Skip to content

Document Service Processor public-key second-factor support in ONTAP 9.15.1 #2063

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Copilot wants to merge 3 commits into from
Closed

Document Service Processor public-key second-factor support in ONTAP 9.15.1 #2063

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0819931
Initial plan
Copilot Jun 5, 2026
77c7769
Document SP two-factor authentication support
Copilot Jun 5, 2026
54720b0
Add SP page footer update note
Copilot Jun 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions system-admin/accounts-access-sp-concept.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,16 +2,16 @@
permalink: system-admin/accounts-access-sp-concept.html
sidebar: sidebar
keywords: account, access, sp, cluster, user, cli, node
summary: "When you try to access the SP, you are prompted for credential. Cluster user accounts that are created with the service-processor application type have access to the SP CLI on any node of the cluster. SP user accounts are managed from ONTAP and authenticated by password. Beginning with ONTAP 9.9.1, SP user accounts must have the admin role."
summary: "When you try to access the SP, you are prompted for credential. Cluster user accounts that are created with the service-processor application type have access to the SP CLI on any node of the cluster. SP user accounts are managed from ONTAP and authenticated by password. Beginning with ONTAP 9.15.1, SP user accounts can optionally use two-factor authentication with a public key as the second authentication method. Beginning with ONTAP 9.9.1, SP user accounts must have the admin role."
---
= Access the ONTAP Service Processor using a cluster user account
:icons: font
:imagesdir: ../media/

[.lead]
When you try to access the SP, you are prompted for credential. Cluster user accounts that are created with the `service-processor` application type have access to the SP CLI on any node of the cluster. SP user accounts are managed from ONTAP and authenticated by password. Beginning with ONTAP 9.9.1, SP user accounts must have the `admin` role.
When you try to access the SP, you are prompted for credential. Cluster user accounts that are created with the `service-processor` application type have access to the SP CLI on any node of the cluster. SP user accounts are managed from ONTAP and authenticated by password. Beginning with ONTAP 9.15.1, SP user accounts can optionally use two-factor authentication with a public key as the second authentication method. Beginning with ONTAP 9.9.1, SP user accounts must have the `admin` role.

User accounts for accessing the SP are managed from ONTAP instead of the SP CLI. A cluster user account can access the SP if it is created with the `-application` parameter of the `security login create` command set to `service-processor` and the `-authmethod` parameter set to `password`. The SP supports only password authentication.
User accounts for accessing the SP are managed from ONTAP instead of the SP CLI. A cluster user account can access the SP if it is created with the `-application` parameter of the `security login create` command set to `service-processor` and the `-authmethod` parameter set to `password`. Beginning with ONTAP 9.15.1, you can optionally configure two-factor authentication for an SP account by setting the second authentication method to `publickey` with the `security login modify` command and then associating the public key with the `security login publickey create` command.

You must specify the `-role` parameter when creating an SP user account.

Expand All @@ -27,8 +27,9 @@ ONTAP prevents you from creating user accounts with names that are reserved for

You can display current SP user accounts by using the `-application service-processor` parameter of the `security login show` command.

Learn more about `security login show` in the link:https://docs.netapp.com/us-en/ontap-cli/security-login-show.html[ONTAP command reference^].
Learn more about link:https://docs.netapp.com/us-en/ontap-cli/security-login-modify.html[`security login modify`^], link:https://docs.netapp.com/us-en/ontap-cli/security-login-publickey-create.html[`security login publickey create`^], and link:https://docs.netapp.com/us-en/ontap-cli/security-login-show.html[`security login show`^] in the ONTAP command reference.


// 2026 June 05, update to include optional 2FA
// 2025 June 18, ONTAPDOC-2960
// 2022-06-20, BURT 1387627