Subscribe

How to grant admin access to a CDOT cluster via an Active Directory group

We have a new 4 node CDOT cluster that we are building out at this time. This is the first on our company as the rest are all running 7-mode.

When I add execute the following commands on our new CDOT cluster, I am able to successfully login via putty or system manager:

security login create -vserver vs1 -username DOMAIN\username -application ontapi -authmethod domain -role admin
security login create -vserver vs1 -username DOMAIN\username -application ssh -authmethod domain -role admin

However, I need to provision security access via AD groups as we have a ot of admins that need access.

If I use the following commands to provision security, the commands are accepted by ONTAP but AD credential sets will not grant access to putty or system manager.

security login create -vserver vs1 -username "DOMAIN\AD Group" -application ontapi -authmethod domain -role admin
security login create -vserver vs1 -username "DOMAIN\AD Group" -application ssh -authmethod domain -role admin

Please provide comments if you have ideas on next steps.

Re: How to grant admin access to a CDOT cluster via an Active Directory group

We have the exact same issue here. Really tough from a management perspective to have to set manually add and remove user admin accounts on the cluster.

Re: How to grant admin access to a CDOT cluster via an Active Directory group

AD security group is not supported, only AD domain user could be used starting DOT 8.1.1.

From the Release Notes:

Starting with Data ONTAP 8.1.1, you can enable Active Directory (AD) domain users to access the cluster (admin Vserver) by setting up an authentication tunnel through a CIFS-enabled Vserver. You must also create cluster user accounts for the domain users.

Re: How to grant admin access to a CDOT cluster via an Active Directory group

[ Edited ]

I have done it in 8.3 please see below for the steps

 

Here are the steps to grant access after you have CIFS setup in your SVM (This portion has to be done before the below steps will allow access)

 

my-fas8060> security login domain-tunnel create -vserver (nameofSVM)

 

(gives SSH  login)

my-fas8060> security login create -vserver (nameofSVM) -username domain\group name -application ssh -authmethod domain -role admin

 

(gives GUI login)

my-fas8060> security login create -vserver (nameofSVM) -username domain\group name -application http -authmethod domain -role admin

 

my-fas8060> security login create -vserver (nameofSVM) -username domain\group name -application ontapi -authmethod domain -role admin

Re: How to grant admin access to a CDOT cluster via an Active Directory group

What credentials are used to log in? You cannot set group password, cannot you?

Re: How to grant admin access to a CDOT cluster via an Active Directory group

8.3 adds support for domain groups over ssh and ontap (not the gui though)

Re: How to grant admin access to a CDOT cluster via an Active Directory group

[ Edited ]

If the group name has a space in it, the quotes around it should work, yes?  Example:  "DOMAIN\Domain Admins"

Re: How to grant admin access to a CDOT cluster via an Active Directory group

Hi, 

 

In 8.2.3P4, I found that you have to first create the domain-tunnel SVM, then create the user for the cluster name.

 

my-fas8060> security login domain-tunnel create -vserver (nameofDomainTunnelSVM)

 

(gives SSH  login)

my-fas8060> security login create -vserver (nameofCluster) -username domain\group name -application ssh -authmethod domain -role admin

 

(gives GUI login)

my-fas8060> security login create -vserver (nameofCluster) -username domain\group name -application http -authmethod domain -role admin

 

my-fas8060> security login create -vserver (nameofCluster) -username domain\group name -application ontapi -authmethod domain -role admin

 

That is how it worked for me.

 

-Jack

Re: How to grant admin access to a CDOT cluster via an Active Directory group

Hi,

 

Refer https://kb.netapp.com/support/index?page=content&id=1013901 for the procedure.

If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.

Re: How to grant admin access to a CDOT cluster via an Active Directory group

Hi,

 

I was able to set the configuration that you have mentioned, but how do you login once it is set.

 

Is login id "Domain\username" or "Domain\group\username"

 

Regards