8 types in Netapp Cluster mode to simplify there purpose

• Console – To access console
• http – To access via web using browser GUI
• ontapi – To access via system manager application 
• rsh – To access using RSH protocol (Prefer to collect perf data)
• service-processor – To get service processor access here there is no -Vserver name required (SP/RLM)
• snmp – SNMP access per monitoring Netapp
• ssh – Access filer via SSH (CLI)
• telnet – Telnet is an old technology which is not secure but still we can access Netapp node via telnet (CLI)

ArkCluster::> security login create ravi -application ssh -authmethod password -role AdminRole -vserver ArkCluster -comment "Ravi Netapp Admin"

Please enter a password for user 'ravi':
Please enter it again:

Above command will create an user ravi and assign role AdminRole in vserver ArkCluster

User authentication can be multiple types

• cert – SSL certificate authentication
• community – SNMP community strings
• domain – Active Directory authentication
• nsswitch – LDAP or NIS authentication
• password – Password
• publickey – Public-key authentication
• usm – SNMP user security model. Refer to “security snmpusers” man page for more details.

Delete User

ArkCluster::> security login delete -user-or-group-name ravi -application ssh -authmethod password -vserver ArkCluster

Warning: Unable to list entries on node ArkCluster-01. Database is not open.

ArkCluster::> security login show

Vserver: ArkCluster
 Authentication Acct
User/Group Name Application Method Role Name Locked
---------------- ----------- -------------- ---------------- ------
admin console password admin no
admin http password admin no
admin ontapi password admin no
admin service-processor
 password admin no
admin ssh password admin no
autosupport console password autosupport no

Error: show failed: database is not open
6 entries were displayed.

CLI commands for creating SVM roles

CLI commands for creating cluster roles

 

Conclusion

In Netapp Cluster mode there is no group concept just directly create an role and assign role to user. Capabilities will be added to role.

Related Articles

Adding Cluster ports to Netapp

Data Migration from 7-Mode Netapp to Cluster mode Netapp