Patent ID: 8402514

Claim:
A method comprising: authenticating a user of a client when the user logs on to a storage management system; upon successfully authenticating the user, determining a set of roles of the user and capabilities of the user in each of the determined roles, and caching the determined roles and capabilities of the user in a cache coupled to an access permission database; receiving a request from the user to perform a first operation from a plurality of operations on a first resource from a plurality of storage system resources, wherein the storage system resources are organized as a hierarchy of containers and include at least a volume and an aggregate; and performing an RBAC (Role-Based Access Control) access check to resolve the request using entries stored in the cache, wherein performing the RBAC access check further comprises: identifying the entries in the cache having a role parameter matching one of the determined roles of the user and an operation parameter matching the first operation; determining whether at least one of the identified entries has a resource parameter that matches the first resource or matches a parent resource of the first resource, wherein the parent resource is a container within which the first resource is located; and upon determination that a match of the first resource or a match of the parent resource exists, granting access permission to the user of the client to perform the first operation on the first resource.