Hitachi HUS VM, User And Reference Manual

Page: 86 / 530

User authentication
CCI allows user authentication by using the operation authority of a user set
by:
• Storage Navigator
• Device Manager - Storage Navigator
• Maintenance utility
User authentication is arbitrary in the Replication operation in the in-band
method while the operation by user authentication is mandatory in the
configuration information operation and in the out-of-band method.
To enable the user authentication function, the user authentication mode of
the command device accessed by CCI must be enabled.
The user authentication function inputs a login command from the client
(server) and, to authenticate the user ID and password sent from CCI and
the same types of information maintained by the storage system, issues an
authentication request to the authentication module (SVP/GUM).
If the user ID and password which are sent by CCI are authenticated, the
storage system generates the session information. The storage system stores
the session information, the user ID, and the client ID, and then sends back
the session information to CCI. CCI stores the session information with the
storage system ID. After that, the session information is added to all
commands which are issued by CCI to the storage system. If the session
information which is added to the command is valid, the storage system
permits the command execution.
When the user logs out, the session information which is stored by CCI, and
the user ID, the client ID, and the session information which are stored in the
storage system are deleted.
A storage system can store only one session information for the same user ID
and the same client ID at the same time. If the storage system received the
login command with the user ID and client ID, corresponding to the session
information which has already been stored, the storage system sends back
the stored session information to CCI without authentication. During
executing the login command, if another login command is input with the
same user ID from the same client, the authentication result of the
subsequent login command will be the same as the authentication result of
login command being executed.
Note:
• The only function that can be used if the user authentication function is
disabled is the Replication function (replication command). If the user
authentication function is disabled, the Provisioning function
(configuration setting command) cannot be used. If you use the global
storage virtualization function, see Table 3-2 Relations between resource
groups and command devices on page 3-10 . For details about global
storage virtualization, see the Provisioning Guide for Open Systems or
3-8
CCI functions
Command Control Interface User and Reference Guide