Creating a Restricted Administrator for ONTAP Cluster Mode

When adding ONTAP cluster mode, an admin role is required soDataCore vFilO has access to the required ONTAP APIs. The default cluster mode admin role can be used, however in some situations this may present a security concern.

The following steps will create an ONTAP cluster admin role that provides read-only access to only the APIs DataCore vFilO needs.

  1. Log in to your ONTAP cluster as a cluster admin user
  2. Run the following commands from the ONTAP command line (copy/paste friendly):

    security login role create -role DataCore vFilO -vserver C-Mode-PM1 -access none -cmddirname DEFAULT

    security login role create -role DataCore vFilO -vserver C-Mode-PM1 -access readonly -cmddirname "vserver show"

    security login role create -role DataCore vFilO -vserver C-Mode-PM1 -access readonly -cmddirname "cluster show"

    security login role create -role DataCore vFilO -vserver C-Mode-PM1 -access readonly -cmddirname "volume show"

    security login role create -role DataCore vFilO -vserver C-Mode-PM1 -access readonly -cmddirname "cluster identity show"

    security login role create -role DataCore vFilO -vserver C-Mode-PM1 -access readonly -cmddirname "network interface show"

    security login role create -role DataCore vFilO -vserver C-Mode-PM1 -access readonly -cmddirname "system license show"

    security login role create -role DataCore vFilO -vserver C-Mode-PM1 -access readonly -cmddirname "storage aggregate show"

    security login role create -role DataCore vFilO -vserver C-Mode-PM1 -access readonly -cmddirname "version"

    security login role create -role DataCore vFilO -vserver C-Mode-PM1 -access readonly -cmddirname "system node show"

    security login role create -role DataCore vFilO -vserver C-Mode-PM1 -access readonly -cmddirname "volume qtree show"

    security login role create -role DataCore vFilO -vserver C-Mode-PM1 -access readonly -cmddirname "system node autosupport show”

    security login role create -role DataCore vFilO -vserver C-Mode-PM1 -access readonly -cmddirname "security login role show-ontapi"

    These commands will create warning messages that they are automatically setting up additional permissions, this is expected.

  3. To verify the role is created correctly run:

    security login role show -role DataCore vFilO -vserver C-Mode-PM1

    cluster identity modify readonly

    cluster identity show readonly

    cluster modify readonly

    cluster show readonly

    network interface create readonly

    network interface delete readonly

    network interface modify readonly

    network interface show readonly

    security login role show-ontapi readonly

    storage aggregate create readonly

    storage aggregate modify readonly

    storage aggregate show readonly

    system license delete readonly

    system license show readonly

    system node autosupport modify readonly

    system node autosupport show readonly

    system node modify readonly

    system node show readonly

    version readonly

    volume create readonly

    volume modify readonly

    volume qtree create readonly

    volume qtree show readonly

    volume show readonly

    vserver create readonly

    vserver modify readonly

    vserver show readonly

    28 entries were displayed.

  4. Create a new user with the DataCore vFilO role:

    security login create -user-or-group-name DataCore vFilO_admin -application ontapi -authentication-method password -role DataCore vFilO

    Enter a password when prompted

  5. You can now add the ONTAP cluster as a storage node to DataCore vFilO using the restricted cluster admin user credentials.