PARTITIONING MANAGEMENT OF SYSTEM RESOURCES ACROSS MULTIPLE USERS

• US 20120150858A1
• Filed: 12/09/2010
• Published: 06/14/2012
• Est. Priority Date: 12/09/2010
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: RIPBERGER, Richard A.
• Granted Patent: US 8,577,885 B2
• Time in Patent Office: Days
• US Class Current: 707/737
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 16/35 Clustering; Classification
• CPC Class Codes: G06F 3/0605 by facilitating the interaction with a user or administrator
• CPC Class Codes: G06F 3/0629 Configuration or reconfiguration of storage systems
• CPC Class Codes: G06F 3/0637 Permissions
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

Exemplary method, system, and computer program embodiments for partitioning management of storage resources in a computing storage environment across multiple users are provided. In one embodiment, a resource group attribute is assigned to a storage resource object representing at least one of the plurality of storage resources in a system configuration of the computing storage environment. The resource group attribute includes a selectable value indicating a resource group object to which the storage resource object is associated. A resource group label is provided in the resource group object and is a string having no wildcards. A user resource scope is assigned to a user ID and a value of the user resource scope provides a mechanism to match to the resource group label. The user ID is authorized to perform one of creating, deleting, modifying, controlling, and managing storage resources with an association to a resource group.

Claims

1. A method of partitioning management of a plurality of storage resources in a computing storage environment across a plurality of users by a processor device, comprising:

assigning a resource group attribute to a storage resource object representing at least one of the plurality of storage resources, wherein the resource group attribute includes a selectable value indicating a resource group object to which the storage resource object is associated;

providing a resource group label in the resource group object, the resource group label being a string having no wildcards; and

assigning a user resource scope to a user ID, wherein a value of the user resource scope provides a mechanism to match to the resource group label, the user resource scope being a pattern of a string adapted to include wildcards for comparison to the resource group label to determine a match between the user resource scope and the resource group label, whereupon the user ID is authorized to perform one of creating, deleting, modifying, controlling, and managing storage resources with an association to a resource group in the plurality of storage resources.

2. The method of claim 1, further including assigning the resource group a plurality of policy attributes prescribing a behavior of the plurality of storage resources prior to installation of code on the computing storage environment, wherein the plurality of storage resources are assigned to the resource group upon installation of code with a plurality of non-administrative user IDs adapted to access the plurality of the storage resources by assigning a default user resource scope matching a default resource group label, further wherein the behavior of the plurality of the storage resources is identical before and after installing the code on the computing storage environment.

3. The method of claim 1, further including limiting access of the user resource scope to the plurality of storage resources by designating the resource group as a default resource group, wherein the default resource group is adapted to authorize the plurality of users to perform management tasks, further wherein at least one of the plurality of users may be assigned a new resource scope while maintaining access to the plurality of storage resources in both the default resource group and the resource group being assigned.

4. The method of claim 1, further including:

designating at least one of the plurality of users as an administrator having authorization to perform actions to configure the plurality of storage resources and activating an enforcement of a plurality of resource group policies and limiting a scope of access of at least one of the plurality of users,

creating the resource group, wherein at least one of the resource group label being assigned to the resource group,

modifying the resource group, wherein a plurality of policy attributes are changed in the resource group,

deleting the resource group not being associated with at least one of the plurality of storage resources,

changing the association of the at least one of the plurality of storage resources to the resource group,

performing at least one of assigning and modifying the user resource scope on a non-administrative user IDs, and

performing at least one of enabling and disabling the creation of a plurality of objects in a default resource group.

5. The method of claim 1, further including assigning the user resource scope to the user ID via a user directory accessible by a plurality of storage subsystems in the computing storage environment, wherein the user directory conforms to a lightweight directory access protocol (LDAP).

6. The method of claim 1, further including assigning the resource group attribute to an object representing at least one logical volume of the computing environment.

7. The method of claim 1, further including configuring a schema for assigning resource group labels to resource groups and user resource scopes to user IDs such that a multiplicity of resource groups may be managed by a set of users sharing a common user resource scope that matches an associated resource group label of the multiplicity of resource groups.

8. A system for partitioning management of a plurality of storage resources in a computing storage environment across multiple users, comprising:

a resource group manager operational in the computing storage environment, wherein the resource group manager is adapted for;

assigning a resource group attribute to a storage resource object representing at least one of the plurality of storage resources, wherein the resource group attribute includes a selectable value indicating a resource group object to which the storage resource object is associated,

providing a resource group label in the resource group object, the resource group label being a string having no wildcards, and

assigning a user resource scope to a user ID, wherein a value of the user resource scope provides a mechanism to match to the resource group label, the user resource scope being a pattern of a string adapted to include wildcards for comparison to the resource group label to determine a match between the user resource scope and the resource group label, whereupon the user ID is authorized to perform one of creating, deleting, modifying, controlling, and managing storage resources with an association to a resource group in the plurality of storage resources.

9. The system of claim 8, wherein the resource group manager is further adapted for assigning the resource group a plurality of policy attributes prescribing a behavior of the plurality of storage resources prior to installation of code on the computing storage environment, further wherein the plurality of storage resources are assigned to the resource group upon installation of code with a plurality of non-administrative user IDs adapted to access the plurality of the storage resources by assigning a default user resource scope matching a default resource group label, further wherein the behavior of the plurality of the storage resources is identical before and after installing the code on the computing storage environment.

