PowerVC Appliance – LDAP users at restricted shell level

Issue: PowerVC appliance utilises LDAP at the application/GUI level, but this doesn’t progress down to the restricted shell CLI environment. LDAP users for the PowerVC appliance are only at the applicable to GUI logins.

In many environments, it is not allowed, for security reasons to have different users utilise a shared login. It is one of the basic tenants of system security & auditability that individuals utilise their own logins. Default shared login accounts like pvcroot should only be utilised in emergency situations, with logins accountable to individuals being used for day-to-day functions.

In environment were single sign on is utilised to provide logins, this capability is needed at both the Application GUI and CLI levels of the system/appliance. When providing a single user base access to multiple PowerVC instances, a single source of user access control is essential. Maintaining several locally defined users at the CLI level across multiple PowerVC instances is not optimal.

There is a precedent in the Power ecosystem for this functionality – The HMC. HMC users have both UI & CLI access, this is for both locally defined and LDAP (automanaged) users. Both locally defined and LDAP users are assigned to appropriate roles for their required level of HMC access.

Why is it useful?

For environments with multiple users accessing the PowerVC environment via CLI, where single sign on integration is required, the PowerVC appliance is not a suitable option as it cannot provide this. These environments must continue to utilise traditional PowerVC installs.

Who would benefit from it?

PowerVC customers who cannot currently transition to the appliance due to it not meeting security & usability requirements at the CLI level would be able to migrate to the appliance. Customers would benefit from the lower level of effort required to maintain the appliance v’s a traditional install.

IBM would benefit from this by allowing more PowerVC environments to transition to the Appliance leading to lower customer support costs. It would assist with the eventual elimination of the traditional non-appliance PowerVC install reducing development and testing costs. The simplified experience provided by the appliance would help customers who don’t have the required Linux skills to adapt PowerVC leading to additional sales.

How should it work?

LDAP users on the PowerVC appliance should be able to login at both the GUI & CLI layers. The CLI layer should be to the restricted shell with the access mapped to the different roles that are available at the CLI level, pvcoperator, pvcsuperadmin, pvcviewer etc. CLI level roles could be a different role assignment to the GUI, not all GUI level users may need CLI access.