Skip to main content

Manage ONTAP administrator approval groups for MAV

Contributors netapp-andreajost netapp-aaron-holt netapp-bhouser netapp-forry netapp-aoife netapp-dbagwell
PDFs

Before enabling multi-admin verification (MAV), you must create an admin approval group containing one or more administrators to be granted approve or veto authority. Once you have enabled multi-admin verification, any modifications to approval group membership requires approval from one of the existing qualified administrators.

About this task

You can add existing administrators to a MAV group or create new administrators.

MAV functionality honors existing role-based access control (RBAC) settings. Potential MAV administrators must have sufficient privilege to execute protected operations before they are added to MAV administrator groups. Learn more about RBAC.

You can configure MAV to alert MAV administrators that approval requests are pending. To do so, you must configure email notifications—​in particular, the Mail From and Mail Server parameters—​or you can clear these parameters to disable notification. Without email alerts, MAV administrators must check the approval queue manually.

Beginning with ONTAP 9.15.1, you can configure Active Directory (AD) users as MAV administrators. The AD user must be configured as an ONTAP administrator.

Beginning with ONTAP 9.20.1, approval groups can also include identity provider (IdP), Active Directory (AD), or LDAP (nsswitch) groups. Supported group types include Entra ID (formerly Azure AD), ADFS, AD domain groups, and LDAP groups.

Changes to a user's group membership in the identity provider take effect upon the user's next successful login. No MAV reconfiguration is required.

Note Before you can add an IdP, AD, or LDAP group to a MAV approval group, the group must already have login access configured and must be registered in the security login group table with a role mapping. See the following procedures.

System Manager procedure

If you want to create a MAV approval group for the first time, see the System Manager procedure to enable multi-admin verification.

To modify an existing approval group or create an additional approval group:

  1. Identify administrators to receive multi-admin verification.

    1. Select Cluster > Settings.

    2. Select Arrow icon next to Users, groups, and roles.

    3. Select Add icon under Users.

    4. Modify the roster as needed.

      For more information, see Control administrator access.

  2. Beginning with ONTAP 9.20.1, if you want to add an IdP, AD, or LDAP group as a MAV approver, first register the group so it can be referenced in the MAV configuration.

    1. Under Groups, select Add icon to add a group.

      Enter the group name. The UUID field is required only for Microsoft Entra groups; other identity providers use the group name.

    2. Under Group to role mapping, select Add icon, select the group, and assign a role with sufficient privileges to approve MAV requests.

  3. Create or modify the MAV approval group:

    1. Select Cluster > Settings.

    2. Select Arrow icon next to Multi-Admin Approval in the Security section. (You will see the Actions icon icon if MAV is not yet configured.)

      • Name: enter a group name.

      • Approvers (users): select individual approvers from a list of users.

      • Approvers (groups): beginning with ONTAP 9.20.1, optionally select one or more registered IdP, AD, or LDAP groups.

      • Email address: enter email address(es).

      • Default group: select a group.

MAV approval is required to edit an existing configuration once MAV is enabled.

CLI procedure

  1. Verify that values have been set for the Mail From and Mail Server parameters. Enter:

    event config show

    The display should be similar to the following:

    cluster01::> event config show
                           Mail From:  admin@localhost
                         Mail Server:  localhost
                           Proxy URL:  -
                          Proxy User:  -
 Publish/Subscribe Messaging Enabled:  true

    To configure these parameters, enter:

    event config modify -mail-from email_address -mail-server server_name

    Learn more about event config show and event config modify in the ONTAP command reference.

  2. Identify administrators to participate in multi-admin verification.

    If you want to… Enter this command

    Display current administrators

    security login show

    Modify credentials of current administrators

    security login modify <parameters>

    Create new administrator accounts

    security login create -user-or-group-name admin_name -application ssh -authentication-method password

    Learn more about security login show, security login modify, and security login create in the ONTAP command reference.

  3. Beginning with ONTAP 9.20.1, if you want to add an IdP, AD, or LDAP group as a MAV approver, confirm the group has login access configured, then register it for MAV.

    If the group does not already have login access configured, enter:

    security login create -user-or-group-name group_name -application http|ssh -authentication-method domain|nsswitch|saml|oauth2 -role role

    Then register the group so it can be referenced in the MAV configuration, and map it to a role:

    security login group create -vserver svm_name -name group_name [-uuid uuid]

    security login group role-mapping create -group-id group_id -role role

    The -uuid parameter is required only for Microsoft Entra ID groups. AD domain, ADFS/SAML, and LDAP (nsswitch) groups are identified by name only.

    Example: The following commands register the AD group mydomain\mav_approvers for MAV and map it to the admin role.

    cluster-1::> security login group create -vserver cluster-1 -name mydomain\mav_approvers
cluster-1::> security login group show -vserver cluster-1

     Vserver: cluster-1
  Group Name: mydomain\mav_approvers
    Group ID: 1
  Group UUID: -
     Comment: -

cluster-1::> security login group role-mapping create -group-id 1 -role admin

    Learn more about security login group create and security login group role-mapping create in the ONTAP command reference.

  4. Create the MAV approval group:

    security multi-admin-verify approval-group create [ -vserver svm_name] -name group_name [-approvers approver1[,approver2…]] [-groups group1[,group2…]] [[-email address1], address1…​]

    • -vserver - Only the admin SVM is supported in this release.

    • -name - The MAV group name, up to 64 characters.

    • -approvers - The list of one or more individual approvers. For AD users, use the format domain\user. For example, mydomain\pavan.

    • -groups - The list of one or more IdP, AD, or LDAP groups to include in the approval group. Each group must already be registered in the security login group table with a role mapping.

    • -email - One or more email addresses that are notified when a request is created, approved, vetoed, or executed.

      Example: The following command creates a MAV group with two individual approvers and one Entra ID group.

      cluster-1::> security multi-admin-verify approval-group create -name mav-grp1 -approvers pavan,julia -groups entra-group-mav-approvers -email pavan@myfirm.com,julia@myfirm.com

  5. Verify group creation and membership:

    security multi-admin-verify approval-group show

    Example:

    cluster-1::> security multi-admin-verify approval-group show
Vserver  Name        Approvers        Approver Groups                  Email
-------  ---------------- ------------------  ------------------------------- ------------------------------------------------------------
svm-1    mav-grp1   pavan,julia      entra-group-mav-approvers        pavan@myfirm.com,julia@myfirm.com

Use these commands to modify your initial MAV group configuration.

Note: All require MAV administrator approval before execution.

If you want to… Enter this command

Modify the group characteristics or modify existing member information

security multi-admin-verify approval-group modify [-vserver svm_name] -name group_name [-approvers approver1[,approver2…]] [-groups group1[,group2…]] [[-email address1], address1…​]

Add or remove members

security multi-admin-verify approval-group replace [-vserver svm_name] -name group_name [-approvers-to-add approver1[,approver2…]][-approvers-to-remove approver1[,approver2…]] [-groups-to-add group1[,group2…]][-groups-to-remove group1[,group2…]]

Delete a group

security multi-admin-verify approval-group delete [-vserver svm_name] -name group_name
Related information