RBAC over RestRoles

klmi

HI all,

we are currently in the phase to switchover from ontapi to Rest-API.
For some regulations, we need to use RBAC, so that special AD-Groups/User get reduced API-Access to the vserver.

We need a role for Snapshot-Management (Backup Application), so this user only can create/delete snapshots on the vserver.

So far i can only get it working with giving RestAccess to API  /api/storage/volumes, but this would also give rights to create/destroy volumes and more.

I tried to create a more strict role, but it doesnot work.

Ontap_98::> security login rest-role create -vserver <vserver> -role rest_snapadmin -api /api/storage/volumes/{volume.uuid}/snapshots -access all

Error: command failed: Invalid character detected in URI.

Has anybody an Idea, how to restirct the Access to snapshot only operations with REST-API?

Best Regards,

Klaus

mbeattie

Hi Klaus,

Whilst it's not currently possible to delegate permissions using the 'security login rest-role create' command you can use the traditional method as follows:

security login role create -role snapadmin -cmddirname "volume snapshot" -access all -query "-vserver vserver1 -volume cifs_data_001"

vserver services web access create -name rest -role snapadmin -vserver cluster1

security login create snapadmin -application http -authentication-method password -role snapadmin

curl -ku snapadmin:<password> -X GET "https://192.168.100.2/api/storage/volumes/4a8e36e3-2861-11eb-9071-0050568028c9/snapshots"

{
  "records": [
    {
      "uuid": "b43de933-4b7f-4bcd-b51d-b759b0752a4a",
      "name": "snapmirror.1b2e97b3-285c-11eb-9660-00505680d956_2150679890.2020-11-16_224256",
      "_links": {
        "self": {
          "href": "/api/storage/volumes/4a8e36e3-2861-11eb-9071-0050568028c9/snapshots/b43de933-4b7f-4bcd-b51d-b759b0752a4a"
        }
      }
    },
    {
      "uuid": "8c3ace7d-2b99-4dbe-b05c-f954ed37547c",
      "name": "snapmirror.1b2e97b3-285c-11eb-9660-00505680d956_2150679890.2020-11-19_020943",
      "_links": {
        "self": {
          "href": "/api/storage/volumes/4a8e36e3-2861-11eb-9071-0050568028c9/snapshots/8c3ace7d-2b99-4dbe-b05c-f954ed37547c"
        }
      }
    }
  ],
  "num_records": 2,
  "_links": {
    "self": {
      "href": "/api/storage/volumes/4a8e36e3-2861-11eb-9071-0050568028c9/snapshots"
    }
  }

Note: if you ever renamed the volume you'd also need to update the name in the 'query':

security login role create -role snapadmin -cmddirname "volume snapshot" -access all -query "-vserver vserver1 -volume cifs_data_001"

Hope that helps

/Matt