Chapter 4. Initial configuration 109
Locally administered users can coexist with remote authentication.
4.4.1  Default superuser account
Every system has a default user called superuser. Superuser cannot be deleted or modified, 
except for changing the password and SSH key. Superuser is a local user and cannot be 
authenticated remotely.
Superuser is a member of the SecurityAdmin user group, which is the most privileged role 
within the system.
The password for superuser is set during system setup. The superuser password can be 
reset to its default value of passw0rd using the technician port.
4.4.2  Local authentication
A local user is a user whose account is managed entirely on the system. A local user belongs 
to one user group only, and it must have a password, an SSH public key, or both. Each user 
has a name, which must be unique across all users in one system.
User names can contain up to 256 printable American Standard Code for Information 
Interchange (ASCII) characters. Forbidden characters are the single quotation mark ('), colon 
(:), percent symbol (%), asterisk (*), comma (,), and double quotation marks (“). A user name 
cannot begin or end with a blank space.
Passwords for local users can be up to 64 printable ASCII characters. There are no forbidden 
characters. However, passwords cannot begin or end with blanks.
When connecting to the CLI, encryption key authentication is attempted first with the user 
name and password combination available as a fallback. The SSH key authentication method 
is available for CLI and file transfer access only. For GUI access, only the password is used.
4.4.3  Remote authentication
A remote user is authenticated by using identity information that is accessible by way of 
Lightweight Directory Access Protocol (LDAP). The LDAP server must be available for the 
users to log in to the system. Remote users have their groups defined by the remote 
authentication service.
Configuring remote authentication with LDAP
IBM Spectrum Virtualize systems support the following types of LDAP servers:
/SM590000IBM Security Directory Server
/SM590000Microsoft Active Directory
/SM590000OpenLDAP
Note: Superuser is the only user allowed to log in to the Service Assistant Tool. It is also 
the only user allowed to run sainfo and satask commands through the CLI.
Note: If local authentication is used, user accounts must be created for each Storwize 
V7000 system. If you want to allow access for a user on multiple systems, you must define 
the user in each system.