Documentation forAccess Rights Manager

Prepare Dell PowerScale (Isilon) OneFS file servers

ARM can scan and manage permissions on Dell PowerScale clusters (formerly EMC Isilon) that run the OneFS operating system. ARM treats OneFS clusters as the EMC file server type, so no separate resource type is required.

For OneFS clusters, ARM can:

  • Discover the access zones and SMB shares of the cluster

  • Scan the permissions of the SMB shares in each access zone

  • Change permissions (ACLs) on OneFS shares and directories

    This feature is only supported with AD credentials or write permission in OneFS Zone.

ARM uses the OneFS REST API (Platform API, PAPI) to discover the access zones and the SMB shares in each zone.

Prerequisites

  • The OneFS cluster is joined to Active Directory (AD), and its computer object can be found in AD. ARM detects a OneFS cluster when the operatingSystem attribute of the computer object contains OneFS.

  • The following ports are open from the ARM server and from each collector that scans the cluster:

    • TCP 8080 for the OneFS REST API (PAPI)
    • The SMB ports (TCP 445) for share access

  • An account wishing to scan must hold a read-only role with the following privileges: 

    • ISI_PRIV_LOGIN_PAPI

    • ISI_PRIV_AUTH_ZONES (and ISI_PRIV_AUTH if needed)

    • ISI_PRIV_SMB

    • ISI_PRIV_NS_IFS_ACCESS

    • ISI_PRIV_IFS_BACKUP

  • The cluster runs a supported OneFS 9.0 version or later.

How access zones appear in ARM

ARM creates a separate resource for each access zone of a OneFS cluster. The resource name uses the following format:

<hostname> [<zone name>, Id:<zone ID>]

For example, a cluster named armonefs with two access zones displays as the following resources:

  • armonefs [System, Id:1]
  • armonefs [Production, Id:2]

ARM scans the access zones in parallel. Each zone is scanned independently, so a problem in one zone does not stop the scan of the other zones.

Credentials

When you configure the credentials for a OneFS resource, you can choose one of the following options:

  • AD credentials: a domain account.

  • External credentials: a local OneFS account without a domain, for example root.

The same choice is available in the File Server CSV Import dialog. See Import a file server resource for the zone columns you can use in the import file.

Limitations

  • ARM scans only SMB shares. NFS exports are not scanned.

  • Shares that ARM cannot access through their UNC path are skipped. ARM writes a warning to the log file.

  • If the access zones and shares cannot be discovered through the OneFS REST API, ARM falls back to the standard Windows share enumeration.

  • Access zones that you add to the zone later are not detected automatically. After creating a new zone on the cluster, you can add the new zone as a resource.

Certificate validation for the OneFS REST API

By default, ARM does not validate the TLS certificate of the OneFS REST API. To enforce certificate validation, set skipPapiCertificateValidation to false in the fileSystem section of the pnServer.config.xml configuration file. SolarWinds recommends using a certificate signed by a certificate authority (CA) on the cluster when you enable certificate validation.

Configuration file

pnServer.config.xml

Path

%ProgramData%\protected-networks.com\8MAN\cfg

Code

<config>
  <fileSystem>
    <config>
      <skipPapiCertificateValidation type="System.Boolean">false</skipPapiCertificateValidation>
    </config>
  </fileSystem>
</config>

Possible values

  • true (default): The certificate is not validated.
  • false: The certificate is validated.

After you save the file, restart the ARM service.