Jump to main content

# Roles and associated permissions

Users gain access to a storage system or component directly through a role assignment or indirectly through membership in a user group that has a role assignment.

A Unisphere user can assume several roles. Tasks and associated permissions are associated with each role. The Role Based Access Control (RBAC) feature provides a method for restricting the management operations that individual users or groups of users may perform on storage systems.

Users gain access to a storage system or component either directly through a role assignment and/or indirectly through membership in a user group that has a role assignment.

If a user has two different role assignments (one as an individual and one as a member of a group), the permissions that are assigned to the user are combined. For example, if a user is assigned a Monitor role and a StorageAdmin role through a group, the user is granted Monitor and StorageAdmin rights.

The following diagram outlines the role hierarchy.

Roles are assigned as part of the user creation process (see Create local users).

The following tables detail the permissions that are associated with each role in Unisphere. You can assign up to four of these roles per authorization rule.

| NOTE: In addition to these user roles, Unisphere includes an administrative role, the Initial Setup User.. This role, defined during installation, is a temporary role that provides administrator-like permissions for adding local users and roles to Unisphere.

The roles (and the acronyms that are used for the roles) in these tables are:

- None—Provides no permissions.
- Monitor (MO)—Performs read-only (passive) operations on a storage system excluding the ability to read the audit log or access control definitions.
- StorageAdmin (SA)—Performs all management (active or control) operations on a storage system and modifies GNS group definitions in addition to all Monitor operations.
- Admin (AD)—Performs all operations on a storage system, including security operations, in addition to all StorageAdmin and Monitor operations.
- SecurityAdmin (SecA)—Performs security operations on a storage system, in addition to all Monitor operations.
- Auditor (AUD)—Grants the ability to view, but not modify, security settings for a storage system (including reading the audit log, symacly list, and symauth) in addition to all Monitor operations. It is the minimum role that is required to view the storage system audit log.
- PerfMonitor (PM)—Performs read-only (passive) operations on performance management functionality. This role also includes Monitor rights.
- MainframeAdmin (MA)—Grants user rights to perform mainframe control and configuration operations on Splits and CU images. This role also grants the rights to perform z/OS Map and Unmap operations on CKD devices. This role also includes Monitor rights for non-mainframe operations.
- Local Replication—Performs local replication operations (SnapVX or legacy Snapshot, Clone, BCV). To create Secure SnapVX snapshots, a user must have Storage Admin rights at the storage system level. This role also includes Monitor rights.
- Remote Replication—Performs remote replication (SRDF) operations involving devices and pairs. Users can create, operate upon, or delete SRDF device pairs but cannot create, modify, or delete SRDF groups. This role also includes Monitor rights.
- Device Management—Grants user rights to perform control and configuration operations on devices. Storage Admin rights are required to create, expand, or delete devices. This role also includes Monitor rights.

| NOTE: The RBAC roles for performing local and remote replication actions are outlined in Roles for performing local and remote replication actions.

| NOTE: The RBAC roles for SRDF local and remote replication actions are outlined in RBAC roles for SRDF local and remote replication actions.

| NOTE: The RBAC roles for TimeFinder SnapVX local and remote replication actions are outlined in RBAC roles for TimeFinder SnapVX local and remote replication actions.

Table 1. User roles and associated permissions
Permissions | AD | SA | MO | SecA | AUD | None | PM | MA
--- | --- | --- | --- | --- | --- | --- | --- | ---
Create/delete user accounts | Yes | No | No | Yes | No | No | No | No
Reset user password | Yes | No | No | Yes | No | No | No | No
Create roles | Yes | Yes | No | Yes (self-excluded) | No | No | No | No
Change own password | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes
Manage storage systems | Yes | Yes | No | No | No | No | No | No
Discover storage systems | Yes | No | No | Yes | No | No | No | No
Add/show license keys | Yes | Yes | No | No | No | No | No | No
Set alerts and Optimizer monitoring options | Yes | Yes | No | No | No | No | No | No
Release storage system locks | Yes | Yes | No | No | No | No | No | No
Set Access Controls | Yes | Yes | No | No | No | No | No | No
Set replication and reservation preferences | Yes | Yes | No | No | No | No | No | No
View and export the storage system audit log | Yes | No | No | Yes | Yes | No | No | No
Access performance data | Yes | Yes | Yes | Yes | Yes | No | Yes | Yes
Start data traces | Yes | Yes | Yes | Yes | Yes | No | Yes | Yes
Set performance thresholds/alerts | Yes | Yes | No | No | No | No | Yes | Yes
Create and manage performance dashboards | Yes | Yes | Yes | Yes | Yes | No | Yes | Yes

Table 2. Permissions for Local Replication, Remote Replication and Device Management roles
Permissions |  |  |
--- | --- | --- | ---
Local Replication | Remote Replication | Device Management
Create/delete user accounts | No | No | No
Reset user password | No | No | No
Create roles | No | No | No
Change own password | Yes | Yes | Yes
Manage storage systems | No | No | No
Discover storage systems | No | No | No
Add/show license keys | No | No | No
Set alerts and Optimizer monitoring options | No | No | No
Release storage system locks | No | No | No
Set Access Controls | No | No | No
Set replication and reservation preferences | No | No | No
View the storage system audit log | No | No | No
Access performance data | Yes | Yes | Yes
Start data traces | Yes | Yes | Yes
Set performance thresholds/alerts | No | No | No
Create and manage performance dashboards | Yes | Yes | Yes
Perform control and configuration operations on devices | No | No | Yes
Create, expand, or delete devices | No | No | No
Perform local replication operations (SnapVX, legacy Snapshot, Clone, BCV) | Yes | No | No
Create Secure SnapVX snapshots | No | No | No
Create, operate upon, or delete SRDF device pairs | No | Yes | No
Create, modify, or delete SRDF groups | No | No | No