Hi, Does anyone have an idea about what minimum permissions is required to connect to ontap? I am using the default readonly role and every read command that I have tried works. However in the auditlogs I keep getting an Insufficient privileges. The Connect-NcController tries to write to a file /etc/powershell. The audit log shows the following : ^M ^M node ^M run ^M controller-a ^M -command ^M wrfile ^M /etc/powershell ^M ; ^M node ^M run ^M controller-a ^M -command ^M wrfile ^M -a ^M /etc/powershell ^M // File generated by the Data ONTAP PowerShell Toolkit: powershell.usagelog.version=1: powershell.usagelog.lastupdated=1644250226: powershell.cmdlet.CONNECTNCCONTROLLER.count=1: powershell.cmdlet.GETNCVOL.count=1: powershell.usagelog.timestamp=1644250226: ^M ^M advanced ^M ^M :: Pending:

nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Connecting to cluster generates a "Insufficient privileges" when using the default readonly role

cc2

Hi,

Does anyone have an idea about what minimum permissions is required to connect to ontap?

I am using the default readonly role and every read command that I have tried works.
However in the auditlogs I keep getting an Insufficient privileges.

The Connect-NcController tries to write to a file /etc/powershell.

The audit log shows the following :

<netapp version='1.0' xmlns='http://www.netapp.com/filer/admin'><system-cli>^M <args>^M <arg>node</arg>^M <arg>run</arg>^M <arg>controller-a</arg>^M <arg>-command</arg>^M <arg>wrfile</arg>^M <arg>/etc/powershell</arg>^M <arg>;</arg>^M <arg>node</arg>^M <arg>run</arg>^M <arg>controller-a</arg>^M <arg>-command</arg>^M <arg>wrfile</arg>^M <arg>-a</arg>^M <arg>/etc/powershell</arg>^M <arg>// File generated by the Data ONTAP PowerShell Toolkit: powershell.usagelog.version=1: powershell.usagelog.lastupdated=1644250226: powershell.cmdlet.CONNECTNCCONTROLLER.count=1: powershell.cmdlet.GETNCVOL.count=1: powershell.usagelog.timestamp=1644250226: </arg>^M </args>^M <priv>advanced</priv>^M </system-cli></netapp>^M :: Pending:

Find more posts tagged with

Powershell Toolkit

Hyper-V

Accepted answers

cc2

For anyone else that has this issue, I found a workaround by setting the variable "$DataONTAP_SkipEmsReport = $true"

All comments

NetApp_SR

Others have had the same question. Please see if the below link helps to answer your question.

https://community.netapp.com/t5/ONTAP-Discussions/PowerShell-user-ReadOnly-does-not-have-write-access-to-this-resource/td-p/429950

cc2

Hi and thank you for your replay.

I have read those suggestions and unfortunatly they do not help.
I am using the readonly role and it has the default command with permission readonly as mentioned in one of those posts.

Here is the permissions from the readonly role if that helps.

Command/ Access
Directory Query Level
--------- ----------------------------------- --------

DEFAULT readonly
security readonly
security login password all
security login publickey all
security login role show-user-capability all
set all

cc2

For anyone else that has this issue, I found a workaround by setting the variable "$DataONTAP_SkipEmsReport = $true"

rjefferis

Hi cc2, sorry could you confirm how/where you are setting that variable please. I am getting the same problem. Thanks

cc2

Hi, rjefferis.

You can just add it in the beginning of your scrip. As long as the variable is set before you connect it should be fine.

$DataONTAP_SkipEmsReport = $true

Connect-NcController -Name "ontapcluster1"

rjefferis

ah ha, sorry! Thanks for the quick reply!! Have a great christmas