Chapter 6. Administering User Accounts; User Groups - IBM DS8000 User Manual

Chapter 6. Administering user accounts

The topics in this section provide information related to administering your
DS8000 user accounts. If you have administrator level privileges, you can add a
new user account, delete an existing user account, or modify the user name,
password, and group for a user account. There might be times when users forget
the password that they use to access the DS Storage Manager. After going beyond
the set number of allowable attempts with the wrong password, the account is
locked. The administrator can unlock a user account. If the Admin account is
locked, the administrator must use the security recovery utility tool. If you do not
have administrator level privileges, your account administration privileges are
limited to entering a new password for your own user ID.

User Groups

User groups (or roles) are a level of access that is assigned by the administrator,
which allows users to perform certain functions. User groups are created using the
DS Storage Manager or the CLI.
When a user account is created, the administrator must specify an initial password
for the account. This initial password expires immediately which means that the
account users must change the password before they are allowed to perform any
other actions. This is also true for all account roles, including Administrators.
The user must be assigned to at least one group or role. Users can be assigned to
multiple groups or combinations of groups. Groups with the label No Access
(only) cannot be selected in combination with another group.
Administrators can make the following user group assignments (Table 3 on page 92
provides specific capabilities for each user group):
Administrator (only)
Physical operator (only)
Logical operator
Copy Services Operator
© Copyright IBM Corp. 2004, 2008
Must be the only assigned group. This user group has the highest level of
authority. It allows a user to add or remove user accounts. This group has
access to all service functions and DS8000 resources.
Must be the only assigned group. This user group allows access to
resources that are related to physical configuration, including storage
complex, storage unit, storage image, management console, arrays, ranks,
and extent pools. The physical operator group does not have access to
security functions.
Can be assigned in combination with the Copy Services operator group,
but not in combination with any other group. This group has access to
resources that relate to logical volumes, hosts, host ports, logical
subsystems, and volume groups, excluding security functions.
Can be assigned in combination with the Logical operator group, but not
in combination with any other group. This group has access to all Copy
Services service functions and resources, excluding security functions.
91