PowerScale OneFS 9.8.0.0 Web Administration Guide

Privileges

Privileges permit users to complete tasks on a cluster.

Privileges are associated with an area of cluster administration such as Job Engine, SMB, Quotas, or statistics. Privileges enable you to control the actions that a user or role can perform within a particular area of cluster administration.

In OneFS 9.3.0.0 and later, privileges are granular: each area of cluster administration is associated with a top-level privilege, the feature or parent privilege. Each parent privilege can have one or more subprivileges, which can also have subprivileges. Granular privileges enable you to control the specific actions that a user can perform within a cluster administration area in a detailed way.

For example, the feature-level (parent) privilege ISI_PRIV_QUOTA enables monitoring and enforcing storage limits. Grant entity-level privileges (subprivileges) to control the specific quota management-related actions that a user or role can perform. Grant attribute-level privileges to control access to specific properties of quota management-related actions, including management, tracking, and limiting storage of an entity or directory, or configuring the ratio of logical space to physical space.

Grant the feature-level privilege first. Granting the feature-level privilege to a user or role grants all privileges, subprivileges, and permissions associated with that privilege. Granting subprivileges is optional. Grant subprivileges to restrict or fine-tune the access and activities allowed to users or roles. If a subprivilege also has subprivileges, grant the parent subprivilege before you grant the lower-level subprivileges. Subprivileges cannot be higher than their parent privilege or subprivilege.

Privileges have the following forms:

Write (w)

Grants write, execute, and read access privileges to a role or user. Allows a role or user to view, create, modify, and delete a configuration subsystem such as statistics, snapshots, or quotas. For example, the ISI_PRIV_QUOTA privilege with write permission allows an administrator to create, schedule, and run quota reports and to configure quota notification rules. Write permission allows performing the API operations GET, PUT, POST, and DELETE.

Execute (x)

Grants execute and read access privileges to a role or user. Allows a role or user to initiate API operations such as PUT, POST or Delete for specific URIs on a configuration subsystem without granting write privileges to that role or user. The specific URIs on which execute privileges can be granted do not perform write operations. The specific URIs are /sync/policies/<POLICY>, /sync/jobs, /sync/jobs/<JOB>, /sync/policies/<POLICY>/reset, and /sync/rules/<RULE>.

Read (r)

Grants the read access privilege to a role or user. Allows a role or user to view a configuration subsystem. The role or user cannot modify configuration settings. Read permission allows performing the API operation GET.

No permission (-)

The privilege is not granted to the role or user. The role or user has no access to the privilege.

Privileges are granted to the user on login to a cluster through the OneFS API, the web administration interface, SSH, or a console session. A token is generated for the user that includes a list of all privileges that are granted to that user. Each URI, web-administration interface page, and command requires a specific privilege to view or modify the information available through any of these interfaces.

Sometimes, privileges cannot be granted or there are privilege limitations.

• Privileges are not granted to users that do not connect to the System Zone during login or to users that connect through the deprecated Telnet service, even if they are members of a role.
• Privileges do not provide administrative access to configuration paths outside of the OneFS API. For example, the ISI_PRIV_SMB privilege does not grant a user the right to configure SMB shares using the Microsoft Management Console (MMC).
• Privileges do not provide administrative access to all log files. Most log files require root access.
• Privileges can be denied to users and roles using No permission.

The privilege ISI_PRIV_RESTRICTED_AUTH and its subprivileges ISI_PRIV_RESTRICTED_AUTH_GROUPS and ISI_PRIV_RESTRICTED_AUTH_USERS provide limited administrative privileges for groups and users. Administrators with the ISI_PRIV_RESTRICTED_AUTH privilege can modify only those groups and users with the same or less privilege as the administrator. Administrators with the ISI_PRIV_RESTRICTED_AUTH_GROUPS or ISI_PRIV_RESTRICTED_AUTH_USERS privileges can modify only those groups or users with the same privilege as the administrator. For example, you can grant the ISI_PRIV_RESTRICTED_AUTH privilege to a help desk administrator to perform basic user management operations without having the full abilities of the ISI_PRIV_AUTH privilege.