HPE SimpliVity role based access control.
This is Ron Dharma from the SimpliVity Tech Marketing.
Role based access control can be simply defined by three
different components. The first one is by WHO provides the exact
name or the identity of the user. The second is by WHAT
provides the particular role that this user is associated
with and the last is by HOW provides the actions
associated with the associated role and also the object that this
user can perform.
So what motivates this feature? The key driver is the cloud
efficiency. You want to allow your user to be able to perform
all the actions and all the access that is appropriate
without limitation of your admin. For example, this is your
admin. He can perform all the possible SimpliVity actions for
your private cloud.
He managed multiple Department with different applications on
each department. For compliance and security reason, your admin
must limit access and actions for that Department only to the
member of that Department. Wait, he is a bottleneck now, but what
about if he allow Department a on the top left of this picture
to have its own admin?
That's just have enough capability that allows him to
delegate. Now that is the beauty of this feature.
For demo, I created a group called as SVT backup admins.
Inside the group there is a member called the SVTbackupadmin01
and this is the user that will be using for the our
demo. Inside the SimpliVity Federation Dallas. The SVTbackupAdmin user group is
already associated with the user group backup admin as shown by
this svtcli
To implement the RBAC for SimpliVity you will need to add
2 settings, roles and permissions. First. for our demo
I went into the menu to add the backup admin roles by clicking
the administration menu under the access control and roles.
This role was associated with the action that this backup
admin can perform, such as create alarm VM, power on, and
VM power off. Now the next setting is the permission. I use
global permissions so that the SVTbackup admin group can
perform the role of SimpliVity
backup user for all of the VMS.
Let's log in using the SVTbackupAdmin01 at demo
local, which has the SimpliVity role as backup
user. Now once we are in, let's figure it out. If the
SVTbackupAdmin01 can perform different operation
that is not part of the backup user role. In this case
cloning. Now try to Clone this demo and it will not complete
as we click finish button. They are work as designed.
Now let's do another demo. This time I'm going to perform
the allowed action on the backup user role, such as back
up to the external store. Yes, SVTbackupAdmin01 can backup to
external store successfully.
So what about restore? first I was doing a search on existing
backup from the demo VM, followed by clicking on the
restore VM menu. Then I provided the new VM name that is ended
with the restore-backupadmin01 and directed restore to
SVT underscore Dallas 02 data store. After clicking on the OK
button you will see that the VM was restored successfully. What
about rest API? Here in the interactive web interface I
perform a clone on existing VM as SVTbackup admin 01 after
I click the tryout button as expected the cloning is failed
and simply with the rest API errored out with the message
that this user cannot perform
the requested action. You have seen the demo of the
role based access control. For more information you can
take a look at HPE SimpliVity admin guide 4.1 or later.