Netapp, Inc.

Network Appliance, Inc.

Timothy J Thompson

Benjamin Swartzlander

Vijay Mohan Deshmukh

James Hartwell Holl, Ii

Jay Perry

William Raoul Durant

Alan G Yoder

Mark Muhlestein

Shailaja Kamila

Steven R Klinkner

Sreenivasa Potakamuri

Robert M Armitano

Joshua Hanan Flank

Raja Shekar Cs

Dejan L Mihajlovic

James T Uren

Bill Raoul Durant

A method, apparatus, and system are described herein, in which system resources and operations are assigned to roles in a role-based access control system, and the roles are assigned to a plurality of users. An RBAC system is used to resolve the client request to perform an operation on a resource, the RBAC system using a hierarchy of the plurality of resources to determine if a user is permitted to perform the operation on a parent of the resource in the hierarchy of resources. The RBAC system also determines if a user is permitted to perform the operation on the resource if a user group to which the user belongs to has the required access.

Hierarchy-aware role-based access control

According to an embodiment of the invention, a filer or other storage server is coupled to a network to store files for users of the network. Agents are coupled to the filer, and performs a scan or file walk for a Multi-Appliance Management Application (MMA) which is coupled to the filer and can monitor and manage the filer. A directory structure of the filer may be divided into two or more paths, each of which may be scanned by an independent agent. The results of the scan, or file walk, are saved to a database server. In this way, multiple agents may be used to scan a single storage server, and the amount of time required for the scan is reduced.

Storage resource management across multiple paths

Centralized role-based access control (RBAC) for storage servers can include operating multiple storage servers, each configured to provide a set of clients with access to stored data, and using a separate network server to provide centralized RBAC. The network server may include an API proxy to proxy requests to access individual APIs of a storage server by an application which is external to the network server and the storage server and may control access to the individual APIs of the storage servers on a per-API, per-user and per-object basis. The API proxy may filter responses to API calls based on the access privileges of the user of the application which sent the API call. In some embodiments, the network server may implement a Windows domain server, an LDAP server or the like to evaluate security credentials of administrative users on behalf of multiple storage servers.

Centralized role-based access control for storage servers

A system and method are provided to manage configuration of multiple file server appliances. The method comprises obtaining a source configuration from a storage server, and pushing a target configuration associated with the source configuration to one or more target storage servers.

Method and apparatus to manage configuration for multiple file server appliances

Certain tasks are outsourced from a filer to a remote policy engine. The policy engine implements various defined policies to control the filer's servicing of client requests. For example, the policy engine can be used to implement policies to control various storage-related operations relating to data managed by a filer, such as creation, deletion, modification, opening, closing, renaming and/or changing attributes of files or directories managed by the filer.

Policy engine to control the servicing of requests received by a storage server

According to an embodiment of the invention, a storage server management application (SSMA) includes scripting ability. The scripting ability allows functionality to be added to the SSMA by deploying scripting packages onto the SSMA. The packages may be written by a user having access to the SSMA, and deployed onto the SSMA without affecting the core functionality of the SSMA, and may be easily removed. One package allows a system administrator to monitor the configuration of storage servers monitored by the SSMA by comparing the current configuration of the filers to a standard configuration. Another package monitors best practices for redundant array of inexpensive disks (RAID) systems. Other packages may be added to the SSMA.

Method and apparatus for deploying updates to a storage server management application

In an RBAC system, a capability is defined as including an operation and an object on which the operation is to be performed. The capability is assigned to a role, which is in turn assigned to a user. Whether a user's request to perform an operation on an object should be authorized is determined based on whether a capability to perform the operation on the object is assigned to a role which is in turn assigned to the user. Further, the authorization is determined based on the evaluation of the constraint(s) attached to the role. If the evaluation result of the constraint(s) disallows the user to assume the role, the user is prohibited from performing the operation on the object even the user has such capability.

Method and system of access control based on a constraint controlling role assumption

In an RBAC system, a capability is defined as including an operation and an object on which the operation is to be performed. The capability is assigned to a role, which is in turn assigned to a user. Then the user will have the authorization to perform the operation on the object. Rather than specifying the object by predetermining the identity of the object, an expression (e.g., a regular expression, a query, etc.) may be specified in place of the predetermined object. In response to a request initiated by a user, the expression is then evaluated to determine the identity of the object(s) on which the operation may be performed.

Method and system for controlling access to dynamically specified resources

According to an embodiment of the invention, a directory on a storage server is scanned. A number of children of the directory is determined, and the number is added to a reference count. A child is scanned to collect information about the child, and the information is combined into a summary of the directory. After the child is scanned, the reference count is reduced by one. According to another embodiment of the invention, the storage server is scanned by an agent separate from the storage server.

Growing community of inventors

San Jose, CA, United States of America

Timothy J Thompson