Overview of VAST Providers
VAST providers let you manage users and groups on the VAST cluster without the need to connect an external authentication and authorization provider, such as Active Directory or LDAP. You can create multiple VAST providers and associate each provider with one or more tenants. This feature is useful for:
Adding users when you do not have an external provider configured. (This is an option for NFS and S3 access.)
Adding users who are not defined on external providers who specifically need S3 access. (Users who are defined on external providers can be assigned S3 permissions without being added to the VAST provider.
Adding POSIX attributes for a user who is defined on Active Directory but only has SMB attributes there and is not defined in an additional configured external provider. In this case, use the same user name as is used on Active Directory so that the user database will associate these attributes to the same user.
Adding users to manually override incorrect or outdated attributes on external providers.
In case of any conflict between user attributes on any external authorization provider and the VAST provider, the VAST provider attributes override the non-VAST provider. For more details, see Overview of User Management and Authorization.
Local users are created with a UID and user name that you supply manually. A unique SID is generated by the cluster for each local user. You can specify the user's leading group and other groups by name, using names of manually added groups.
Note
VAST provider user entries are not included in S3 backup.
Managing Local Users
You can manage users and groups in VAST providers on the VAST cluster, without the need to connect an external authentication and authorization provider, such as Active Directory or LDAP. You can create multiple VAST providers and associate each provider with one or more tenants. VAST providers are useful for:
Adding users when you do not have an external provider configured.
Adding POSIX attributes for a user who is defined on Active Directory without POSIX attributes. In this case, use the same user name as is used on Active Directory so that the user database will associate these attributes to the same user.
Adding users to manually override incorrect or outdated POSIX attributes on external providers.
In case of any conflict between user POSIX attributes on any external authorization provider and the VAST provider, the VAST provider attributes override the external provider. For more details, see Overview of User Management and Authorization.
Note
VAST provider user entries are not included in S3 backup.
Creating a Local User in VAST Web UI
From the left navigation menu, choose User Management and then Local Users.
In the Local Users tab, click Create Local User and complete the following fields:
Name (required)
The user name.
UID
The user's POSIX UID.
VAST provider (required)
Select the VAST provider with which the user will be associated. If additional providers are created (in the VAST Providers tab), you can select one of them.
Leading group
The name of the user's leading group.
This is the group assigned by default as the owning group of any files created by the user.
Select the group from the dropdown. If the group has not been added to the VAST provider, add the group first.
Groups
Names of other groups that the user belongs to beside the leading group. Also known as auxiliary groups.
Select groups from the dropdown. If a group has not been added to the VAST provider, add the group first.
Select tenant to see user details
Select a tenant from the list. Tenants associated with the selected VAST provider (if any) are shown, as well as the default tenant.
Temporary password and Generate Password
Enter a temporary password for the user, or click Generate Password to have it generated.
The password is needed if the local user is required to login to VMS. The password can be any string matching the password requirements set in VMS settings. The user will be required to change the password when they first login using it. If the user has access to multiple tenants, the same password is used to log in to all of them.
Allow Create Bucket
Enable this setting to give the user permission to create S3 buckets. The setting will apply to the user for the selected Tenant (it could be set differently for the same user in a different tenant).
Disabled by default.
Allow Delete Bucket
Enable this setting to give the user permission to delete S3 buckets. The setting will apply to the user for the selected Tenant (it could be set differently for the same user in a different tenant).
Disabled by default.
Identity Policies
Optionally, select one or more S3 identity policies to assign to the user. If needed, click Add Identity Policy to create a policy first. The list of policies shown are for the selected tenant, if a tenant is associated with the provider.
Click Create. The user is created. Once the user is created, you can update it and add S3 access keys to it. Follow the steps in Modifying a User in VAST Web UI.
Modifying a User in VAST Web UI
From the left navigation menu, select User Management and then Local Users.
In the Local Users page that opens, right-click the user, and select Edit.
In the Update User dialog that opens, make the changes you need and click Update, including adding S3 access keys.
The user is updated with the changes.
