Creating and Assigning SME Roles and SME Users

The SME feature provides two primary roles: SME Administrator and the SME Recovery Officer. The SME Administrator role also includes the SME Storage Administrator and SME KMC Administrator roles. By default, SME assigns both the SME Administrator and the SME Recovery Officer to the same user. This assignment works well for small scale deployments of SME.

Note The DCNM-SAN user credentials must be the same as the switch user.

Table 1-4 shows a description of the SME roles and the number of users that should be considered for each role.

Note SME is configured from the DCNM-SAN Web Client. Internally, the actual switch operations are executed on behalf of the user that is logged into the Web Client and not the user monitoring the fabrics. Therefore, in a multifabric configuration the SME administrators must have the same username and password across all the fabrics to perform the SME operations.

Table 1-8 SME Roles and Responsibilities 

SME Role

Master Key Security Mode

Required # of Users for This Role

What Operations is This Role Responsible For?

SME Administrator

Basic mode

Standard mode

One user should hold the SME Administrator and the SME Recovery officer roles.

One per VSAN is the minimum for day to day operations; must have access to all VSANs (if there are many VSANs and multiple VSAN administrators are assigned, then SME administrators, then there may be one SME Administrator per VSAN for key recovery operations.

 • SME management

 • Tape management

 • Disk management

 • Export/import tape volume groups

 • Export/import disk keys

SME KMC Administrator

Basic mode

Standard mode

The number of users is the same as for the SME Administrator role.

 • Key Management operations

 • Archive/purge volumes

 • Add/remove volume groups

 • Add/remove disk groups and disk devices

 • Import/export volume groups

 • Import/export disk keys

 • Rekey/replace smart cards

Cisco Storage Administrator

Basic mode

Standard mode

The number of users is the same as for the SME Administrator role.

 

 • SME provisioning operations

 • Create/update/delete cluster

 • Create/update/delete tape backup groups

 • Create/update/delete disk groups

 • Add/remove tape devices

 • Add/remove disk devices

 • Create volume groups

 • View smart cards

SME Recovery Officer

Advanced mode

Five users (one for each smart card).

Each smart card holder must be present during the cluster creation to provide the user login and password information and smart card pin.

 • Master key recovery

 • Replace smart card

Note For Basic and Standard security modes, one user should hold both the SME Administrator and the SME Recovery Officer roles.