I have a ZAPI script that makes one call to 'snapmirror-update' so that a client can trigger a snapmirror after their data is written. One permissions granted through security login role: 'snapmirror update -destination-path SVMNAME:VOLUMENAME' with access all.   In trying to convert this to REST using the python client library, additional permissions were added: 'snapmirror show -destination-path SVMNAME:VOLUMENAME' with access readonly(which also granted 'snapmirror create') 'job show' with access readonly   The script is effectively: config.CONNECTION = HostConnection(connect, username=user, password=password, verify=verify) relationship=SnapmirrorRelationship.find(**{'destination.path':f'{svm}:{volume}'}) transfer=SnapmirrorTransfer(relationship=relationship) transfer.post()   However, when the post is issued, it fails with: HTTPError('403 Client Error: Forbidden for url: https://filer:443/api/snapmirror/relationships/e8b27bcf-8bee-11eb-94d0-00a098aad316/transfers',): not authorized for that command   If I change 'snapmirror show' from readonly access to all access, it works, but that introduces privilege concerns since that now allows the user to create snapmirror relationships. Any ideas what I'm missing here? ... View more

Hi, Trying to get the qtree name that has curly braces in it. ex - {cjtest-really-long-name} if tried name: {cjtest-really-long-name} without double quotes around the name, it did not return the qtree record. curl -X GET "https://host_ip/api/storage/qtrees?name=%7Bcjtest-really-long-name%7D&return_records=true&return_timeout=15" -H "accept: application/json" -H "authorization: Basic YWRtaW46bmV0YXBwMSE=" whereas with double quotes "{cjtest-really-long-name}", it return record good. curl -X GET "https://host_ip/api/storage/qtrees?name=%22%7Bcjtest-really-long-name%7D%22&return_records=true&return_timeout=15" -H "accept: application/json" -H "authorization: Basic YWRtaW46bmV0YXBwMSE=" is this expected? Thanks, Mohan ... View more

Hi,   verb - POST api -  snapmirror/policies body -  {'name': 'ansible_policy', 'svm': {'name': 'ansible_snap'}, 'type': 'async'} my assumption was async is async-mirror, but it's configured in ONTAP as  mirror-vault. ontap97::> snapmirror policy show -vserver ansible_snap Vserver Policy Policy Number Transfer Name Name Type Of Rules Tries Priority Comment ------- ------------------ ------ -------- ----- -------- ---------- ansible_snap ansible_policy mirror-vault 1 8 normal - SnapMirror Label: sm_created Keep: 1 Total Keep: 1 is async in REST is mirror-vault? Thanks, Mohan ... View more

I've been working on automating stuff via REST calls and I ran into an uncomfortable security scenario. The account I used has a dedicated rest-role. In this role it has read/write (all via cli) for /api/storage/volumes. This is necessary for creating and modifying volumes which one of the main goals of the REST calls. If you dig a little deeper into that api path there is /api/storage/volumes/{uuid}/files/{path} which allows you to make some changes directly on files or folders inside a volume and ignores any cifs/nfs acls. Yep, it does that. It's even noted in TR-4569 that it's not recorded in the NAS Audit Log. Concerning to say the least. I've been trying to figure out a what to limit the access this account has on this deeper api path. Via the web gui it doesn't list that deep of path as an option. Using cli I've tried security login rest-role create -vserver <svmName> -role <roleName> -api "/api/storage/volumes/*/files/*" but get the response "specified uri path is invalid or not suppported. I've also tried dropping the last * but it doesn't recognize that path either. I know the * wildcard works in the command because I've successfully added /api/storage/volumes/*/snapshots.  Anyone have any ideas? Maybe I'm just being paranoid about having the ability to effect changes to files/folders to which I don't have auditable access, or automation having the same access which feels like a sizeable security hole. ... View more