topic read only account in Software Development Kit (SDK) and API Discussions

read only account

HAIT_NETAPP — Wed, 22 Jan 2014 21:58:54 GMT

Is ontap 8.1.17 7 mode able to create a read-only account, so a API scirpt can safely run? If so, how?

Many thanks.

Re: read only account

DANIELCM6 — Thu, 23 Jan 2014 21:18:57 GMT

Take a look at this link

https://library.netapp.com/ecmdocs/ECMP1196890/html/man1/na_useradmin.1.html

You can use useradmin to control user access. You can probably create an account with certain capabilities and fine tune it to your use.

Re: read only account

HAIT_NETAPP — Thu, 23 Jan 2014 21:55:01 GMT

I have to laugh at NetApp. they make creating a read only account mission impossible. If anyone disagrees, please provide your complete commands to do this.

===========================

A sixth capability, filerview-readonly, is unused and ignored. - what does this mean? can this used or not?

read only account

DANIELCM6 — Thu, 23 Jan 2014 22:16:11 GMT

See this for more info on that capability

http://hd.kvsconsulting.us/netappdoc/733docs/html/ontap/rnote/rel_notes/concept/c_oc_rn_feat73-admin-filerview-readonly-capability.html

I dont think it's impossible, it's just a matter of knowing what capabilities you need to give granularity to a role.

I think you need to determine what you need from this account and what are you trying to do exactly.

What does your API script do?

Re: read only account

WOODROGER — Thu, 26 Jun 2014 19:57:42 GMT

You have 2 different issues I believe. You would need to invoke a RBAC users on the filer to insure that some CLI commands could not be run nor login to the filer. However with PowerShell (PS) depending on what APIs you are calling or invoking if you can access .Net framework and issue commands the user restrictions no longer apply at that point. You can issue any public API that the system would allow and that you are aware to call upon in the .Net framework

Re: read only account

obrakmann — Fri, 27 Jun 2014 10:44:42 GMT

That's just wrong. With RBAC, you can restrict a user to certain API calls (anything that begins with "api-") just as you can limit the CLI commands that user can exceute.

For example, for one of my applications I have the following user that only has read-only API access to the system info, aggregate, volume and snapshot information. The user does not have CLI access at all, and attempts to access other API calls will be logged and rejected:

useradmin role add myrole -a login-http-admin,api-system-get-info,api-aggr-list-info,api-volume-list-info,api-snapshot-list-info

useradmin group add mygroup -r myrole

useradmin user add myuser -g mygroup

Re: read only account

obrakmann — Fri, 27 Jun 2014 10:50:36 GMT

It's not impossible. In fact it's quite easy as long as we're talking about the HTTP API here (and I assume we do, since we're in the NMSDK API area of the forum).

However, I would agree that creating a read-only CLI user is not possible, since there are some corner cases (like the vfiler commands, if I remember correctly) where destructive and read-only commands are not separated well enough.

Here's an example for a read-only API user, though:

useradmin role add myrole -a login-http-admin,api-system-get-info,api-aggr-list-info,api-volume-list-info,api-snapshot-list-info

useradmin group add mygroup -r myrole

useradmin user add myuser -g mygroup

Re: read only account

WOODROGER — Fri, 27 Jun 2014 16:37:32 GMT

I am not sure I follow you Oliver. You called out what I said was wrong. Was that about the RBAC or the PS? You then restated my comment about the RBAC and gave a CLI example about the creation of a RBAC user. Did you mean what I stated about the Powershell was wrong?

I stated , "You would need to invoke a RBAC users on the filer to insure that some CLI commands could not be run nor login to the filer." and you said

"With RBAC, you can restrict a user to certain API calls (anything that begins with "api-") just as you can limit the CLI commands that user can exceute."

Re: read only account

obrakmann — Mon, 30 Jun 2014 12:48:25 GMT

The statement that prompted my reply was "However with PowerShell (PS) depending on what APIs you are calling or invoking if you can access .Net framework and issue commands the user restrictions no longer apply at that point."

That's wrong because of course you can restrict which APIs are available to PowerShell users. But maybe I just misunderstood what you wrote somewhere.

The point that I was trying to get across is that CLI access and API access have different sets of capabilities that pertain to them, and if you want to properly restrict a user that has access to both CLI and API, you need to consider both when setting up RBAC.

Re: read only account

vkbathala — Tue, 06 Mar 2018 00:15:11 GMT

What if I need to just create a read-only account with all the show commands or commands which cannot change filer configuration? Are we able to create such read-only account in 7-mode?

Re: read only account

bkamil — Thu, 14 Jun 2018 14:26:58 GMT

Check this out:

https://kb.netapp.com/app/answers/answer_view/a_id/1030500