This is super specific, but I wonder if any of you folks have some insight into this.
The subject TR calls for creating a role called admin_ssh that is basically like the admin role, but restricts access to the service processor commands, like so:
cluster::> security login role create -role admin_ssh -cmddirname DEFAULT -access all -vserver <cluster SVM> cluster::> security login role create -role admin_ssh -cmddirname "system service-processor" -access none -vserver <cluster SVM>
I did this, and changed a user from admin to admin_ssh for all login methods, including ssh, http, and ontapi.
Prior to the change, the user was able to log in to OnCommand System Manager as per normal. After the change, the user cannot log in to OnCommand System Manager at all. All attempts result in an "invalid credentials" type message. Reverting the change results in the ability to log in to OCSM normally once more.
Any chance this is a bug? Worth filing a ticket to support?