Creating ONTAP users - FSx for ONTAP
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Creating ONTAP users

To create a new SVM or file system user (ONTAP CLI)

Only file system users with the fsxadmin role can create new SVM and file system users.

  1. To access the NetApp ONTAP CLI, establish an SSH session on the management port of the Amazon FSx for NetApp ONTAP file system by running the following command. Replace management_endpoint_ip with the IP address of the file system's management port.

    [~]$ ssh fsxadmin@management_endpoint_ip

    For more information, see Managing file systems with the ONTAP CLI.

  2. Use the security login create ONTAP CLI command to create a new user account on your FSx for ONTAP file system or SVM.

    Insert your data for the placeholders in the example to define the following required properties:

    • -vserver – Specifies the name of the SVM where you want to create the new SVM role or user. If you are creating a file system role or user, don't specify an SVM.

    • -user-or-group-name – Specifies the username or Active Directory group name of the login method. The Active Directory group name can be specified only with the domain authentication method and the ontapi and ssh applications.

    • -application – Specifies the application of the login method. Possible values include http, ontapi, and ssh.

    • -authentication-method – Specifies the authentication method for login. Possible values include the following:

      • domain – Use for Active Directory authentication

      • password – Use for password authentication

      • publickey – User for public-key authentication

    • -role – Specifies the access-control role name for the login method. At the file system-level, the only role that can be specified is fsxadmin.

    (Optional) You can also use one or more of the following parameters with the command:

    • [-comment] – Use to include a notation or comment for the user account. For example, Guest account. The maximum length is 128 characters.

    • [-second-authentication-method {none|publickey|password|nsswitch}] – Specifies the second factor authentication method. You can specify the following methods:

      • password – Use for password authentication

      • publickey – Use for Public-key authentication

      • nsswitch – Use for NIS or LDAP authentication

      • none – The default value if you don't specify one

    Fsx0123456::> security login create -vserver vserver_name -user-or-group-name user_or_group_name -application login_application -authentication-method auth_method -role role_or_account_name

    The following command creates a new file system user new_fsxadmin with the fsxadmin-readonly role assigned, using SSH with a password for logging in. When prompted, provide a password for the user.

    Fsx0123456::> security login create -user-or-group-name new_fsxadmin -application ssh -authentication-method password -role fsxadmin-readonly Please enter a password for user 'new_fsxadmin': Please enter it again: Fsx0123456::>
  3. The following command creates a new SVM user new_vsadmin on the fsx SVM with the vsadmin_readonly role, configured to use SSH with a password to login. When prompted, provide a password for the user.

    Fsx0123456::> security login create -vserver fsx -user-or-group-name new_vsadmin -application ssh -authentication-method password -role vsadmin-readonly Please enter a password for user 'new_vsadmin': Please enter it again: Fsx0123456::>
  4. The following command creates a new read-only file system user harvest2-user that is to be used by the NetApp Harvest application to collect performance and capacity metrics. For more information, see Monitoring FSx for ONTAP file systems using Harvest and Grafana.

    Fsx0123456::> security login create -user-or-group-name harvest2-user -application ssh -role fsxadmin-readonly -authentication-method password
To view information for all file system and SVM users
  • Use the following command to view all login information for your file system and SVMs.

    Fsx0123456::> security login show Vserver: Fsx0123456 Second User/Group Authentication Acct Authentication Name Application Method Role Name Locked Method -------------- ----------- ------------- ---------------- ------ -------------- autosupport console password autosupport no none fsxadmin http password fsxadmin no none fsxadmin ontapi password fsxadmin no none fsxadmin ssh password fsxadmin no none fsxadmin ssh publickey fsxadmin - none new_fsxadmin ssh password fsxadmin-readonly no none Vserver: fsx Second User/Group Authentication Acct Authentication Name Application Method Role Name Locked Method -------------- ----------- ------------- ---------------- ------ -------------- new_vsadmin ssh password vsadmin-readonly no none vsadmin http password vsadmin yes none vsadmin ontapi password vsadmin yes none vsadmin ssh password vsadmin yes none 10 entries were displayed. Fsx0123456::>