Administrator authentication & RBAC

Authentication proves who the administrator is; the login maps that identity and application to a role; RBAC decides which command directories or API endpoints the session may use.

Cluster admin and SVM admin scopes

The admin SVM represents the cluster-management scope. Cluster roles can manage cluster-wide resources. A data SVM administrator is scoped to that SVM and its delegated capabilities; built-in vsadmin role variants provide common SVM administration boundaries. Inspect what exists rather than assuming every release has the same built-ins.

cluster::> security login show -vserver svm1
Vserver  User/Group  Application  Auth Method  Role
svm1     svmops      ssh          password     vsadmin
svm1     DOMAIN\nas  ssh          domain       vsadmin-volume

Accounts are application-specific

A user can have distinct login records for console, ssh, http and legacy ontapi. ONTAP 9.19.1 accepts authentication methods including password, domain, nsswitch, publickey, cert, saml and others subject to application constraints. Create only the combinations needed.

cluster::> security login create -vserver cluster1 -user-or-group-name alice \
  -application ssh -authentication-method password -role readonly
Please enter a password for user 'alice':
Please enter it again:
cluster::> security login show -user-or-group-name alice
Vserver   User/Group  Application  Auth Method  Role
cluster1  alice       ssh          password     readonly

ontapi is the legacy API application. Prefer REST for new automation and remove unused application logins after dependency testing.

AD and LDAP-backed administrators

domain uses domain authentication; nsswitch uses the SVM name-service configuration. DNS, time, LDAP/AD reachability and name-service order must already work. See NTP, DNS & name services.

cluster::> security login create -vserver cluster1 \
  -user-or-group-name "CORP\storage-admins" -application ssh \
  -authentication-method domain -role storage-ops
cluster::> security login create -vserver svm1 -user-or-group-name nasops \
  -application ssh -authentication-method nsswitch -role vsadmin
2 login records created.

cluster::> vserver services name-service ns-switch show -vserver svm1
Vserver  Database  Source Order
svm1     passwd    files,ldap
svm1     group     files,ldap
cluster::> vserver services name-service ldap client show -vserver svm1
Vserver  Client Configuration
svm1     corp-ldap

SAML for System Manager

SAML is not a 9.12-only feature: NetApp documents it beginning with ONTAP 9.3. It applies only to http/ontapi on the admin SVM, not SSH, and authenticates remote users through an IdP. When enabled, System Manager access behavior changes; maintain tested console recovery because a broken IdP configuration can lock out the GUI. IdP group-to-role mapping begins in 9.17.1; check your version.

cluster::> security saml-sp create -idp-uri https://idp.example.com/metadata \
  -sp-host cluster-mgmt.example.com
[Job 179] Job succeeded: Access the SAML SP metadata using the displayed URL.
cluster::> security saml-sp modify -is-enabled true
cluster::> security login create -vserver cluster1 -user-or-group-name alice \
  -application http -authentication-method saml -role readonly

RBAC: role entries, not vague capabilities

The 9.19.1 CLI uses -cmddirname, -access and optional -query. It does not use -capability all for CLI command roles. Access values include none, readonly, creation/modification combinations, and all. A query can constrain applicable objects. security login role config modify controls account/password restrictions for a role; it does not grant commands.

cluster::> security login role create -vserver cluster1 -role storage-auditor \
  -cmddirname "volume show" -access readonly
cluster::> security login role modify -vserver cluster1 -role storage-auditor \
  -cmddirname "volume show" -access readonly
cluster::> security login role show -vserver cluster1 -role storage-auditor
Role             Command / Directory  Access
storage-auditor  volume show          readonly

Least-privilege example: replication observer

Create explicit show-command entries and then map the account. Confirm the effective behavior in a test session: command-directory inheritance and defaults can surprise.

cluster::> security login role create -vserver cluster1 -role dp-observer \
  -cmddirname "snapmirror show" -access readonly
cluster::> security login role create -vserver cluster1 -role dp-observer \
  -cmddirname "volume show" -access readonly
cluster::> security login role create -vserver cluster1 -role dp-observer \
  -cmddirname DEFAULT -access none
cluster::> security login create -vserver cluster1 -user-or-group-name dp-audit \
  -application ssh -authentication-method publickey -role dp-observer
4 entries were created.

cluster::> security login role show -role dp-observer
Role         Command / Directory  Access
dp-observer  DEFAULT              none
dp-observer  snapmirror show      readonly
dp-observer  volume show          readonly

Password policy and lockout

The password-change command is security login password, not security login password modify. Role-based restrictions—including minimum length, expiry and invalid-login limits—are changed with security login role config modify. Lock/unlock applies to password accounts with a password set.

cluster::> security login role config modify -vserver cluster1 -role storage-ops \
  -passwd-minlength 15 -passwd-expiry-time 90 \
  -max-failed-login-attempts 5 -lockout-duration 30
cluster::> security login password -vserver cluster1 -username alice
Enter your current password:
Enter a new password:

cluster::> security login lock -vserver cluster1 -username alice
cluster::> security login unlock -vserver cluster1 -username alice
The user account "alice" has been unlocked.

The often-guessed -second-auth-lockout-threshold is not the normal password lockout control here; check active help for MFA-specific parameters on your release.

Audit administrator actions

ONTAP records management activity separately from NAS file-access audit. Centralize time and retain evidence off-box; review role and login changes as high-signal events. Follow the audit & event logging guide and security hardening checklist.

cluster::> security audit log show -time >1h
Time                 User   Application  Command
8/27/2026 14:02:11   alice  ssh          volume show
8/27/2026 14:04:32   admin  ssh          security login role create ...

Practice	Reason
Named, separate admin accounts	Attribution and individual revocation; no shared identities.
IdP MFA for System Manager	Strong external policy, while preserving tested console recovery.
Public keys/certificates for automation	Avoid interactive passwords and narrow application/role scope.
Disable unused applications	Every login record is another management path.
Quarterly role recertification	Privileges otherwise accumulate as duties change.

Troubleshooting

Symptom	Check	Action
Login failed	Exact application/auth method, DNS/time, domain/LDAP reachability, EMS.	Test the identity source and matching login record.
Account locked	Password account status and role lockout policy.	Investigate attempts, then `security login unlock`.
Password expired	Role config and warning/expiry values.	Use a permitted SSH/console recovery path and rotate.
Command denied	Role entries, DEFAULT entry, query and scope.	Add only the required command/query after review.
SAML loop	SP hostname/certificate, IdP metadata, clocks and username mapping.	Use console recovery; repair or disable SAML.

cluster::> event log show -time >30m -severity ERROR -message-name *auth*
Time                 Node   Severity  Event
8/27/2026 14:20:10   node1  ERROR     secd.authentication.server.failure: ...
cluster::> security login show -user-or-group-name alice
Vserver   User  Application  Auth Method  Role
cluster1  alice ssh          password     readonly