About managing administrator access

Reasons for creating administrator accounts

You can use the default system administration account, or root, for managing a storage system. You can also create additional administrator user accounts, using the useradmin command. You might want to create administrator accounts for the following reasons:

You can specify administrators and groups of administrators to have differing degrees of administrative access to your storage systems.
You can limit an administrator's access to specific storage systems by giving him or her an administrative account on only those systems.
Having different administrative users allows you to display information about who is performing what commands on the storage system.
The auditlog file keeps a record of all administrator operations performed on the storage system and the administrator who performed it, as well as any operations that failed due to insufficient capabilities.
You assign each administrator to one or more groups whose assigned roles (sets of capabilities) determine what operations that administrator is authorized to carry out on the storage system.
If a storage system running CIFS is a member of a domain or a Windows workgroup, domainuser accounts authenticated on the Windows domain can access the Data ONTAP Application Program Interface (API) using Windows RPC calls.
For more information about authenticating users using Windows domains, see the section on user accounts in the CIFS chapter of the File Access and Protocols Management Guide.

What users, groups, roles, and capabilities are

You can grant different levels of administrative access to users of a storage system. Terms used in this section include the following:

user

An account that is authenticated on the storage system. Users can be placed into storage system groups to grant them capabilities on the storage system.

domainuser

A nonlocal user who belongs to a Windows domain and is authenticated by the domain. This type of user can only be put into storage system groups, thereby being granted capabilities on the storage system. This only works if CIFS has been set up on the storage system.

group

A collection of users and domainusers that can be granted one or more roles. Groups can be predefined, created, or modified. When CIFS is enabled, groups act as Windows groups.

role

A set of capabilities that can be assigned to a group. Roles can be predefined, created, or modified.

capability

The privilege granted to a role to execute commands or take other specified actions. Types of capabilities include:

Login rights
Data ONTAP CLI (command-line interface) rights
Data ONTAP API (application programming interface) rights
Security rights

How users are assigned capabilities

You cannot assign administrative roles or capabilities directly to administrative users or domainusers. Instead, you assign users to groups whose assigned roles match the capabilities that you want those users to be able to exercise.

You can assign a set of capabilities to a role, then assign that role to a group. You then add an administrative user to the group that has the administrative role and capabilities that you want that user to have.
You can also assign users and domainusers to some predefined groups whose default roles match the roles that you want the users in question to exercise.

Naming requirements for users, groups and roles

When you name your users, groups and roles, you must meet these naming requirements:

Names are case insensitive.
Names can contain any alphanumeric character, a space, or a symbol that is not one of the following characters:
" * + , / \: ; < = > ? | [ ]
If the name contains spaces or special characters, enclose the name in double quotes ("") when you use it in a command.
Do not give a user and a group the same name if you are using the storage system in a CIFS environment; doing so might cause some Windows functions to fail.

Windows special groups

Windows has some special groups it uses for security and administration purposes. Do not create administrative groups on your storage system with the same name as a Windows special group. The special Windows group names include the following names:

System
Everyone
Interactive
Network
Creator/Owner
Creator Group
Anonymous Logon
Authenticated Users
Batch
Dialup
Service
Terminal User

Changing capabilities of other groups and roles

If you are an administrator assigned to a group with capabilities that are equal to or greater than another group, you can make the following changes to that other group:

Change the capabilities of the other group
Change the capabilities of the roles within the other group
Change the membership of the other group