Using role-based access control (RBAC) with DataFabric Manager server

SnapDrive provides support for role-based access control with DataFabric Manager server to separate server administrator and storage administrator functions, and to limit SnapDrive actions and operations depending on the role or job function of the user.

Role-based access control enables an application or Windows server administrator to provision and manage storage for their resources without needing the storage system root password.

When SnapDrive is configured for role-based access control, SnapDrive serves as the policy decision point. For every SnapDrive operation, an RBAC access check to DataFabric Manager is performed. The RBAC access check verifies whether a SnapDrive user can perform a SnapDrive operation on a storage system resource. The SnapDrive MMC displays only the object types to which a user has been granted access to perform a task.

If DataFabric Manager encounters a short service outage, SnapDrive is not affected. If a prolonged outage occurs, however, SnapDrive will no longer operate.

Note: If DataFabric Manager server is down, the SnapDrive administrator can request the storage system administrator to disable role-based access control.

The following requirements must be met in order for SnapDrive to use role-based access control:

DataFabric Manager server must be present and configured in the IP network in which the storage system and the SnapDrive hosts exist.
DataFabric Manager server must be version 3.7 or later.
The DataFabric Manager server must have pre-defined roles, operations and capabilities for SnapDrive.
The storage system administrator must enable the DataFabric Manager server RBAC flag in the AccessControl.xml file located in the root volume of the storage system.
SnapDrive must be configured by the host administrator with the DataFabric Manager server name and credentials in order to use role-based access control; otherwise, SnapDrive continues to use the original access control method, if one was configured.
DataFabric Manager server name and credentials can be entered during SnapDrive installation or by using sdcli.exe.
To enable backup operations to proceed, a role with SD.Config.Read and SD.Config.Write capabilities must be created and applied by the storage administrator at the storage system level.
For example, at the STORACL prompt, use the following command to create a new role: role add -rn SDConfigRole -OPN SD.Config.Read SD.Config.Write To apply the new role to the domain user on the specified storage system use the following command: user add -rsn StorageSystemName -rtype stor -un domain\user -RN SDConfigRole
For disk create and connect operations to succeed using either the automatic igroup creation option or the manual igroup creation option with SnapDrive, the following permissions must be set:
- If you choose the automatic igroup creation option, SD.Config.Write
- If you choose the manual igroup creation option, SD.Config.Read

See the Operations Manager Administration Guide for your version of DataFabric Manager server for more information about roles and capabilities and how they are used. See the Storage Access Control Tool User's Guide for more information about the storacl.exe tool.