User roles

When a user account is created, the administrator must specify an initial password for the account. The initial password expires immediately, which means that the account user must change the password before they are allowed to initiate any other actions. The password expiration is true for all account roles, including Administrators.

The user must be assigned to at least one role. Users can be assigned to multiple roles or combinations of roles (DS CLI only). Roles with the label No Access (only) cannot be selected in combination with another role.

Administrator

This user role (also referred to as the storage administrator) has the highest level of authority. It allows a user to add or remove user accounts. This role has access to all service functions and DS8000® resources, and all DS8000 storage image resources except those functions that are reserved for Security Administrator users. Users in this role cannot be assigned to any other role, and users in any other role might not be assigned to this role.

Copy Services operator

This user role has access to all Copy Services functions and resources, excluding security functions. This role might be assigned in combination with the Logical Operator role, but not in combination with any other role.

IBM Engineering

This user role is typically assigned to IBM® support personnel that perform all service functions and other functions that might be needed by IBM support on the DS8000. This role does not have access to the logical configuration or data on the storage system.

IBM Service

This user role is typically assigned to IBM support personnel that service the hardware (install, remote, or repair) and update firmware on the DS8000. This role does not have access to the logical configuration or data on the storage system. Users in this role cannot be assigned to any other role, and users in any other role cannot be assigned to this role.

Logical operator

This user role has access to resources that relate to logical volumes, hosts, host ports, logical subsystems, and volume groups, excluding security functions. This role can be assigned in combination with the Copy Services Operator role, but not in combination with any other role.

Logical and copy operator

This user role includes the permissions for both the logical operator and copy operator roles. This role has access to resources that relate to logical volumes, hosts, host ports, logical subsystems, and volume groups, excluding security functions. This role also has access to all Copy Services functions and resources, excluding security functions.

Monitor

This user role has access to all read-only, non-security service functions and all DS8000 resources. Users in this role cannot be assigned to any other role, and users in any other role cannot be assigned to this role.

Physical operator

This user role has access to resources that are related to physical configuration, including storage complex, storage unit, storage image, management console, arrays, ranks, and extent pools. The Physical Operator role does not have access to security functions. Users in this role cannot be assigned to any other role, and users in any other role cannot be assigned to this role.

Security administrator

This user role allows users to initiate recovery key operations, and add other users to this role. Users in this role cannot be assigned to any other role, and users in any other role cannot be assigned to this role. Only the security administrator can manage users for this role.

No access

This user role has no access to any service functions or DS8000 resources. This role is the default selection and is assigned to a user account that is not associated with any other user role. Users in this role cannot be assigned to any other role, and users in any other role cannot be assigned to this role. You can manage this role from the DS CLI only.