Add-NcCifsShare cmdlet error

[christybiskit]

Using 9.11.1.2208 toolkit. I am connecting to the controller with this which works just fine:

Connect-NcController -Name MYNETAPP -HTTPS -ONTAPI

Name Address Vserver Version
---- ------- ------- -------
MYNETAPP x.x.x.x NetApp Release 9.10.1P6: Fri Jul 01 12:06:33 UTC 2022

But when I issue a Add-NCCifsShare command I get this:

PS C:\Windows\system32> Add-NcCifsShare -Name qt_myshare1_mirror$ -Path /MYNETAPP_vol_myshare1_mirror/qt_myshare1 -VserverContext MYVSERVER
Add-NcCifsShare : HomeDirectory parameter specified, which is not supported for ONTAPI call
At line:1 char:1
+ Add-NcCifsShare -Name qt_myshare1_mirror$ -Path /MYNETAPP_vol_mysh ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (:) [Add-NcCifsShare], ArgumentException
+ FullyQualifiedErrorId : HomeDirectory parameter specified, which is not supported for ONTAPI call,DataONTAP.C.Po
werShell.SDK.Cmdlets.Cifs.AddNcCifsShare

I am not specifying the "HomeDirectory" parameter.

Anyone else encountered this? This command worked fine in an earlier version of the toolkit (9.6).

I read this article and will try the suggestion given there and report back.

Solved: PowerShell Toolkit 9.11.1.2208 - iSCSI command not working - NetApp Community

use Invoke-NcSsh or Invoke-NcSystemApi

Thank you,

christybiskit

[mbeattie]

Hi Chris,

Remove the -ONTAPI parameter from the Connect-NcController Cmdlet. I think it could be a bug with the CmdLet parameter implementation for REST API's. The -ONTAPI parameter forces the connection to use ZAPI's otherwise it will peform an ONTAP version check and if using ONTAP 9.6 or greater it will leverage REST API's. I tried it without the -ONTAPI parameter and the Add-NcCifsShare cmdlet worked for me.

/Matt

[christybiskit]

Hi Matt,

Thanks for the suggestion. I originally was not using the -ONTAPI switch on Connect-NcController but I had to add it otherwise I get this error and can’t connect:

Connect-NcController : The remote server returned an error: (401) Unauthorized.

At line:1 char:1

+ Connect-NcController -Name myNetapp -Credential $myCred -HTTPS #-ONTA ...

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : InvalidResult: (myNetapp:NcController) [Connect-NcController], WebException

    + FullyQualifiedErrorId : HttpConnectionFailed,DataONTAP.C.PowerShell.SDK.ConnectNcController

With -ONTAPI this connects without error.

Chris

[mbeattie]

Hi Chris,

Are you using an RBAC delegated account for this API call? If so perhaps there is an issue with the RBAC role configuration. Can you invoke the API via the Swagger UI using your account that you are connecting as? I tried it successfully as admin, perhaps an account permission\authorization issue?

/Matt

[christybiskit]

Hi Matt,

Forgive me, but I'm not sure what you mean by "RBAC delegated account". I am trying to use an Active Directory account which has full rights on the cluster. This account can login successfully using the System Manager web interface. I can't use a local ONTAP account as those are managed by another team.

I have never used Swagger UI. Can you please elaborate on what insight it may give if I set it up?

Thank you,

Chris

[christybiskit]

I was able to create a local ONTAP account on our test cluster and then both Connect-NcController (without -ONTAPI) and the subsequent Add-NcCifsShare work using the latest Powershell toolkit (9.11.1.2208). So for the former command, it seems to only work with local ONTAP accounts and not AD accounts. I tried every format I could think of (domain\user, user@domain, user) for the AD account and none worked. I saw the same behavior with the prior toolkit release (9.10.1.2111).

I will see if the team who manages NetApp here will allow me to use a local ONTAP accounts for my scripts (which are running as Windows scheduled tasks).

[mbeattie]

Hi Chris,

You should be able to authenticate to the Swagger UI and invoke API's (Assuming you are using an account that has been granted the appropriate roles\permissions to do so). You can point your browser to the cluster FQDN or IP Address /docs/api and it should display the Swagger UI for you to authenticate to. If authentication fails for the Swagger UI, it's a permissions issue with the account you are using (Not a PSTK issue). In that case you'll need to speak with the storage team to provide you with access

/Matt

[christybiskit]

Thanks Matt for the tips on the Swagger UI. I can login successfully to the Swagger UI using my domain account using domain\user. Does this mean this is an issue with the PSTK?

[mbeattie]

Hi Chris,

Just because you can authenticate to the Swagger UI that's not necessarily an indication that it's a PSTK issue. You need to try and invoke the REST API independently of the PSTK by creating a CIFS Share. Try this:

• Authenticate to the Swagger UI
• Locate the /protocols/cifs/shares API
• Click the "Try it out" button
• Edit the JSON payload EG
• Click Execute
• Verify that the CIFS Share was created in ONTAP
• If successful you'll get a HTTP 201 status code. If there is an error you will receive HTTP status code and error message

/Matt

[christybiskit]

Thank you Matt for the detailed instructions. I am able to create a new CIFS share using Swagger UI authenticated with my domain account. I received return code 201 and I see the newly created share. Is there anything else I can provide to help further troubleshoot why I cannot create a CIFS share using the PSTK as a domain account?

[mbeattie]

Hi Chris,

That's odd, does it work successfully using the PSTK if using a local account instead of your domain account? It worked fine for me creating a CIFS Share using a local account. Given it works successfully in the Swagger UI but not using the PSTK I'm guessing it's probably a bug in the PSTK. Seems to be a number of issues with version 9.11.1.2208. Have you tried it with an older PSTK version?

/Matt

[AmmarMhowwala]

Hi Chris,

Seem like when you connect with controller via with domain user. Rest API which are used in connect-nccontroller have RBAC. Can you please run below rest API with your domain users via swagger UI or curl or postman and confirms is this API's are accessible or not?

https://<clustermangementip>/api/cluster
https://<clustermangementip>api/network/ip/interfaces

Thanks

Ammar

[jcolonfzenpr]

The NetApp.ONTAP v9.11.1.2208 module is garbage. I don't know how this modules passed the QA checks. I uninstalled it and reinstalled v9.10.1.2111.

Get-Module -ListAvailable NetApp.ONTAP | Uninstall-Module -Force

Install-Module -Name NetApp.ONTAP -RequiredVersion 9.10.1.2111

[christybiskit]

Hi Jonathan,

My environment is very secure so I can't connect to the Powershellgallery hub to get the 9.10.1.2111 version as you show above. Do you know where I could find the old-fashioned MSI-based installer for this version?

Thanks,

Chris

[christybiskit]

I answered my own question. I downloaded the raw Nuget package from Powershellgallery and was able to test using it (I ran into the same errors using an AD account).

[CFunk]

Did this get resolved in 9.11 ? I don't have the option to roll back to 9.10 powershell module.