SANRAD I3.1.1205 - Manual (Page 125)

Chapter 7: Volume Exposure and Security 7-7
1015
4
wwui2
wwui1
wwui10
wwui9
wwui8
wwui7
wwui4
wwui3
Ident B
wwui6
wwui5
iSCSI Target 2
wwui22
Ident A
Vol 2
Vol 3
Re
ad
-O
nly
Re
ad
-W
rite
Figure 7-7. iSCSI Initiator in Two Different Identities
In Figure 7-7, iSCSI initiator WWUI8 is part of Identity A and Identity B. If
Identity A and Identity B are coupled with Target 2, iSCSI initiator WWUI8 will
have two different access options to Volumes 2 and 3: read-write and read-
only, depending on the positioning of the identities. If Identity A is assigned
position 1 and Identity B is assigned position 2, Identity B is scanned first by the
V-Switch. A match is made and the scan is stopped. No further identities will
be scanned. Therefore, iSCSI initiator WWUI8 will be granted read-write
access.
If the positions are reversed and Identity B is assigned position 1 and Identity A
is assigned position 2, iSCSI initiator WWUI8 will be granted read-only access.
Authentication
The V-Switch supports the authentication methods CHAP and SRP for the
iSCSI initiator. The credentials for CHAP and SRP are the combination of user
name + password. An authentication method is assigned per identity and not
per iSCSI initiator. An identity can be assigned one or both authentication
methods. If no authentication method is assigned, all listed iSCSI initiators in
an identity will have un-authenticated login rights.
When an iSCSI initiator logs in to a target, its WWUI is checked against the
identity initiator list. After the iSCSI initiator passes the identity stage, if
credentials are configured, the iSCSI initiator must authenticate itself. The
credentials list is checked for the iSCSI initiator’s user name + password. The
list can contain a separate user name + password for each initiator; a few user
name + password pairs common to a few initiators or a single user name +
password for all initiators in the identity.