Hitachi Command Suite 8 User Guide

							FunctionResource Group
Required RolesAdmin, Modify, ViewCustom (VSP G1000)Expand, mount,
unmount, or delete a
file system
(Hitachi NAS Platform
v11.1 or later)All Resources
Even if All Resources is
not assigned, tasks
can be performed by
following the same
steps used for Hitachi
NAS Platform versions
earlier than v11.1. In
this case, the SMU
permission appropriate
to the task is required.Admin or Modify
For the View role, tasks
can be performed by
following the same steps
used for Hitachi NAS
Platform versions earlier
than v11.1. In this case,
the SMU permission
appropriate to the task is
required.-Add, edit, or delete file
shares
(Hitachi NAS Platform
versions earlier than
v11.1)AnyAny
In addition, you must have the SMU permission
for the task.Expand, mount,
unmount, or delete a
file system
(Hitachi NAS Platform
versions earlier than
v11.1)AnyAny
In addition, you must have the SMU permission
appropriate to the task.Set up or modify
Admin services EVS
(Hitachi NAS Platform
v10.2.3071 or later)AnyAdmin or ModifyOne of the following:
Storage Administrator
(Provisioning)
Storage Administrator
(Performance
Management)
Storage Administrator
(Local Copy)
Storage Administrator
(Remote Copy)
Storage Administrator
(Initial Configuration)
Storage Administrator
(System Resource
Management)Create a file system
(Hitachi NAS Platform
v10.2.3071 or later)All Resources
Even if All Resources is
not assigned, tasks
can be completed by
following the same
steps used for Hitachi
NAS Platform versions
earlier than
v10.2.3071. In thisAdmin or Modify
For the View role, tasks
can be performed by
following the same steps
used for Hitachi NAS
Platform versions earlier
than v10.2.3071. In this
case, the SMU-Setting up users and access control121Hitachi Command Suite User Guide 
						

							FunctionResource Group
Required RolesAdmin, Modify, ViewCustom (VSP G1000)case, the SMU
permission appropriate
to the task is required.permission appropriate
to the task is required.Create a file system
(Hitachi NAS Platform
versions earlier than
v10.2.3071)AnyAny
In addition, you must have the SMU permission
to perform these tasks.Change settings of a
storage pool
Edit a file system
Edit the system drive
Create or edit a
system drive group
(Hitachi NAS Platform
v10.1.3071 or later)AnyAny
In addition, the SMU permission appropriate to
the task is required.File Server - HDI & HNAS FCreate a file system
(when linked with
Hitachi File Services
Manager).Resource group to
which the target
resource belongsAdmin or Modify
With any role, you can
use volumes allocated to
the file server.
In addition, you must
have Hitachi File
Services Manager Admin
permissions.One of the following:
Storage Administrator
(Provisioning)
Storage Administrator
(Performance
Management)
Storage Administrator
(Local Copy)
Storage Administrator
(Remote Copy)
Storage Administrator
(Initial Configuration)
Storage Administrator
(System Resource
Management)Expand or delete a file
system (when linked
with Hitachi File
Services Manager).Resource group to
which the target
resource belongsAny
In addition, you must have Hitachi File Services
Manager Admin permissions.Add, edit, or release
file shares (when
linked with Hitachi File
Services Manager).AnyAny
In addition, you must have Hitachi File Services
Manager Admin permissions.ReplicationAdd, edit or delete
command devicesResource group to
which the target
resource belongsAdmin or ModifyStorage Administrator
(Provisioning)122Setting up users and access controlHitachi Command Suite User Guide 
						

							FunctionResource Group
Required RolesAdmin, Modify, ViewCustom (VSP G1000)Define copy pairs, or
change the status of
copy pairs.To perform replication
management in Device
Manager, the target
resource must be
allocated to a Device
Manager resource
group, and that
resource group must
have a role assigned.
Access permissions are
required for the LDEV
ID of the command
device or for the LDEV
IDs of the volumes
that make up the copy
pair.Admin or ModifyFor local copy:
Storage Administrator
(Local Copy)
For remote copy:
Storage Administrator
(Remote Copy)Update the
configuration and
performance
information of a copy
group (UR
Performance Analysis
window of the
Replication tab), set
the network bandwidth
(UR Performance
Analysis window of the
Replication tab), set
M-JNL threshold values
(UR Performance
Analysis window of the
Replication tab).All ResourcesAdmin or Modify
You must have
Replication Manager
View permissions.-Confirm and analyze
Universal Replicator
performance (UR
Performance Analysis
window of the
Replication tab),
export the analysis
results (UR
Performance Analysis
window of the
Replication tab).All ResourcesAdmin, Modify, or View
You must have
Replication Manager
View permissions.-Mobility (Migration)View the View Tier
Properties dialog box
for an HDT pool or
each tiering policy of
HDT volumes.Resource group to
which the target LDEV
ID of an HDT pool
volume to which an
HDT pool belongs.AnyView the View Tier
Properties dialog box
for an HDT volume.Resource group to
which the target LDEV
ID of an HDT volume
belongs.AnySetting up users and access control123Hitachi Command Suite User Guide 
						