Removing a User in VAST Web UI
From the left navigation menu, choose User Management and then Local Users.
In the Local Users page that opens, right-click the user that you want to edit and select Remove.
In the confirmation popup, click Yes to confirm the removal.
The user is deleted from the VAST provider.
Querying a Local User in VAST Web UI
Managing Local Users in VAST CLI
To manage local users using the VAST CLI, use the following commands:
Task | Command |
|---|---|
Add a user | |
Modify a user | |
Query local users | |
Display all local users | |
Display details of a specific local user | user show |
Query a user by prefix | |
Copy users from the default VAST provider to another VAST provider | user copy |
Managing Local Groups
Groups must be added to the VAST provider in order to be associated with a local user. When creating a group, you specify a group name and a GID. A SID is generated for the group.
When providers are queried for groups, groups that are duplicated on multiple external providers are merged by group name. If the different instances of the same group name have conflicting GIDs or SIDs, the attributes of the local group override those of all other providers.
Creating a Group in VAST Web UI
From the left navigation menu, select User Management and then the Local Groups tab.
On the Local Groups page that opens, click Create Group.
In the Add Group dialog, complete the fields:
Field
Description
Name (required)
Enter a name for the group.
GID (required)
Enter a POSIX group ID (GID) for the group.
VAST provider (required)
Optionally, select the VAST provider with which the group will be associated. If additional providers are added (in the VAST Providers tab), you can select one of them.
Tenant
Select a tenant from the list. Tenants associated with the selected VAST provider (if any) are shown, as well as the default tenant.
Identity Policies
Optionally, select one or more S3 identity policies to assign to the group. If needed, click Add Identity Policy to create a policy first. The list of policies shown are for the selected tenant, if a tenant is associated with the provider.
Click Create. The group is created.
Modifying a Group in VAST Web UI
From the left navigation menu, select User Management and then the Local Groups tab.
In the Local Groups page, right-click on the group you want to modify, and select Edit.
In the Update Group dialog that opens, make the changes you need and click Update.
The group is updated with the changes.
Removing a Group in VAST Web UI
From the left navigation menu, select User Management and then the Local Groups tab.
In the Local Groups page, right-click on the group you want to delete, and select Remove.
In the confirmation popup, click Yes to confirm. The group is removed from the VAST provider.
Managing Local Groups in VAST CLI
To manage local groups using the VAST CLI, use the following commands.
Task | Command |
|---|---|
Create a group |
|
List groups |
|
Modify a group |
|
Delete a group |
|
Show details of a group |
|
Query a group |
|
Query a group by prefix |
|
Managing VAST Providers
Creating a VAST Provider using the VAST Web UI
Navigate to User Management -> VAST Providers.
Click Add New Provider and select VAST Provider in the dropdown list.
In the Create VAST Provider dialog, complete the fields:
Name
The name for the provider, as it will appear in the list in the VAST Providers page.
Description
A description for the provider.
Cluster admin
When selected, VMS manager users that have a user type of Cluster Admin can view and manage users for this provider.
Tenant admin
When selected, VMS manager users that have a user type of Tenant Admin can view and manage users for this provider.
Tenant admins can view users in the tenant they administer, even if they are not assigned to manage them.
Click Create. The provider appears in the list in the VAST Providers page.
Modifying a VAST Provider using the VAST Web UI
Navigate to User Management in the VAST Web UI, and then select VAST Providers.
Select the provider to be modified, right-click and then select Edit.
Make changes to parameters for the provider, as necessary, and then click Update.
Removing a VAST Provider using the VAST Web UI
You can remove a VAST provider if it is not associated with a tenant, and it has no users or groups.
Navigate to User Management in the VAST Web UI, and then select VAST Providers.
Select the provider to be modified, right-click and then select Remove.
Managing VAST Providers using the VAST CLI
You can manage VAST providers in the VMS CLI using the following commands:
Task | Command |
|---|---|
Create a new VAST provider | |
Modify VAST providers | |
Remove VAST providers | |
Show details for a specific VAST provider | |
List all VAST providers |