Skip to main content
ONTAP tools for VMware vSphere 10

How ONTAP RBAC works with ONTAP tools

Contributors jani netapp-jani dmp-netapp
PDFs

ONTAP provides a robust and extensible RBAC environment that controls access to storage and system operations through the REST API and CLI. Understanding ONTAP RBAC concepts — including role types, scopes, and privileges — helps you configure and manage user access for your ONTAP tools for VMware vSphere 10 deployment.

Overview of the administrative options

There are several options available when using ONTAP RBAC depending on your environment and goals. The following sections provide an overview of the major administrative decisions. Also see ONTAP Automation: Overview of RBAC security for more information.

Note ONTAP RBAC is tailored to a storage environment and is simpler than the RBAC implementation provided with vCenter Server. With ONTAP, you assign a role directly to the user. Unlike vCenter Server, ONTAP RBAC does not require you to configure explicit permissions.
Types of roles and privileges

An ONTAP role is required when defining an ONTAP user. There are two types of ONTAP roles:

  • REST

    The REST roles were introduced with ONTAP 9.6 and are generally applied to users accessing ONTAP through the REST API. The privileges included in these roles are defined in terms of access to the ONTAP REST API endpoints and the associated actions.

  • Traditional

    These are the legacy roles that existed prior to ONTAP 9.6. They continue to be a foundational aspect of RBAC. The privileges are defined in terms of access to the ONTAP CLI commands.

While the REST roles were introduced more recently, the traditional roles offer some advantages. For example, you can include additional query parameters so that privileges more precisely define the objects that they apply to.

Scope

ONTAP roles can be defined with one of two different scopes. They can be applied to a specific data SVM (SVM level) or to the entire ONTAP cluster (cluster level).

Role definitions

ONTAP provides a set of pre-defined roles at both the cluster and SVM level. You can also define custom roles.

Working with ONTAP REST roles

Keep the following in mind when using the ONTAP REST roles included with ONTAP tools for VMware vSphere 10.

Role mapping

Whether using a traditional or REST role, all ONTAP access decisions are made based on the underlying CLI command. But because the privileges in a REST role are defined in terms of the REST API endpoints, ONTAP needs to create a mapped traditional role for each of the REST roles. Therefore each REST role maps to an underlying traditional role. This allows ONTAP to make access control decisions in a consistent way regardless of the role type. You cannot modify the parallel mapped roles.

Defining a REST role using CLI privileges

Because ONTAP always uses the CLI commands to determine access at a base level, it's possible to express a REST role using CLI command privileges instead of REST endpoints. One benefit of this approach is the additional granularity available with the traditional roles.

Administrative interface when defining ONTAP roles

You can create users and roles with the ONTAP CLI and REST API. However, it's more convenient to use the System Manager interface along with the JSON file available through the ONTAP tools Manager. See Use ONTAP RBAC with ONTAP tools for VMware vSphere 10 for more information.