nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

powershell invoke-ncsystemapi and CLI differ for the same user

MORAYHOONDERT

When connecting over an SSH-connection, the user: readonly_cl_user can see the tiering-minimum-cooling-days.

::> set d

Warning: These diagnostic commands are for use by NetApp personnel only.

Do you want to continue? {y|n}: y

::*> volume show -fields tiering-minimum-cooling-days

vserver volume tiering-minimum-cooling-days

-------- -------- ----------------------------

nct_cifs02 sns004_cifs_vol01 30

nct_cifs02 sns004_cifs_vol02 30

nct_cifs02 sns004_cifs_vol03 30

nct_cifs02 sns004_cifs_vol04 30

BUT:

When running the command from powershell, with invoke-ncsystemapi. It says:

PS H:\> Invoke-NcSystemApi -Request $api -ErrorAction Stop

Invoke-NcSystemApi : Insufficient privileges: user 'readonly_cl_user' does not have write access to this

At line:1 char:2

+ Invoke-NcSystemApi -Request $api -ErrorAction Stop

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : InvalidOperation: (ncu:NcController) [Invoke-NcSystemApi], EAPIPRIVILEGE

+ FullyQualifiedErrorId : ApiException,DataONTAP.C.PowerShell.SDK.Cmdlets.System.InvokeNcSystemApi

PRIVILEGES IN THE ROLE ARE:

::> security login role show -vserver xxx

readonly_cl DEFAULT readonly
metrocluster check run all
set all
system all

MY QUESTION IS: WHAT privilege do I need to create for WHICH command on the CLI to make it work in Powershell over the invoke-ncsystemapi-command?

thank you in advance !

Moray

Find more posts tagged with

Accepted answers

mbeattie

Hi Moray,

You can view the Swagger UI for ONTAP in a browser using: https://<%cluster%>/docs/api

Browse the Swagger UI and look for /storage/volume. Here is an example to query the tiering minimum cooling days for all volumes on a cluster:

Param(
   [Parameter(Mandatory = $True, HelpMessage = "The Cluster name or IP Address")]
   [String]$Cluster,
   [Parameter(Mandatory = $True, HelpMessage = "The Credentials to authenticate to the destination cluster")]
   [System.Management.Automation.PSCredential]$Credential
)
#'------------------------------------------------------------------------------
#'Set the certificate policy and TLS version.
#'------------------------------------------------------------------------------
Add-Type @"
   using System.Net;
   using System.Security.Cryptography.X509Certificates;
   public class TrustAllCertsPolicy : ICertificatePolicy {
   public bool CheckValidationResult(
   ServicePoint srvPoint, X509Certificate certificate,
   WebRequest request, int certificateProblem) {
      return true;
   }
}
"@
[System.Net.ServicePointManager]::SecurityProtocol  = [System.Net.SecurityProtocolType]'Tls12'
[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy
#'------------------------------------------------------------------------------
Function Get-NcAuthorization{
   [Alias("Get-NcAuth")]
   [CmdletBinding()]
   Param(
      [Parameter(Mandatory = $True, HelpMessage = "The Credential to authenticate to the cluster")]
      [ValidateNotNullOrEmpty()]
      [System.Management.Automation.PSCredential]$Credential
   )
   #'---------------------------------------------------------------------------
   #'Set the authentication header to connect to the cluster.
   #'---------------------------------------------------------------------------
   $auth    = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($Credential.UserName + ':' + $Credential.GetNetworkCredential().Password))
   $headers = @{
      "Authorization" = "Basic $auth"
      "Accept"        = "application/json"
      "Content-Type"  = "application/json"
   }
   Return $headers;
}#'End Function Get-NcAuthorization.
#'------------------------------------------------------------------------------
#'Enumerate the volume tiering minimum cooling days for all volumes on the cluster.
#'------------------------------------------------------------------------------
$headers = Get-NcAuth -Credential $Credential
$url     = "https://$Cluster/api/storage/volumes?fields=tiering.min_cooling_days"
Try{
   $response = Invoke-RestMethod -Method GET -Uri $Url -Headers $headers -ErrorAction Stop
}Catch{
   Write-Warning -Message $("Failed Invoking Private CLI using URL ""$Url"". Error " + $_.Exception.Message)
   Break;
}
If($Null -ne $response){
   $response.records
}Else{
   Write-Host "No records returned"
}
#'------------------------------------------------------------------------------

To enumerate values not available via the REST API you can also use the private CLI via the REST API to invoke a CLI command.