							FunctionResource Group
Required RolesAdmin, Modify, ViewCustom (VSP G1000)View the Trend Chart
and output the CSV
file from the Mobility
tab.Resource group to
which the target
resource belongsAnyData migrationResource group to
which the target
resource belongs.Admin or ModifyStorage Administrator
(Provisioning)Virtual IDDisplay Virtual ID
informationResource group to
which the target
resource belongsAnyResources of virtual storage machinesView information of
virtual storage
machines.Default resource group
of the storage system.AnyCreate, edit or delete
virtual storage
machines.All ResourcesAdmin-Move resources in a
virtual storage
machine to a default
virtual storage
machine, or resources
in the default virtual
machine to another
virtual storage
machine.All ResourcesAdmin-Manage resources
(including adding or
deleting virtual
information of LDEVs)
in a virtual storage
machine (except the
default virtual storage
machine).Resource group to
which the target
resource belongs in
the virtual storage
machine.Admin or ModifyStorage Administrator
(Provisioning)AnalyticsFrom the Analytics
tab,Identify the
existence of
performance problems
of storage systems,
analyze MP Blades/
Units performance,
execute Health Check
immediately, and view
and export Health
Check reports.All ResourcesAdmin, Modify, or View
You must have Tuning
Manager View
permissions.-Delete a Health Check
report (Analytics tab).All ResourcesAdmin, Modify, or View-124Setting up users and access controlHitachi Command Suite User Guide 
						

							FunctionResource Group
Required RolesAdmin, Modify, ViewCustom (VSP G1000)In addition, you must be
logged in with a user ID
that has Tuning Manager
Admin permissions or
with the user ID that
generated the Health
Check report.Execute Health Checks
on a schedule
(Analytics tab),
change the threshold
value for performance
analysis of storage
systems (Analytics
tab).All ResourcesAdmin, Modify, or View
You must have Tuning
Manager Admin
permissions.-
For HCS, custom roles (Storage, Security, and Audit Log roles) provide
specific permissions for performing specific tasks (functions) on VSP G1000.
Additional tasks (functions) are available when selecting System GUI from menus or application panes to open Hitachi Device Manager - Storage
Navigator, and are listed in the table below.
Table 4-5  Required roles or custom roles for performing VSP G1000 specific functions
FunctionsResourceGroup
Required RolesAdmin,ModifyCustom (VSP G1000)Provisioning related operations:
• Configuring caches
• Configuring LDEVs, pools, and virtual volumes
• Formatting and shredding LDEVs
• Configuring external volumes
• Creating and deleting quorum disks used in a global-active device environment.
• Creating and deleting global-active device pairs.
• Configuring alias volumes for Compatible PAV • Configuring Dynamic Provisioning
• Configuring host groups, paths, and WWNs
• Configuring Volume Migration except splitting Volume Migration pairs when using CCI.
• Configuring access attributes for LDEVs • Configuring LUN securityResource group
to which the
resources of the
target system
belong.Admin or
ModifyStorage
Administrator
(Provisioning)Performance related operations:
• Configuring monitoring
• Starting and stopping monitoringResource group
to which the
resources of the
target system
belong.Admin or
ModifyStorage
Administrator
(Performance
Management)Setting up users and access control125Hitachi Command Suite User Guide 
						

							FunctionsResourceGroup
Required RolesAdmin,ModifyCustom (VSP G1000)Local copy management:
• Performing pair operations for local copy • Configuring environmental settings for local copy
• Splitting Volume Migration pairs when using CCIResource group
to which the
resources of the
target system
belong.Admin or
ModifyStorage
Administrator
(Local Copy)Remote copy management:
• Remote copy operations in general
• Managing global-active device pairs (except for creation and deletion).Resource group
to which the
resources of the
target system
belong.Admin or
ModifyStorage
Administrator
(Remote Copy)Initial configuration:
• Configuring settings for storage systems
• Configuring settings for SNMP
• Configuring settings for e-mail notification • Configuring settings for license keys
• Viewing, deleting, and downloading storage configuration reports
• Acquiring all the information about the storage system and refreshingDefault
resource group
of the storage
system.Admin or
ModifyStorage
Administrator
(Initial
Configuration)System resource management:
• Configuring settings for CLPR
• Configuring settings for MP Blade • Deleting tasks and releasing exclusive locks of resources
• Completing SIMs
• Configuring attributes for ports
• Configuring LUN security
• Configuring Server Priority Manager
• Configuring tiering policiesDefault
resource group
of the storage
system.Admin or
ModifyStorage
Administrator
(System
Resource
Management)For global-active device:
• Setting the reserved attribute for a volume to be used in a global-active device pair.
For encryption key and authentication
management (does not allow user management):
• Creating an encryption key, configuring encryption
• Viewing and switching the location at which to create an encryption key
• Backing up and restoring an encryption key
• Deleting an encryption key that is backed up on the key management server.
• Viewing and changing the password policies for backing up an encryption key on the
management client.
• Configuring the Fibre Channel authentication (FC-SP)Default
resource group
of the storage
system.AdminSecurity
Administrator
(View & Modify)Viewing storage encryption key and
authentication:Default
resource groupAdminSecurity
Administrator
(View & Modify)126Setting up users and access controlHitachi Command Suite User Guide 
						