10. The system of claim 8, wherein the resource group manager is further adapted for limiting access of the user resource scope to the plurality of storage resources by designating the resource group as a default resource group, further wherein the default resource group is adapted to authorize the plurality of users to perform management tasks, further wherein at least one of the plurality of users may be assigned a new resource scope while maintaining access to the plurality of storage resources in both the default resource group and the resource group being assigned.

11. The system of claim 8, wherein the resource group manager is further adapted for:

designating at least one of the plurality of users as an administrator having authorization to perform actions to configure the plurality of storage resources and activating an enforcement of a plurality of resource group policies and limiting a scope of access of at least one of the plurality of users,

creating the resource group, wherein at least one of the resource group label being assigned to the resource group,

modifying the resource group, wherein a plurality of policy attributes are changed in the resource group,

deleting the resource group not being associated with at least one of the plurality of storage resources,

changing the association of the at least one of the plurality of storage resources to the resource group,

performing at least one of assigning and modifying the user resource scope on a non-administrative user IDs, and

performing at least one of enabling and disabling the creation of a plurality of objects in a default resource group.

12. The system of claim 8, wherein the resource group manager is further adapted for assigning the user resource scope to the user ID via a user directory accessible by a plurality of storage subsystems in the computing storage environment, wherein the user directory conforms to a lightweight directory access protocol (LDAP).

13. The system of claim 8, wherein the resource group manager is further adapted for assigning the resource group attribute to an object representing at least one logical volume of the computing storage environment.

14. The system of claim 8, wherein the resource group manager is further adapted for configuring a schema for assigning resource group labels to resource groups and user resource scopes to user IDs such that a multiplicity of resource groups may be managed by a set of users sharing a common user resource scope that matches an associated resource group label of the multiplicity of resource groups.

15. A computer program product for partitioning management of a plurality of storage resources in a computing storage environment by a processor device, the computer program product comprising a computer-readable storage medium having computer-readable program code portions stored therein, the computer-readable program code portions comprising:

a first executable portion for assigning a resource group attribute to a storage resource object representing at least one of the plurality of storage resources, wherein the resource group attribute includes a selectable value indicating a resource group object to which the storage resource object is associated;

a second executable portion for providing a resource group label in the resource group object, the resource group label being a string having no wildcards; and

a third executable portion for assigning a user resource scope to a user ID, wherein a value of the user resource scope provides a mechanism to match to the resource group label, the user resource scope being a pattern of a string adapted to include wildcards for comparison to the resource group label to determine a match between the user resource scope and the resource group label, whereupon the user ID is authorized to perform one of creating, deleting, modifying, controlling, and managing storage resources with an association to a resource group in the plurality of storage resources.

16. The computer program product of claim 15, further including a fourth executable portion for assigning the resource group a plurality of policy attributes prescribing a behavior of the plurality of storage resources prior to installation of code on the computing storage environment, wherein the plurality of storage resources are assigned to the resource group upon installation of code with a plurality of non-administrative user IDs adapted to access the plurality of the storage resources by assigning a default user resource scope matching a default resource group label, further wherein the behavior of the plurality of the storage resources is identical before and after installing the code on the computing storage environment.

17. The computer program product of claim 15, further including a fourth executable portion for limiting access of the user resource scope to the plurality of storage resources by designating the resource group as a default resource group, wherein the default resource group is adapted to authorize the plurality of users to perform management tasks, further wherein at least one of the plurality of users may be assigned a new resource scope while maintaining access to the plurality of storage resources in both the default resource group and the resource group being assigned.

18. The computer program product of claim 15, further including a fourth executable portion for:

designating at least one of the plurality of users as an administrator having authorization to perform actions to configure the plurality of storage resources and activating an enforcement of a plurality of resource group policies and limiting a scope of access of at least one of the plurality of users,

creating the resource group, wherein at least one of the resource group label being assigned to the resource group,

modifying the resource group, wherein a plurality of policy attributes are changed in the resource group,

deleting the resource group not being associated with at least one of the plurality of storage resources,

changing the association of the at least one of the plurality of storage resources to the resource group,

performing at least one of assigning and modifying the user resource scope on a non-administrative user IDs, and

performing at least one of enabling and disabling the creation of a plurality of objects in a default resource group.

19. The computer program product of claim 15, further including a fourth executable portion for listing the at least one resource token in a user directory accessible by multiple storage subsystems in the computing storage environment.

20. The computer program product of claim 15, further including a fourth executable portion for assigning the user resource scope to the user ID via a user directory accessible by a plurality of storage subsystems in the computing storage environment, wherein the user directory conforms to a lightweight directory access protocol (LDAP).

21. The computer program product of claim 15, further including a fourth executable portion for assigning the resource group attribute to an object representing at least one logical volume of the computing environment.

22. The computer program product of claim 15, further including a fourth executable portion for configuring a schema for assigning resource group labels to resource groups and user resource scopes to user IDs such that a multiplicity of resource groups may be managed by a set of users sharing a common user resource scope that matches an associated resource group label of the multiplicity of resource groups.