Provisioning data storage entities with authorization settings

A computer-implemented method comprising:

• receiving a request at a host-based storage-management application to perform a provisioning operation on a data storage entity stored by a data storage system communicatively coupled to the host via a network, wherein the data storage entity is any type of logical container of data used by the data storage system to store data;
• and
• directing the storage system to perform the provisioning operation only after analyzing a locally-cached copy of an authorization setting associated with the data storage entity to determine whether an administrative user associated with the request has previously been granted authority to perform the provisioning operation involving the data storage entity;
• and
• prior to analyzing the locally-cached copy of the authorization setting maintained at the host, analyzing an indicator to verify that the locally-cached copy of the authorization setting is valid.

A system comprising:

• a storage system that includes
• a communications interface through which to communicate via a network with a first host system that includes a first storage-management application and a second host system that includes a second storage-management application, the first storage-management application and the second storage-management application configured to i) facilitate generating data storage entities on the storage system, and ii) generate authorization settings for the data storage entities of the storage system;
• logic to receive the authorization settings from the first host system or the second host system, wherein the authorization settings indicate those provisioning operations, if any, that a plurality of users are permitted to perform on a data storage entity stored by the storage system, and wherein the data storage entity is any type of logical container of data used by the storage system to store data;
• and
• logic to store the authorization settings in the storage system;
• and
• logic to provide the authorization settings to any one or more storage-management applications of a plurality of storage-management applications coupled to the network in response to user requests from the one or more storage-management applications to perform provisioning operations on the data storage entity.

A non-transitory computer-readable storage medium having instructions stored thereon, which, when executed by a first computer, cause the first computer to perform a method comprising:

• generating an authorization setting indicating those provisioning operations, if any, that a user is permitted to perform on a data storage entity of a storage system,
• wherein the data storage entity is any type of logical container of data used by the storage system to store data;
• and
• sending the authorization setting from the first computer to the storage system to enable the storage system to provide the authorization setting to a storage-management application executing on a second computer when a user initiates a request to perform an operation on the data storage entity via the storage-management application;
• and
• wherein, after said sending the authorization, the second computer analyzes the authorization setting to verify that the user associated with the request has the proper authority to perform the requested provisioning operation and an indicator to verify that a locally-cached copy of the authorization setting is valid.

A method comprising:

• receiving, at a network storage system that provides network storage services to one or more clients, first and second authorization settings from at least one host executing at least one storage-management application on a network, the first authorization settings indicating a first set of storage provisioning operations that a first administrative user is permitted to perform on a data storage entity stored by the network storage system and a second set of storage provisioning operations that a second administrative user is permitted to perform on said data storage entity, and the second authorization settings indicating a third set of storage provisioning operations that the first administrative user is permitted to perform on a second data storage entity stored by the network storage system, wherein the second set of provisioning operations is not identical to the first set of provisioning operations and the third set of provisioning operations is not identical to the first set of provisioning operations;
• storing the authorization settings in the network storage system;
• and
• providing at least some of the authorization settings from the network storage system to a particular storage-management application of a plurality of storage-management applications, in response to a user request received at the particular storage-management application to perform a provisioning operation on the data storage entity.