Adding AD or LDAP domains in NetBackup
NetBackup supports Active Directory (AD) or Lightweight Directory Access Protocol (LDAP) domain users.
If an AD domain or an LDAP domain is added in NetBackup, the respective domain users can logon to a NetBackup master server and Security Administrator can assign RBAC roles to these domain users.
For more information on RBAC (Role-based Access Control), see the NetBackup Web UI Security Administrator's Guide.
http://www.veritas.com/docs/DOC5332
The following procedure describes how to add an existing AD or LDAP domain in NetBackup and authenticate the domain users to access NetBackup.
To add an AD domain or an LDAP domain in NetBackup
- Run the following command to add an AD domain or an LDAP domain in the NetBackup master server:
vssat addldapdomain -d DomainName -s server_URL -u user_base_DN -g group_base_DN [-f trusted_CA_file_name] [-t rfc2307 | msad | {-c user_object_class -a user_attribute -q user_GID_attribute -un user_display_name_attribute -ui user_ID_attribute[:value_type] -ud user_description_attribute -x group_object_class -y group_attribute -z group_GID_attribute -gn group_display_name_attribute -gi group_ID_attribute[:value_type] -gd group_description_attribute [-k DN | UID]]} [-b FLAT | BOB] -m admin_user_DN [-w admin_user_password] [-p SUB | ONE | BASE]Note:
Ensure that the user that is specified in the -m option has the required rights to query the AD or LDAP server.
For more information on the vssat command, see the NetBackup Commands Reference Guide.
http://www.veritas.com/docs/DOC5332
An example to add an LDAP domain:
vssat addldapdomain -d nbudomain -s ldap://example.com -u "OU=Users,DC=example,DC=com" -g "OU=Groups,DC=example,DC=com" -m "CN=TestUser,OU=Users,DC=example,DC=com" -t msad - Run the vssat validateprpl command to verify whether the specified AD or LDAP domain is successfully added or not.
For more information on the command, see the NetBackup Commands Reference Guide.
http://www.veritas.com/docs/DOC5332
If the AD or LDAP domain is not added and the vssat validateprpl or vssat validategroup command fails, you need to carry out certain troubleshooting steps to resolve the issue.
See Troubleshooting AD or LDAP domain configuration issues .