Skip to main content
SnapManager for SAP

Set role-based access control capabilities and roles

Contributors
PDFs

After you enable role-based access control (RBAC) for SnapManager using SnapDrive, you can add RBAC capabilities and users to roles to perform SnapManager operations.

What you'll need

You must create a group in the Data Fabric Manager server and add the group to both primary and secondary storage systems. Run the following commands:

  • dfm group create smsap_grp

  • dfm group add smsap_grpprimary_storage_system

  • dfm group add smsap_grpsecondary_storage_system

About this task

You can use either the Operations Manager web interface or the Data Fabric Manager server command-line interface (CLI) to modify RBAC capabilities and roles.

The table lists the RBAC capabilities required to perform SnapManager operations:

SnapManager operations RBAC capabilities required when data protection is not enabled RBAC capabilities required when data protection is enabled

Profile create or profile update

SD.Storage.Read (smsap_grp)

SD.Storage.Read (SMSAP _profile dataset)

Profile protection

DFM.Database.Write (smsap_grp)

SD.Storage.Read (smsap_grp)

SD.Config.Read (smsap_grp)

SD.Config.Write (smsap_grp)

SD.Config.Delete (smsap_grp)

GlobalDataProtection

None

Backup create

SD.Storage.Read (smsap_grp)

SD.Snapshot.Write (smsap_grp)

SD.Snapshot.Read (smsap_grp)

SD.Snapshot.Delete (smsap_grp)

SD.Storage.Read (SMSAP _profile dataset)

SD.Snapshot.Write (SMSAP _profile dataset)

SD.Snapshot.Read (SMSAP _profile dataset)

SD.Snapshot.Delete (SMSAP _profile dataset)

Backup create (with DBverify)

SD.Storage.Read (smsap_grp)

SD.Snapshot.Write (smsap_grp)

SD.Snapshot.Read (smsap_grp)

SD.Snapshot.Delete (smsap_grp)

SD.SnapShot.Clone (smsap_grp)

SD.Storage.Read (SMSAP _profile dataset)

SD.Snapshot.Write (SMSAP _profile dataset)

SD.Snapshot.Read (SMSAP _profile dataset)

SD.Snapshot.Delete (SMSAP _profile dataset)

SD.SnapShot.Clone (SMSAP _profile dataset)

Backup create (with RMAN)

SD.Storage.Read (smsap_grp)

SD.Snapshot.Write (smsap_grp)

SD.Snapshot.Read (smsap_grp)

SD.Snapshot.Delete (smsap_grp)

SD.SnapShot.Clone (smsap_grp)

SD.Storage.Read (SMSAP _profile dataset)

SD.Snapshot.Write (SMSAP _profile dataset)

SD.Snapshot.Read (SMSAP _profile dataset)

SD.Snapshot.Delete (SMSAP _profile dataset)

SD.SnapShot.Clone (SMSAP _profile dataset)

Backup restore

SD.Storage.Read (smsap_grp)

SD.Snapshot.Write (smsap_grp)

SD.Snapshot.Read (smsap_grp)

SD.Snapshot.Delete (smsap_grp)

SD.SnapShot.Clone (smsap_grp)

SD.Snapshot.Restore (smsap_grp)

SD.Storage.Read (SMSAP _profile dataset)

SD.Snapshot.Write (SMSAP _profile dataset)

SD.Snapshot.Read (SMSAP _profile dataset)

SD.Snapshot.Delete (SMSAP _profile dataset)

SD.SnapShot.Clone (SMSAP _profile dataset)

SD.Snapshot.Restore (SMSAP _profile dataset)

Backup delete

SD.Snapshot.Delete (smsap_grp)

SD.Snapshot.Delete (SMSAP _profile dataset)

Backup verify

SD.Storage.Read (smsap_grp)

SD.Snapshot.Read (smsap_grp)

SD.Snapshot.Clone (smsap_grp))

SD.Storage.Read (SMSAP _profile dataset)

SD.Snapshot.Read (SMSAP _profile dataset)

SD.Snapshot.Clone (SMSAP _profile dataset)

Backup mount

SD.Storage.Read (smsap_grp)

SD.Snapshot.Read (smsap_grp)

SD.Snapshot.Clone (smsap_grp)

SD.Storage.Read (SMSAP _profile dataset)

SD.Snapshot.Read (SMSAP _profile dataset)

SD.Snapshot.Clone (SMSAP _profile dataset)

Backup unmount

SD.Snapshot.Clone (smsap_grp)

SD.Snapshot.Clone (SMSAP _profile dataset)

Clone create

SD.Storage.Read (smsap_grp)

SD.Snapshot.Read (smsap_grp)

SD.SnapShot.Clone (smsap_grp)

SD.Storage.Read (SMSAP _profile dataset)

SD.Snapshot.Read (SMSAP _profile dataset)

SD.SnapShot.Clone (SMSAP _profile dataset)

Clone delete

SD.Snapshot.Clone (smsap_grp)

SD.Snapshot.Clone (SMSAP _profile dataset)

Clone split

SD.Storage.Read (smsap_grp)

SD.Snapshot.Read (smsap_grp)

SD.SnapShot.Clone (smsap_grp)

SD.Snapshot.Delete (smsap_grp)

SD.Storage.Write (smsap_grp)

SD.Storage.Read (SMSAP _profile dataset)

SD.Snapshot.Read (SMSAP _profile dataset)

SD.SnapShot.Clone (SMSAP _profile dataset)

SD.Snapshot.Delete (SMSAP _profile dataset)

SD.Storage.Write (SMSAP _profile dataset)

For details about defining RBAC capabilities, see the OnCommand Unified Manager Operations Manager Administration Guide.

Steps

  1. Access the Operations Manager console.

  2. From the Setup menu, select Roles.

  3. Select an existing role or create a new one.

  4. To assign operations to your database storage resources, click Add capabilities.

  5. On the Edit Role Settings page, to save your changes to the role, click Update.

Related information

OnCommand Unified Manager Operations Manager Administration Guide