SnapDrive uses the AccessControl.xml file on the storage system to determine what roles are assigned to a user and what operations are allowed for specific roles.
Before you begin
- Install the storage access control (storacl.exe) tool on any Windows host to create and manage the AccessControl.xml file on your storage system in the /etc directory of the root volume.
The executable is part of your SnapDrive installation and is located in the SnapDrive directory on your host.
- HTTPS must be enabled using the options ssl.enable command and secureadmin setup ssl command on the storage system.
HTTP is also supported for use with vFiler units when using the MultiStore feature of Data ONTAP software.
- You must be logged in as root on the storage system.
About this task
Attention: Always use
storacl.exe to modify the AccessControl.xml file. Using a standard XML editor might corrupt the file and cause SnapDrive operations to fail.
Steps
- Run storacl.exe from your Windows host to create a default AccessControl.xml file on the specified storage system.
An AccessControl.xml file is created containing a default set of roles and operations with no resources or access rights.
- Using storacl.exe, edit the AccessControl.xml file to add or change users and to grant or deny access rights to the storage system resources. You can also use the default entries.
SnapDrive opens and reads the AccessControl.xml file and caches the information on the Windows host. SnapDrive uses this information to check resource access for all SnapDrive operations, and grants or denies access depending on the role assigned to the user.
SnapDrive performs an rbac-access-check operation to compare the file timestamp on the cached AccessControl.xml file with the timestamp on the AccessControl.xml file on the storage system. If a change exists on the storage system version of the AccessControl.xml file, SnapDrive refreshes the cached version.
