Managing roles

Predefined roles

Data ONTAP provides the following predefined roles.

Role	Default capability assignments	Summary of default granted capabilities
`root`	`-a *`	Grants all possible capabilities.
`admin`	`-a cli-`, `api-`, `login-`, `security-`	Grants all CLI, API, login, and security capabilities.
`power`	`-a cli-cifs`, `cli-exportfs`, `cli-nfs`, `cli-useradmin`, `api-cifs-`, `api-nfs-`, `login-telnet`, `login-http-admin`, `login-rsh`, `login-ssh`	Grants the ability to Invoke all `cifs`, `exportfs`, `nfs`, `useradmin` CLI commands Make all `cifs` and `nfs` API calls Log in using telnet, HTTP, rsh, and ssh sessions
`audit`	`-a api-snmp-get`, `api-snmp-get-next`	Grants the ability to make `snmp-get` and `snmp-get-next` API calls.
`none`	None	Grants no administrative capabilities.

Assigning capabilities to roles

You use the useradmin role add or useradmin role modify commands to define and modify the capabilities of roles that can be assigned to a group.

Supported capability types

Data ONTAP supports four capability types, as described in the following table.

Capability Type	Description
`login`	Grants the specified role `telnet`, `console`, `rsh`, `ssh`, or `http-admin` login capabilities. `login-` gives the specified role the ability to log in through all supported protocols. `login`-protocol* gives the specified role capability to log in through a specified protocol. Supported protocols include: `login-telnet`--gives the specified role the ability to log in to the storage system using Telnet. `login-console`--gives the specified role the ability to log in to the storage system using the console. `login-rsh`--gives the specified role the ability to log in to the storage system using `rsh`. `login-ssh`--gives the specified role the ability to log in to the storage system using SSH. `login-http-admin`--gives the specified role the ability to log in to the storage system using HTTP.
`cli`	Grants the specified role the ability to execute one or more Data ONTAP command line interface (CLI) commands. `cli-` grants the specified role the capability to execute all supported CLI commands. `cli`-cmd gives the specified role the capability to execute all commands associated with the CLI command cmd. For example, the following command gives the specified role the capability to execute all `vol` commands: useradmin role modify status_gatherer -a cli-vol* Note Users with `cli` capability also require at least one `login` capability to execute CLI commands.
`security`	Grants the specified role security-related capabilities, such as the ability to change other users' passwords or to invoke the CLI `priv set advanced` command. `security-` grants the specified role all security capabilities. `security`-capability* grants the specified role one of the following specific security capabilities: `security-passwd-change-others` gives the specified role the capability to change the passwords of all users with equal or less capabilities. For more information about comparing capabilities, see Changing another user's capabilities. `security-priv-advanced` gives the specified role the capability to access the advanced CLI commands.
`api`	Grants the specified role the capability to execute Data ONTAP API calls. `api-` grants the specified role all api capabilities. `api`-api_call_family- grants the specified role the capability to call all API routine in the family api_call_family. `api`-api_call grants the specified role the capability to call the API routine api_call. Note You have more fine-grained control of the command set with the `api` capabilities because you can give subcommand capabilities as well. Users with `api` capability also require the `login-http-admin` capability to execute API calls.

Creating a new role

To create a new role, complete the following steps:

Step	Action
1	Enter the following command: *useradmin role add role_name* [-c comments] -a capability1[,capability2...]** role_name is the name of the role you want to create. Role names are case insensitive and can be 1-32 characters. For more information about naming requirements, see Naming requirements for users, groups and roles. comments is a short string you can use to document this role. The capability parameters are the capabilities you want to grant to this new role.
2	To verify the success of the operation, enter the following command. useradmin role list role_name Result The capabilities allowed for the specified role are listed.

Step

Action

Enter the following command:

useradmin role add role_name [-c comments] -a 
capability1[,capability2...]

role_name is the name of the role you want to create. Role names are case insensitive and can be 1-32 characters. For more information about naming requirements, see Naming requirements for users, groups and roles.

comments is a short string you can use to document this role.

The capability parameters are the capabilities you want to grant to this new role.

To verify the success of the operation, enter the following command.

useradmin role list role_name

Result

The capabilities allowed for the specified role are listed.

Modifying an existing role

To modify the capabilities of an existing role, you use the useradmin role modify command.

Note
When you use the useradmin role modify command to modify an existing role, whatever capabilities were previously assigned to that role are replaced with the capabilities you supply in the command.

To modify an existing role, complete the following steps.

Step	Description
1	Enter the following command: *useradmin role modify role_name* [-c comments] -a capability1[,capability2...]** role_name is the name of the role that you want to modify. comments is a short string you can use to document this role. The capability parameters are the capabilities you want to grant to this role. Example The following command line assigns the role "class2loginrights" telnet capabilities, console login capabilities, and all CLI capabilities, while removing any other capabilities that the role was granted previously. useradmin role modify class2loginrights -c "This role is for telnet and console logins" -a login-telnet,login- console,cli-*
2	To verify the success of the operation, enter the following command. useradmin role list role_name Result The capabilities allowed for the specified role are listed.

Step

Description

Enter the following command:

useradmin role modify role_name [-c comments] -a 
capability1[,capability2...]

role_name is the name of the role that you want to modify.

comments is a short string you can use to document this role.

The capability parameters are the capabilities you want to grant to this role.

Example

The following command line assigns the role "class2loginrights" telnet capabilities, console login capabilities, and all CLI capabilities, while removing any other capabilities that the role was granted previously.

useradmin role modify class2loginrights -c "This role is 
for telnet and console logins" -a login-telnet,login-
console,cli-*

To verify the success of the operation, enter the following command.

useradmin role list role_name

Result

The capabilities allowed for the specified role are listed.

Example of granting API command families

You can grant API capabilities for API command families. For example, to grant the myrole role only the capability to run CIFS commands, you use the following command:

useradmin role add myrole -a api-cifs-*