PowerScale OneFS 9.3.0.0 CLI Administration Guide

Create a new role and add a user

You can create a new role and then add a user to the new role.

1. To create a new role, run the isi auth roles create command in zone1.

    isi auth roles create --name Zone1SMBAdmin --zone zone1

2. To view the newly added role in the authentication list, run the isi auth roles list command.

   isi auth roles list --zone zone1
   Name
   -----------------
   BasicUserRole
   Zone1SMBAdmin
   ZoneAdmin
   ZoneSecurityAdmin
   -----------------
   Total: 4
   

3. To view the details associated with the new role, run the isi auth roles view command.

    isi auth roles view Zone1SMBAdmin --zone zone1
          Name: Zone1SMBAdmin
   Description: -
       Members: -
    Privileges
                ID: -
        Permission: -
   

4. To add a privilege to the new role, run the isi auth roles modify command.

   isi auth roles modify --zone zone1 Zone1SMBAdmin --add-priv ISI_PRIV_SMB

   NOTE: You can also add a description to the new role using the isi auth roles modify command.

   isi auth roles modify --zone zone1 Zone1SMBAdmin --description "Zone1 SMB Admin"
   

5. To view whether the privilege and description of the new role were added, run the following command.

   isi auth roles view Zone1SMBAdmin --zone zone1
          Name: Zone1SMBAdmin
   Description: Zone1 SMB Admin
       Members: -
    Privileges
            ID: ISI_PRIV_SMB
    Permission: w
   

6. Run the isi auth user create command to create a user to add to the new role.
   You can only add existing users to a role. The isi auth roles modify command does not create the user for you.

   isi auth user create z1-user3 --zone zone1 --enabled True --set-password
   password: <enter password>
   confirm: <re-enter password>
   

7. To add a user to the new role, run the isi auth roles modify command again.

   isi auth roles modify --zone zone1 Zone1SMBAdmin --add-user z1-user3
   

   NOTE: You can also add read privilege to the new user using the isi auth roles modify command.

   isi auth roles modify --zone zone1 Zone1SMBAdmin --add-priv-read ISI_PRIV_LOGIN_PAPI
   

8. To view whether the new user was assigned the new role along with the read privilege, run the following command:

   isi auth roles view Zone1SMBAdmin --zone zone1
          Name: Zone1SMBAdmin
   Description: Zone1 SMB Admin
       Members: z1-user3
    Privileges
                ID: ISI_PRIV_LOGIN_PAPI
         Permission: r
   
                ID: ISI_PRIV_SMB
         Permission: w