Managing Administrative Roles

Managing Administrative Roles in VAST Web UI

You can manage permissions through administrative roles. Managers can belong to any number of roles. Managers inherit all permissions enabled for any roles they belong to.

VAST Cluster includes several default roles that are created during cluster deployment to cover some specific use cases, such as the read-only or csi role. Do not modify these roles. If you'd like to alter a default role, create a copy of the default role and modify the copy as needed.

Viewing Administrative Roles

From the left navigation menu, select Administrators and then Administrative Roles.

The following information can be displayed for each role:

Tip
To display or hide fields, click to the right of a column title, and then click to open a dropdown where you can select or unselect fields.

ID	The ID of the role.
Name	The name of the role.
Managers	Names of managers who have this role.
Managers Count	The number of managers who have this role.
LDAP Groups	LDAP groups associated with this role.
Tenants	Tenants associated with this role.
Default	Indicates whether this role is default.

To review permissions granted by a role, right-click the role and select View.

Adding Administrative Roles

From the left navigation menu, select Administrators and then Administrative Roles.
Click Create Administrative Role to open the Create Administrative Role dialog.
In the Tenant field, enter the names of the tenants associated with this role.
In the Name field, enter a name for the role .
Select the permissions you want to include in the role.
If you want to associate authentication provider group(s) with the role, enter each group in the format <groupname>@<domain> in the Active Directory/LDAP groups field.
Users who belong to groups that are associated with the role will be able to log into VMS using their LDAP user name and password. They will be authorized based on the role(s) associated with their group.
To enter a group, start typing the initial characters and then select an auto-complete option.
Note
If the group is on a provider that is not configured as a VMS authentication provider, enter the group name manually.
To enter more than one group, enter the first group, then enter a comma and then enter another group. Each group is entered into the field with a removal button (). You can use the remove button to remove any group.
Each group can be any group on any connected LDAP-based provider, including Active Directory. Groups can be associated with multiple roles and vice versa.
If you want to allow SSH access to cluster's CNodes with provider-based authentication, select Enable OS SSH Login. If enabled, the users that are members of the group(s) specified in the Active Directory/LDAP groups field, will be able to log in to the cluster's nodes via SSH with permissions same as of the vastdata user.
Caution
Consider security implications before granting SSH access to the CNodes.
Note
This feature requires that all CNodes are running VAST OS version 12.15.55-2529260 or later.
When you're done, click Create.
The role is added.

Tip
To assign the role to a manager, update the manager.

Modifying Administrative Roles

Whenever you modify a role and change the permission set enabled for the role, you automatically update the inherited permissions of all the managers who have the role.

Do not modify default roles. If you'd like to alter a default role, create a copy of the default role and modify the copy as needed.

From the left navigation menu, select Administrators and then Administrative Roles.
Right-click the role you want to modify, and select Edit.
Make changes as needed (see Adding Administrative Roles).
Click Update.
The role is modified.

Deleting Administrative Roles

Caution
Deleting a role can remove permissions from managers who have the role.

From the left navigation menu, select Administrators and then Administrative Roles.
Right-click the role you want to delete, and then select Remove.
Click Yes to confirm the removal.
The role is deleted.