topic Re: SSH admin Login without password - Domain Group User in ONTAP Discussions

SSH admin Login without password - Domain Group User

LUN_Move_Events_filter — Wed, 04 Jun 2025 10:53:45 GMT

Hi there. I've reviewed the following link, but have a unique (surely not) problem.

https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/How_to_set_up_public_key_authentication_Cluster-Mode_Data_OnTap_(cDOT)_for_login_without_password_through_SSH

My admin user account is part of an AD Admin Group, the GROUP has access to logon to the Cluster & we are not allowed to have individual account access. They want admin access controlled through the AD group. So thats all fine and works, but I want to setup key pair login with my AD authenticated account via SSH. The above article says I need my own individual account access on the cluster to upload my pub key.

I guess I'm wondering if my AD auth can be forwarded to either System Manager or my SSH session? OR how do I make SSH login work with a key pair while using an AD Group account? Hopefully that makes sense.

Re: SSH admin Login without password - Domain Group User

hmoubara — Fri, 25 Sep 2020 07:43:04 GMT

Hello,

I tried running through your request in one my lab but i am not able to create either recommendation that you requesting.

I have shared below a TR regarding Multifactor Authentication in ONTAP that might be helpful:

https://www.netapp.com/us/media/tr-4647.pdf

Thanks

Re: SSH admin Login without password - Domain Group User

LUN_Move_Events_filter — Sun, 27 Sep 2020 23:04:34 GMT

Thanks for your efforts. I'm trying to log into the CLI without having to type a password. I have to log in to different clusters about 30 times a day. That's 30 times I need to type in a complex password.

I'm looking for a way to authenticate by passing through my already authenticated windows AD session... or any other way, like public/private key but it has to work with my account being part of an AD group.

It seems ONTAP does not currently support this. Maybe a feature request? What about a tick box on the System Manager login page like vSphere has to use your current session credentials to authenticate?