To connect an LDAP user domain

1. From the Flex Appliance Console, verify that the instance is on the same network as the LDAP domain. If it is not, edit the settings so that the instance can reach the domain.
2. Open the following port between the instance and the remote host if it is not already open:

   • If you want to enable SSL for the connection: port 389

   • If you do not want to enable SSL for the connection: port 636

3. Open an SSH session to the instance as the appadmin user and run the following command to navigate to the SSSD configuration file:

   sudo vi /etc/sssd/sssd.conf.

4. Run the following command to copy the file and create a backup:

   sudo cp /etc/sssd/sssd.conf /mnt/nbdata/sssd.conf.orig

5. In the sssd.conf file, locate and modify the following entries:

   • ldap_uri =

     Enter the LDAP server name and port. If you want to enable SSL for the connection, use port 636. If you do not want to enable SSL, use port 389.

     For example: ldap_uri = ldaps://example.cohesity.com:636

   • ldap_search_base =

     Enter the LDAP search domain.

     For example: ldap_search_base = dc=example,dc=cohesity,dc=com

   • ldap_tls_reqcert =

     If you want to enable SSL for the connection, enter hard.

     If you do not want to enable SSL for the connection, enter never.

     For example: ldap_tls_reqcert = hard

   Note:

   Other fields may also need to be modified depending on your LDAP configuration. Check the LDAP vendor documentation and follow those instructions if there are any differences.

6. If you did not enable SSL, proceed to the next step.

   If you enabled SSL, perform the following additional steps:

   • Add the following lines to the sssd.conf file:

     • ldap_tls_cacertdir = /mnt/nbdata/sssd/certs

     • ldap_tls_cacert = /mnt/nbdata/sssd/certs/<CA certificate>

       Where <CA certificate> is the file name of the LDAP CA certificate.

   • Run the following command to create a directory for the LDAP certificates:

     sudo mkdir -p /mnt/nbdata/sssd/certs

   • Copy all LDAP certificate files to this directory.

   • Run the following command to navigate to the LDAP configuration file:

     sudo vi /etc/openldap/ldap.conf

   • Add the following entry to this file:

     TLS_CACERTDIR /mnt/nbdata/sssd/certs

7. By default, all users on the remote user domain can log in to the instance. If you need to restrict access to specific users or groups, perform the following steps:

   • Navigate to /etc/sssd/sssd.conf on the instance and verify that the file includes the following line:

     access_provider = ldap

     If it does not, add it.

   • Add the following filter to the file:

     ldap_access_filter = <user list>

     Where <user list> is the list of users that you want to have access, in one of the following formats:

     • To add user groups, replace <user list> with the following:

       (memberOf=cn=<common name>,ou=<organizational unit>,dc=<domain component>)

       Where everything after memberOf= specifies the group that you want to provide access to.

       There may be more than one ou or dc, and you can also add multiple groups to the filter. For example:

       ldap_access_filter = (|(memberOf=cn=users1,ou=groups,dc=example,dc=company,dc=com) (memberOf=cn=users2,ou=admins,ou=groups,dc=example,dc=company,dc=com))

     • To add users, replace <user list> with the following:

       (sAMAccountName=<username>)

       You can also add multiple users. For example:

       ldap_access_filter = (|(sAMAccountName=user1) (sAMAccountName=user2))

     For more information on the LDAP access filter, refer to the Red Hat documentation.

   • Run the following command:

     systemctl restart sssd

8. By default, LDAP users have super administrator privileges and full access to the instance. To remove those privileges and designate the appadmin user as the only super administrator, perform the following steps:

   • Navigate to /etc/ssh/sshd_config and add the following line to the end of the file:

     AllowUsers appadmin

   • Run the following command:

     systemctl restart sshd

9. When the connection is complete, sign in to the instance as the appadmin user from the NetBackup web UI. Add and configure the remote users that you want to have access to the instance from the web UI. See the NetBackup Web UI Administrator's Guide for details.

   Note:

   The username maintenance is not supported on application instances.