Skip to main content

Sync tenant groups and users in StorageGRID

Contributors netapp-lhalbert netapp-perveilerk
PDFs

If a tenant was created or edited to use grid federation connections, that tenant is replicated from one StorageGRID system (the source tenant) to all other connected StorageGRID systems (the replica tenants). After the tenant has been replicated, tenant groups, users, and S3 access keys are synced across the connected grids.

The StorageGRID system where the tenant is originally created is the tenant's source grid. The tenant is replicated to one or more destination grids. The tenant accounts on all connected grids have the same account ID, name, description, storage quota, assigned permissions, and root user password. For details, refer to Learn about account sync for grid federation and Manage permitted tenants.

The syncing of tenant account information is required for cross-grid replication of bucket objects. Having the same tenant groups and users on all grids ensures you can access the corresponding buckets and objects on any connected grid.

Tenant workflow for account sync

If your tenant account has the Use grid federation connection permission, review the workflow diagram to see the steps you will perform to sync groups, users, and S3 access keys.

the tenant's workflow for account sync. Steps are described in the following text.

These are the primary steps in the workflow:

One Sign in to tenant

Sign in to the tenant account on any connected grid.

Two Optionally, configure identity federation

If your tenant account has the Use own identity source permission to use federated groups and users, configure the same identity source (with the same settings) for the source and one or more destination tenant accounts. Federated groups are cloned at creation time, and federated users are cloned when a key is created. For clone to happen, the same identity source must be configured on all grids. For instructions, see Use identity federation.

Three Create groups and users

You can create groups and users from any connected grid. When you add a new local group, StorageGRID automatically syncs it to all connected grids. Changes to local groups (edit, delete) are also continuously synced. Federated groups are cloned once at creation.

  • If identity federation is configured for the entire StorageGRID system or for your tenant account, create new tenant groups by importing federated groups from the identity source.

Four Create S3 access keys

You can create your own access keys or to create another user's access keys on any grid to access buckets on all connected grids.

Five Sync S3 access keys

If you need to access buckets with the same access keys on all grids, create the access keys on one of the grids. For local users, the access keys are automatically synced by default. For federated users, you must create S3 access keys on the source grid and select Enable access key sync for the keys to be synced to all destination grids.

How are groups, users, and S3 access keys synced?

Review this section to understand how groups, users, and S3 access keys are synced across connected grids.

Local groups are continuously synced

After a tenant account is created and replicated to the destination grid, StorageGRID continuously syncs local groups across all connected grids. All changes to local groups—including create, edit, and delete operations—made on any grid are automatically replicated to all other connected grids.

Both the original group and its synced copies have the same access mode, group permissions, and S3 group policy. For instructions, refer to Create groups for S3 tenant.

Local users are continuously synced

When you create a new local user on any connected grid, StorageGRID automatically syncs that user to all other connected grids. Subsequent changes—including edits, deletes, and password resets—are also continuously synced. The original user and its synced copies have the same full name, username, and Deny access setting. The same users on each grid also belong to the same groups. For instructions, refer to Manage users.

Federated groups are synced once at creation

Assuming the requirements for using account sync with single sign-on and identity federation have been met, federated groups that you create (import) for the tenant on a grid are automatically synced to the tenant on all other connected grids.

Both groups have the same access mode, group permissions, and S3 group policy.

After federated groups are created for the source tenant and synced to other grids, federated users can sign in to the tenant on any connected grid. Subsequent changes to federated groups are not automatically synced across grids.

S3 access keys can be automatically or manually synced

By default, StorageGRID automatically syncs S3 access keys. For security, you can disable automatic syncing of S3 access keys for each tenant and have different keys for each tenant on each grid.

To manage access keys on connected grids, you can do either of the following:

Note When you sync S3 access keys for a federated user, both the user and the S3 access keys are synced to the destination tenants.
Note S3 access keys owned by local users are continuously synced across connected grids, including when keys are deleted. S3 access keys owned by federated users are synced once at creation; subsequent changes, including deletes, are not replicated. You can enable or disable access key sync for each tenant connection.

Groups and users added to destination grid are synced

Changes made on any connected grid, including creating or importing local groups and users, are automatically synced to all other connected grids.

Edited or deleted local groups, users, and access keys are synced

Changes to local groups, local users, and S3 access keys owned by local users are continuously synced across all connected grids. Synced operations include edits, deletes, and password resets.

Changes to federated groups and S3 access keys owned by federated users aren't synced after initial creation.