got this error when he tried to run a Rest API Call for /api/storage/volume
00000005.000173e6 0020e504 Tue Apr 28 2020 04:53:02 -07:00 [kern_audit:info:2238] 8503e8000001567f :: ec1_netapp_cvo_ls_prod_dr_ext:CSODMGMT\svc-ls-cvo-iac :: GET /api/storage/volume :: Error: Forbidden Error for this user was 403 – Forbidden …. RBAC.
/api/storage/volume { "error": { "message": "not authorized for that command" "code": "6" } }
Workaround provided: Create a exact same role from ONTAP CLI and associate with user and it works fine.
Steps Taken: Test with the affected user – doesn't work. Test with admin user – worked fine. Test with same role capabilities on another cluster – works fine. Create a new role with same capabilities from CLI – works fine. Re-associate user to old role with same capabilities as old role – fails. Old role created by Ansible – works fine on another cluster with same version.
developed some python code that makes REST calls. This code did work and nothing has changed. If you check the logs, you can see REST call on the 20th April that were successful.
Commands used to create the role : security login rest-role create -vserver CVO_Prod -role cvo-rest-test -api /api/storage/volumes -access all security login rest-role create -vserver CVO_Prod -role cvo-rest-test -api /api/protocols/cifs/shares -access all security login rest-role create -vserver CVO_Prod -role cvo-rest-test -api /api/cluster/jobs -access all
Data collected related to both role : old one created by ansible and worked before, new one created by CLI as workaround
Any ideas ?
Thanks.
... View more
Posting on behalf of a customer.. Per instruction in the document (https://library.netapp.com/ecmdocs/ECMLP2862544/html/index.html#/storage/quota_rule_modify), a `return_timeout` can be specified for asynchronous options where ONTAP waits that length of time to see if the job completes. This seems not to work for us. We always get an immediate response with a job id instead of waiting. Could you please help check and advice if we are doing as expected? Sample: Api = https://xxxname.yyycompany.com/api/storage/quota/rules/d8b6b371-7b35-11eb-93cf-00a0989bbd8f?return_timeout=30 Kwargs = {"space": {"hard_limit": '1073741824'}} Call = http_request('patch', api, kwargs) We will get response: {u'job': {u'_links': {u'self': {u'href': u'/api/cluster/jobs/49fcfe2c-7c00-11eb-93cf-00a0989bbd8f'}}, u'uuid': u'49fcfe2c-7c00-11eb-93cf-00a0989bbd8f'}}
... View more
Hi, i have a rest client which is communicating with a SVM - to the cluster admin i have no connection. now i want to get the timezone.... does anybody have a clue how i can get this? i was trying /api/private/cli/timezone /api/cluster?fields=timezone but nothing is working...
... View more
HI all, we are currently in the phase to switchover from ontapi to Rest-API. For some regulations, we need to use RBAC, so that special AD-Groups/User get reduced API-Access to the vserver. We need a role for Snapshot-Management (Backup Application), so this user only can create/delete snapshots on the vserver. So far i can only get it working with giving RestAccess to API /api/storage/volumes, but this would also give rights to create/destroy volumes and more. I tried to create a more strict role, but it doesnot work. Ontap_98::> security login rest-role create -vserver <vserver> -role rest_snapadmin -api /api/storage/volumes/{volume.uuid}/snapshots -access all Error: command failed: Invalid character detected in URI. Has anybody an Idea, how to restirct the Access to snapshot only operations with REST-API? Best Regards, Klaus
... View more
We have an app that is using the OnTap REST api to create snapshots of specific volumes.
We would like to create a service account that ONLY has the rights to create snapshots on specified volumes.
Using the CLI we can create a "rest-role" that has all access to all volumes:
modify -vserver dc1-netsim -role SmartBackupRest -api /api/storage/volumes -access all
But when we try to lock this down to a specific operation:
create -vserver dc1-netsim -role SmartBackupRest -api /api/storage/volumes/snapshots -access all
we get "URI does not exist"
and if we try to use the actual URI called by the app (including the volume ID):
create -vserver dc1-netsim -role SmartBackupRest -api /api/storage/volumes/d9616397- a06b-4da4-931d-ee22f7bffeec/ snapshots -access all
we get "Invalid character detected in URI."
How are we meant to lock the role down effectively?
... View more