							FunctionsResourceGroup
Required RolesAdmin,ModifyCustom (VSP G1000)• Viewing information about encryption settings
• Viewing information about encryption keys on the key management serverof the storage
system.or Security
Administrator
(View Only)Storage audit log management:
• Configuring audit log settings
• Downloading audit logsDefault
resource group
of the storage
system.AdminAudit Log
Administrator
(View & Modify)Storage audit log access:
• Viewing storage audit log settings
• downloading audit logsDefault
resource group
of the storage
system.AdminAudit Log
Administrator
(View & Modify)
or Audit Log
Administrator
(View Only)
Related concepts
•
About user accounts and controlling access to resources  on page 84
Related tasks
•
Changing permissions for a user account  on page 90
•
Editing the profile for a user account  on page 88
Related references
•
User group roles  on page 104
•
Custom roles  on page 105
Creating user groups You can create user groups and assign resource groups either immediately, or
later as needed. The assigned resource group rights provide user group
members with view, modify, admin, or custom roles for displaying, modifying, or managing the storage resources for this group.
Creating a user group also creates a private logical group for that user group.
Procedure 1. On the  Administration  tab, select User Groups .
Existing user groups are displayed.
2. Click  Create User Group  and enter a name and description.
3. Click  Add Users  to select the user group members.
4. Click  Add Resource Groups  to assign specific storage system resources
to the user group, and for each resource group set the role (permissions)
to one of the following:
• View
Setting up users and access control127Hitachi Command Suite User Guide 
						

							• Modify
• Admin
• Custom
5. Click  OK.
You can click the user group name to verify group membership (list of users) on the  Users tab. On the  Resource Groups  tab, you can verify
the resource groups and roles specified during user group creation.  Add
Resource Groups , Remove Resource Groups , and Edit Roles
buttons allow you to modify resources and access rights for the user
group.
Result
The new user group is displayed and a new private logical group is created.
Related concepts
•
About user groups  on page 102
Related tasks
•
Editing a user group  on page 128
•
Assigning resource groups and roles to a user group  on page 129
•
Deleting user groups  on page 129
Editing a user group As user information and membership in user groups change, you can updatethis information.
Procedure 1. On the  Administration  tab, select User Groups .
2. Select the target user group and click  Edit User Group.
3. Change the name of the user group, or the user who manages the user
group.
Result
Editing changes appear in the list in the User Groups tab.
Related concepts •
About user groups  on page 102
•
About access control  on page 94
Related tasks
•
Creating user groups  on page 127
•
Assigning resource groups and roles to a user group  on page 129
128Setting up users and access controlHitachi Command Suite User Guide 
						

							Assigning resource groups and roles to a user groupYou can assign resource groups and roles to a user group.
Procedure 1. Select the  Administration  tab and click on  User Groups.
2. In the  User Groups  tab, click the name of the target user group.
3. In the  Resource Groups  tab, click Add Resource Groups .
4. Set the roles to be assigned to the user group. The assigned resource
groups and roles are displayed in detail by clicking the link for the user group name.
Related tasks •
Creating resource groups  on page 100
•
Creating user groups  on page 127
Changing a user’s user group You can modify information about the user groups that a user belongs to.
Procedure 1. On the  Administration  tab, select User Groups .
2. In the  Users tab select the target user group and click  Assign User
Groups .
3. Change the user groups to which a user belongs.
Result
Changes will appear in the Users tab.
Related concepts
•
About access control  on page 94
Related tasks
•
Creating user groups  on page 127
•
Assigning resource groups and roles to a user group  on page 129
•
Editing a user group  on page 128
Deleting user groups Deleting a user group deletes the associated private logical group and alllogical groups that belong to that private logical group. Deleting a user group
does not delete the related resource groups.
Setting up users and access control129Hitachi Command Suite User Guide 
						

							Procedure1. On the  Administration  tab, select User Groups .
2. Select the user groups to delete.
3. Click  Delete Groups .
4. Click  OK.
Result
The user groups you deleted no longer appear in the list of user groups.130Setting up users and access controlHitachi Command Suite User Guide