Configuring AD/LDAP servers on clusters deployed with only media servers
NetBackup Flex Scale supports multiple AD/LDAP server configuration on clusters deployed with only media servers. You can configure AD/LDAP servers using the Appliance GUI. In a NetBackup Flex Scale deployment with only media servers, the AD/ LDAP servers need to be reachable through the management network.
There is an option in the tab of the Appliance GUI to add role to domain user/groups. Once a domain user has the appliance administrator role, the user can SSH to the host. Based on the IP used to SSH, the cluster-level CLI or the node-level CLI is launched. If you SSH to eth1 (management) IP of any node, the node-level CLI gets launched. If you SSH to console IP, the cluster-level CLI gets launched. Users with appliance administrator role and users that are part of groups with appliance administrator role can access the cluster through various interfaces such as SSH, GUI and REST APIs. Veritas recommends that you assign role to domain users/groups using the GUI.
The domain users and groups must have an UID and GID. This must be configured in the domain server so that you can SSH to the nodes. The domain users UID should start from 10000 onwards, else the UID will conflict with the local user UID.
To configure AD/LDAP servers for clusters deployed with only media servers
- You have to first add a domain. Go to the Appliance GUI > Settings > Directory Services management tab. Click Configure.
- Select Appliance management.
Provide the AD/LDAP server details. The directory type can be Open LDAP or Active Directory. Click Save.
- Once the AD/LDAP server configuration operation is successful, the AD/LDAP server(s) appears in the list with usage as Appliance management.
You can perform a test connection to validate the newly added domain configuration. Click . For performing a test connection, you have to the provide AD/LDAP password. You will receive notifications after the successful completion/failure of the test connection.
On the same page, there is an option to remove the domain configuration.
Roles can be assigned to a directory user as well as group.
To assign a role to AD/LDAP users and groups
- From the navigation menu on the left, go to Settings > User management. The User management pane displays all the users that currently exist in the cluster configuration.
- To add a new user/group, click Add.
- Click on Directory for adding external users/group. The user/group should be specified in the format username@IP|FQDN|domainname. For example, testuser1@10.1.1.10 or testgroup@mydomain.example.com. Domain name can be used only if it was provided during AD/LDAP configuration.
- In the Add administrator dialog box, enter the details. Click Add.
- Once the operation completes verify that the new user/group you added appears in the list of users displayed in the User management pane.
For local users, the user type appears as Local. For external users (AD/LDAP users/group), the user type appears as Active Directory and Open LDAP. It is specified whether the user is an individual user or group.
The domain name information is also provided.
To remove a particular user role, See Modifying user roles.