Smart card Authentication for NetBackup Web UI
The NetBackup Web UI supports authentication of Active Directory (AD) or Lightweight Directory Access Protocol (LDAP) domain users with a digital certificate or smart card, including CAC and PIV. This authentication method only supports one AD or LDAP domain for each appliance primary server domain and is not available for local domain users.
Note:
Perform this configuration separately for each appliance primary server domain where you want to use this authentication method.
Ensure that you add the AD or the LDAP domain before you add access rules for domain users or configure the domain for smart card authentication. Use the vssat command to add AD or LDAP domains.
To add the AD or the LDAP domain for NetBackup
- Log on to the appliance primary server as a NetBackupCLI user.
- Run the vssat command.
vssat addldapdomain -d DomainName -s server_URL -u user_base_DN -g group_base_DN -t schema_type -m admin_user_DN
Replace the variables in the above command as per the following descriptions:
DomainName is a symbolic name that uniquely identifies an LDAP domain.
server_URL is the URL of the LDAP directory server for the given domain. The LDAP server URL must start with either
ldap://orldaps://. Starting withldaps://indicates that the given LDAP server requires SSL connection. For exampleldaps://my-server.myorg.com:636.user_base_DN is the LDAP-distinguished name for the user container. For example,
ou=user,dc=mydomain,dc=myenterprise,dc=com.group_base_DN is the LDAP-distinguished name for the group container. For
example, ou=group,dc=mydomain,dc=myenterprise,dc=com.schema_type specifies which type of LDAP schema to use. The two default schema types that are supported are rfc2307 or msad.
admin_user_DN is a string that contains the DN of the administrative user or any user that has search permission to the user container, or user subtree as specified by UserBaseDN. If the user container is searchable by anyone including an anonymous user, you can configure this option as an empty string. For example, --admin_user=. This configuration allows anyone to search the user container.
- Verify that the specified AD or LDAP domain was successfully added using vssat validateprpl. Note that you can also use the vssat command with the following options:
vssat removeldapdomain removes an LDAP domain from the authentication broker.
vssat validategroup checks the existence of a user group in domain provided.
vssat validateprpl checks the existence of a user in domain provided.
For more details on the vssat command, see the Veritas NetBackup Commands Reference Guide