Using cert security and "rest-role" am unable to manage Luns

[sandynomad]

After contacting NetApp technical support I was referred here.

Trying to do:

for i in Lun.get_collection( fields = 'lun_maps' ):

fails with:

netapp_ontap.error.NetAppRestError:  Caused by HTTPError('401 Client Error: Unauthorized for url: https://filer:443/api/storage/luns?fields=lun_maps',)

I have experience with the NetApp Manageability SDK, and in that it is possible to set a "vserver" for the queries. Is that possible with ontap-rest-python?

How is it possible to bind a cert user to a role that is only applied to a vserver?

It also appears I can only join the slack channel by invitation.

thanks,

-greg

[github-actions]

Thank you for reporting an issue! If you haven't already joined our Slack community,
then we invite you to do so. This is a great place to get help and ask questions from our community.

[RobertBlackhart]

For setting a particular vserver context for a request, you can either add a query to restrict the results:

for i in Lun.get_collection(fields='lun_maps', **{'svm.name': 'vs0'})

Or you can have all of your requests "tunneled" in a vserver context. See the API docs under the "SVM Tunneling" section: https://library.netapp.com/ecmdocs/ECMLP2862544/html/index.html

You can set headers while using the netapp-ontap library on the connection object. See this section of the docs: https://library.netapp.com/ecmdocs/ECMLP2858435/html/index.html#custom-headers

If you want to have a role apply to a vserver, you set the owner.name field to that vserver: https://library.netapp.com/ecmdocs/ECMLP2858435/html/resources/role.html

[sandynomad]

HI @RobertBlackhart, I can't get any of the suggestions working in our environment.

Is there any information on the relationship between rest-roles, SVMs and users?

1/

for i in Lun.get_collection(fields='lun_maps', **{'svm.name': 'MYSERVER'})

uses a GET query:

https://X.X.X.X:443/api/storage/luns?fields=lun_maps&owner.name=MYVSERVER

with result:

HTTPError('401 Client Error: Unauthorized for url ....')

2/ "tunneled" vserver context & "set header"

According to the docs I read, they seem functionally the same?

headers = {
    'X-Dot-SVM-Name':  'MYVSERVER'
}

conn = HostConnection( hostname, key = key_file, cert = cert_file, headers = headers )

request is:

-----------REQUEST-----------
GET https://X.X.X.X:443/api/storage/luns?fields=lun_maps
User-Agent: python-requests/2.12.5
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
X-Dot-SVM-Name: MYVSERVER
X-Dot-Client-App: netapp-ontap-python-9.7.2
None
-----------------------------

result:

HTTPError('401 Client Error: Unauthorized for url ...')

3/ Apply a role to a vserver

and the same error again.

[RobertBlackhart]

If you're getting 401 errors with a certificate, there's probably a few things to check that I can think of:

1. Does the certificate common name match the username of the user you want to use from security login show -user-or-group-name <user>?
2. Does that user have access to the http application when viewing the same command?
3. Does that user have the cert authentication method shown from that same command?
4. Does that user have any rest-roles defined when looking at security login rest-role show -role <user>

All 4 of those things have to be true for the request to be authenticated.

[sandynomad]

The certificate and key work perfectly with the NetApp Managebility SDK. I'm only having problems since trying to use the REST ONTAP API.

1/ Does the certificate common name match the username of the user you want to use from security login show -user-or-group-name ?

Yes.

2/ Does that user have access to the http application when viewing the same command?

Not sure what you mean? (The NetApp Manageability SDK uses http - this user worked fine).

3/ Does that user have the cert authentication method shown from that same command?

The user has cert authentication defined - it's not possible to specify cert auth for a single command.

4/ Does that user have any rest-roles defined when looking at security login rest-role show -role

Show below.

Currently the user is only defined on a data SVM, not the management SVM - could this be an issue?

$ openssl x509 -noout -subject -in  certfile.pem
subject= /......./CN=libvirt_admin

And the data vserver:

filer::> security login show -user-or-group-name libvirt_admin -vserver myvserver

Vserver: myvserver
                                                             Second
User/Group                 Authentication                 Acct   Authentication
Name           Application Method        Role Name        Locked Method
-------------- ----------- ------------- ---------------- ------ --------------
libvirt_admin  ontapi      cert          libvirt_admin    -      none

filer::> security login rest-role show -vserver myvserver -role libvirt_admin
           Role                                    Access
Vserver        Name            API                     Level
----------     -------------   -------------------     ------
myvserver     
           libvirt_admin   /api/storage/luns       all

[RobertBlackhart]

The NMSDK uses ZAPI and you're now trying to use REST. The biggest difference when it comes to the authentication is that the user, in your case libvirt_admin, must be authorized for the http application. In your last output above, I only see the ontapi application which is what is needed for ZAPI access, but doesn't help with REST.

I believe the fix would be to run security login create -user-or-group-name libvirt_admin -application http -authentication-method cert -vserver myvserver

[sandynomad]

Adding the the user to "http" on the management vserver resolved the "401" error. But now I am getting a "403" error (Unauthorized for url).

How can I tell whether the 403 is occurring on the management vserver or the SVM?

What permissions are required on the management vserver to effect a tunnel to an SVM?

Should "rest-role" be used to define permissions? (Or is it only "role"?)

[RobertBlackhart]

rest-role should be used for any limiting of API endpoint access. I'm not sure about the 403 error. I'll get someone else to have a look since this is beyond my expertise.

[sandynomad]

Thanks!

[RobertBlackhart]

OK, I think I have an answer about the 403. It seems that if you are using a custom role, then you will need to also allow access for that role to the security and rest web services on that vserver. Here is a public report describing a similar issue when trying to access System Manager: https://mysupport.netapp.com//NOW/cgi-bin/bol?Type=Detail&Display=1231989

I think you will need to run these two commands:

vserver services web access create -vserver myvserver -name security -role libvirt_admin
vserver services web access create -vserver myvserver -name rest -role libvirt_admin

[sandynomad]

Hi Robert.
Entered both those commands - still no joy:

fs-10::> vserver services web access create -vserver myvserver -name security -role libvirt_admin
fs-10::> vserver services web access create -vserver myvserver -name rest -role  libvirt_admin

Error: command failed: duplicate entry

vis-fs-10::> vserver services web access show -role libvirt_admin
Vserver        Type     Service Name     Role  
-------------- -------- ---------------- ----------------
myvserver    data     ontapi           libvirt_admin
myvserver    data     rest             libvirt_admin
myvserver    data     security         libvirt_admin
fs-10      admin    ontapi           libvirt_admin
fs-10      admin    rest             libvirt_admin
5 entries were displayed.

Still seeing a "403" error.

-greg

[RobertBlackhart]

In your request, you're setting the vserver header value to MYVSERVER. Does it make any difference if you use lowercase to match the vserver name in the cluster?

[sandynomad]

No . . The "myserver" / "MYSERVER" is the anonymized vserver name. If you have a private channel I can share the real names with you - however they are always the same case.

[RobertBlackhart]

I'm fine with the anonymized version, I just wanted to check if you were exactly matching the case or if your header value was all upper case when the name was not.

I'll see if I can find any more suggestions for you.