Managing users

Creating users and assigning them to groups

You can use the useradmin user add or useradmin user modify commands to create or modify a user and assign that user to one or more predefined or customized groups. This gives that user the roles and capabilities associated with those groups.

Note
When you use the useradmin user modify command to modify the groups an existing user is assigned to, whatever groups the user was previously assigned to are replaced with the group or groups you supply in the command.

User names are case insensitive. This means that you cannot create a user named "fred" if you already have a user named "Fred".

To create a new user or assign an existing user to a custom group or predefined group, complete the following steps.

Step	Action
1	Use `useradmin user add` to create a new user. Or, use `useradmin user modify` to modify the attributes of an existing user. useradmin user {add\|modify} user_name [-c comments] [-n full_name] [-p password] -g group1[,group2,group3,..] [-m password_min_age] [-M password_max_age] user_name is the user whose name you want to assign to a customized or predefined group. The user name is case insensitive and can be up to 32 characters long. For more information about naming requirements, see Naming requirements for users, groups and roles. comments specifies a maximum 128-character comment which can be viewed through the `useradmin list` command. Comments cannot contain a colon character (:). full_name specifies the full name for the user. password is the password required of the specified administrative user (used only for rsh access). If the `security.passwd.rules.enable` option is set to On, the password must conform to the rules specified by the `security.passwd.rules.` options. group* is a predefined or customized group with roles assigned through the `useradmin group` command. For more information about creating custom groups, see Assigning roles to groups by creating or modifying a group. For a description of the predefined groups, see Predefined groups. password_min_age specifies the minimum number of days users can have a password before they can change it. The default value is 0. password_max_age specifies the maximum number of days users can have a password before they are required to change it. The default value is 4,294,967,295.
2	To verify the success of your operation, enter the following command. useradmin user list user_name The specified user is listed along with the groups, roles, and capabilities that the user has inherited.

Step

Action

Use useradmin user add to create a new user. Or, use useradmin user modify to modify the attributes of an existing user.

useradmin user {add|modify} user_name [-c comments] 

[-n full_name] [-p password] -g group1[,group2,group3,..] 

[-m password_min_age] [-M password_max_age]

user_name is the user whose name you want to assign to a customized or predefined group.

The user name is case insensitive and can be up to 32 characters long. For more information about naming requirements, see Naming requirements for users, groups and roles.

comments specifies a maximum 128-character comment which can be viewed through the useradmin list command. Comments cannot contain a colon character (:).

full_name specifies the full name for the user.

password is the password required of the specified administrative user (used only for rsh access). If the security.passwd.rules.enable option is set to On, the password must conform to the rules specified by the security.passwd.rules.* options.

group is a predefined or customized group with roles assigned through the useradmin group command.

For more information about creating custom groups, see Assigning roles to groups by creating or modifying a group. For a description of the predefined groups, see Predefined groups.

password_min_age specifies the minimum number of days users can have a password before they can change it. The default value is 0.

password_max_age specifies the maximum number of days users can have a password before they are required to change it. The default value is 4,294,967,295.

To verify the success of your operation, enter the following command.

useradmin user list user_name

The specified user is listed along with the groups, roles, and capabilities that the user has inherited.

Example

The following command uses the predefined Administrators group and role definitions to create the user mollymulberry and grant her rights to invoke every type of administrative capability (login, CLI, API, and security).

useradmin user add molly -n "Molly Mulberry" -c "Filer 
administrator in Corp IT" -g Administrators

Granting access to Windows domain users

You can specify nonlocal administrative users to have administrative access to the storage system after authentication by a Windows Domain Controller, rather than by the storage system itself.

Note
Nonlocal users, or users added with the useradmin domainuser add command, cannot log in to a storage system using the login protocols (telnet, console, rsh, ssh or http-admin). Nonlocal users can log in only by using Windows RPC calls, and can use only the API capability once they are logged in. This is true regardless of the capabilities associated with any storage system group the nonlocal user has been placed in.

To grant a Windows domain user administrative access to an storage system, complete the following steps.

Step	Action
1	Use the `useradmin domainuser add` to assign a Windows domain user to a custom or predefinedgroup. *useradmin domainuser add win_user_name -g {custom_group\|Administrators\|"Backup Operators"\|Guests\|"Power Users"\|Users}[,...]* win_user_name is the Windows domain user whose name or Security ID (SID) you want to assign to a customized or predefined group. This value can be in one of the following formats: `name` Note If you do not specify the domain name, the domain is the storage system, and the user is considered distinct from any user in the Windows domain with the same user name. `domain\name` `textual_sid_S-x-y-z` For more information about these formats, see the na_cifs_lookup(1) man page. custom_group is a customized group with roles assigned through the `useradmin group` command. For more information about creating customized groups, see Predefined groups. `Administrators \| "Backup Operators" \| Guests \| "Power Users" \| Users` are groups predefined by Data ONTAP with default roles and capabilities. For a description of the predefined groups see Using administrator accounts to control administrative access. Example The following command adds the user userjoe in the MyDomain domain to the Power Users group and effectively grants MyDomain\userjoe all administrator capabilities that are granted to the Power Users group through the roles that have been assigned to it. useradmin domainuser add MyDomain\userjoe -g "Power Users"
2	To verify the success of your operation, enter the following command. *useradmin domainuser list -g {custom_group\|Administrators\|"Backup Operators"\|Guests\|"Power Users"\|Users}* The SID of the user in question is among those listed in the output of this command.

Step

Action

Use the useradmin domainuser add to assign a Windows domain user to a custom or predefinedgroup.

useradmin domainuser add win_user_name -g 
{custom_group|Administrators|"Backup 
Operators"|Guests|"Power Users"|Users}[,...]

win_user_name is the Windows domain user whose name or Security ID (SID) you want to assign to a customized or predefined group. This value can be in one of the following formats:

name
Note
If you do not specify the domain name, the domain is the storage system, and the user is considered distinct from any user in the Windows domain with the same user name.
domain\name
textual_sid_S-x-y-z

For more information about these formats, see the na_cifs_lookup(1) man page.

custom_group is a customized group with roles assigned through the useradmin group command. For more information about creating customized groups, see Predefined groups.

Administrators | "Backup Operators" | Guests | "Power Users" | Users are groups predefined by Data ONTAP with default roles and capabilities. For a description of the predefined groups see Using administrator accounts to control administrative access.

Example

The following command adds the user userjoe in the MyDomain domain to the Power Users group and effectively grants MyDomain\userjoe all administrator capabilities that are granted to the Power Users group through the roles that have been assigned to it.

useradmin domainuser add MyDomain\userjoe -g "Power 
Users"

To verify the success of your operation, enter the following command.

useradmin domainuser list -g 
{custom_group|Administrators|"Backup 
Operators"|Guests|"Power Users"|Users}

The SID of the user in question is among those listed in the output of this command.

Changing another user's capabilities

You must be an administrator and your user account must be assigned to a group that has greater capabilities than the group the user is assigned to if you want to perform any of the following tasks:

Change the capabilities of a user
Change the comment about a user
Change the full name of a user
Change the ageing characteristics of a user's password
Change the name of a group
Note
You cannot create or change a group, a user, or a role, to have more capabilities than you have.

If you want to change the password of another user, your account must also be assigned to a group that has the security-password-change-others capability.