Limitations of the -cmddirname query options when creating new roles

STEVEWILLSQ — Wed, 04 Jun 2025 12:39:22 GMT

I have a customer who is interested in locking down some users to be able to access specific volumes and perform a limited set of operations on those volumes.

Sounds like a perfect scenario to use a custom role. I've done some lab on demand testing to sound out the requirements.

The requirements for the role are to have the following commands avaialble.

vol snapshot create

vol snapshot delete

vol snapshot show

vol snapshot restore

set -confirmations off

So far so good. The second requirement is that of each user should only be able to perform the above options on a specific set of volumes. To make it easy lets call them

produser - accessing volumes prod*

testuser - accessing volumes test*

devuser - accessing volumes dev*

The issue I've hit is with the snap restore command set.

I can create a role with the following

sec login role create -role prodrole -cmddirname volume -query "-volume prod*" -access all

But this doesn't include the volume snapshot restore commands So we add the follow

sec login role create -role prodrole -cmddirname volume snapshot -query "-volume prod*" -access all

again this doesn't include the volume snapshot restore commands.

So when we attempt to add this final extentionto the allowed commands

sec login role create -role prodrole -cmddirname volume snapshot restore -query "-volume prod*" -access all

"which includes the snapshot promote command"

The wildcard on the query is rejected. So we can only add a single volume here, with multiple volumes required. Is there way to list a set of volumes we can allow the user to perform restores for? Pipe and command seperation doen't seem to apply. I can't see anything in the documentation that hints at adding mulitple valid queries.

The prod, test and dev volumes are on the same vserver so to get the granularity we require if possible we'ed need to lock down the command

Re: Limitations of the -cmddirname query options when creating new roles

STEVEWILLSQ — Wed, 05 Jun 2019 12:21:27 GMT

Working with Netapp, this has been logged as the following BURT.

https://mysupport.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=1237037

topic Limitations of the -cmddirname query options when creating new roles in ONTAP Discussions

Limitations of the -cmddirname query options when creating new roles

Re: Limitations of the -cmddirname query options when creating new roles