Param(
   [Parameter(Mandatory = $True, HelpMessage = "The URL of the private CLI to invoke")]
   [String]$Url,
   [Parameter(Mandatory = $True, HelpMessage = "The destination cluster name or IP Address")]
   [ValidateSet("GET","PATCH","POST","DELETE")]
   [String]$Method,
   [Parameter(Mandatory = $True, HelpMessage = "The Credentials to authenticate to the destination cluster")]
   [System.Management.Automation.PSCredential]$Credential
)
#'------------------------------------------------------------------------------
#'Set the certificate policy and TLS version.
#'------------------------------------------------------------------------------
Add-Type @"
   using System.Net;
   using System.Security.Cryptography.X509Certificates;
   public class TrustAllCertsPolicy : ICertificatePolicy {
   public bool CheckValidationResult(
   ServicePoint srvPoint, X509Certificate certificate,
   WebRequest request, int certificateProblem) {
      return true;
   }
}
"@
[System.Net.ServicePointManager]::SecurityProtocol  = [System.Net.SecurityProtocolType]'Tls12'
[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy
#'------------------------------------------------------------------------------
Function Get-NcAuthorization{
   [Alias("Get-NcAuth")]
   [CmdletBinding()]
   Param(
      [Parameter(Mandatory = $True, HelpMessage = "The Credential to authenticate to the cluster")]
      [ValidateNotNullOrEmpty()]
      [System.Management.Automation.PSCredential]$Credential
   )
   #'---------------------------------------------------------------------------
   #'Set the authentication header to connect to the cluster.
   #'---------------------------------------------------------------------------
   $auth    = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($Credential.UserName + ':' + $Credential.GetNetworkCredential().Password))
   $headers = @{
      "Authorization" = "Basic $auth"
      "Accept"        = "application/json"
      "Content-Type"  = "application/json"
   }
   Return $headers;
}#'End Function Get-NcAuthorization.
#'------------------------------------------------------------------------------
Function Invoke-OntapCommand{
   [CmdletBinding()]
   Param(
      [Parameter(Mandatory = $True, HelpMessage = "The URL of private CLI to invoke")]
      [String]$Url,
      [Parameter(Mandatory = $True, HelpMessage = "The destination cluster name or IP Address")]
      [ValidateSet("GET","PATCH","POST","DELETE")]
      [String]$Method,
      [Parameter(Mandatory = $True, HelpMessage = "The Credentials to authenticate to the destination cluster")]
      [System.Management.Automation.PSCredential]$Credential
   )
   #'---------------------------------------------------------------------------
   #'Invoke the Private CLI command.
   #'---------------------------------------------------------------------------
   $headers = Get-NcAuth -Credential $Credential
   Try{
      $response = Invoke-RestMethod -Method GET -Uri $Url -Headers $headers -ErrorAction Stop
   }Catch{
      Write-Warning -Message $("Failed Invoking Private CLI using URL ""$Url"". Error " + $_.Exception.Message)
      Return $Null;
   }
   Return $response
}
#'End Function Invoke-OntapCommand.
#'------------------------------------------------------------------------------
#'Display the response.
#'------------------------------------------------------------------------------
$response = Invoke-OntapCommand -Url $Url -Method $Method -Credential $credential
If($Null -ne $response){
   $response.records
}Else{
   Write-Host "No records returned"
}
#'------------------------------------------------------------------------------

EG:

PS C:\Scripts\PowerShell\Projects\InvokeOntapCommand> .\InvokeOntapCommand.ps1 -Url "https://192.168.100.200/api/private/cli/volume?fields=tiering-minimum-cooling-days" -Method GET -Credential $credential

I suspect you will have similar issues enumerating the information from the REST API though as your issue appears to be related to roles\permissions

/Matt

All comments

mbeattie

Hi Moray,

You can set the diag privilege level in the command. Have a look at this example (browse down)

EG something like this ...

[Array]$command = @("set diag;volume", "show", "-fields", "tiering-minimum-cooling-days")
Try{
   $api = $("<system-cli><args><arg>" + ($command -join "</arg><arg>") + "</arg></args></system-cli>")
   Write-Host $("Executed Command`: " + $([String]::Join(" ", $command)))
   $output = Invoke-NcSystemApi -Request $api -ErrorAction Stop
}Catch{
   Write-Warning -Message $("Failed Executing Command`: " + $([String]::Join(" ", $command))
   Break;
}

Hope that helps

/Matt

MORAYHOONDERT

Hello Matt,

Thank you for your reply, I already tried this but the result is empty. I try the invoke-command as the Powershell Toolkit does not show the minimum-cooling-days field. No luck until now. If I enter your code:

Executed Command: set diag;volume show -fields tiering-minimum-cooling-days

PS H:\>

PS H:\> $output.results.'cli-output'

.....EMPTY

What do I oversee or do wrong....

running on 9.11.1P5

with regards, Moray

MORAYHOONDERT

PS H:\> $output.results

status cli-output cli-result-value
------ ---------- ----------------
passed 0

mbeattie

Hi Moray,

It seems like a permission issue as the output returned results for me when i ran it on a cluster using admin credentials. I'm guessing you are trying to implement some type of health check as a read-only user? Perhaps the volume REST API might be an alternative option?

/Matt

MORAYHOONDERT

Hi Matt,

Never thought of the REST API, is there a way to learn this quick, as I did not find any clear and simple manual for this, I even do not know how to start.

And yes, I am already running a script that collects daily data and I want the tiering-minumum-cooling-days in it as well. The script runs over the readonly_cl_user with minimal privileges.

Thanks again!

Moray