topic Re: Multi-admin Verify support for ADS groups in ONTAP Discussions

Multi-admin Verify support for ADS groups

a_lehn — Tue, 27 Sep 2022 11:32:50 GMT

Hi
We are currently testing the use of MAV which is supported in Ontap 9.11.1x.

As I see it, it is only possible to create local users as approvers, does anyone know if there will be support for using AD groups as a approvers. ?

The idea is via. automation that a user is temporarily members of a AD group to approve pending approver

Re: Multi-admin Verify support for ADS groups

elementx — Tue, 27 Sep 2022 13:26:44 GMT

How would ADS admins approve any action (e.g. change of ADS or NTP) if ADS were to be wiped or unreachable?

Re: Multi-admin Verify support for ADS groups

a_lehn — Wed, 28 Sep 2022 09:00:47 GMT

Understand your point
There will also always be a local admins as extra approve, which we normalt not used (local admin user).
In our environment are an admin AD group empty when it is not in use (time limited). We have different ad groups that have access for different roles.

This helps us protect our day-to-day against limit admin rights.

Re: Multi-admin Verify support for ADS groups

elementx — Wed, 28 Sep 2022 10:35:58 GMT

Do you need one of the two accounts to be ADS-based and the other local based, or both ADS-based?

If you want the both to be ADS-based, how do you plan to handle ADS outage or unplanned downtime?

Re: Multi-admin Verify support for ADS groups

a_lehn — Wed, 28 Sep 2022 11:00:27 GMT

Today we use our ADS account depending of what you want to do, where you join to differensens storage rules (time limited).
We never use the local admin accounts.

Our idea is to use 2 ADS-groups, when we need an approval, a storage admins joins the approval group and will aut be removed from the approval group again (time-limited automations tools).

In case there should be an ADS outage/unplanned, we will use the local storage admin users for that.
Hope it make sense.
Maybe I have misunderstand the way MAV can works.

Re: Multi-admin Verify support for ADS groups

elementx — Wed, 28 Sep 2022 11:59:03 GMT

I haven't used the feature myself yet, so I don't know either. But now that the use case is clear someone who's used it will be able to comment and confirm.

Re: Multi-admin Verify support for ADS groups

dbenadib — Thu, 29 Sep 2022 16:27:10 GMT

Having Active Directory users as approver is working ..

Re: Multi-admin Verify support for ADS groups

elementx — Thu, 29 Sep 2022 16:40:45 GMT

Can anything on ONTAP be approved if ADS is down?

Or does it practically freeze operations because they can't be approved?

Re: Multi-admin Verify support for ADS groups

dbenadib — Thu, 29 Sep 2022 16:45:37 GMT

Ontap will not check on AD availability. But it that case every logon to ONTAP will be lost not only the selected command that apply to MAV restrictions.

In any case if you are really concerned about that you could add both local and AD account as approvers

Re: Multi-admin Verify support for ADS groups

elementx — Thu, 29 Sep 2022 16:49:35 GMT

Right, so using the feature with ADS accounts and no fall-back seems risky.

Re: Multi-admin Verify support for ADS groups

a_lehn — Fri, 30 Sep 2022 06:36:02 GMT

I tried the same thing but if in your example I use demo\user1 to delete snapshot I can't use demo\user2 to approver, only a local ontap user works according to my test.

Re: Multi-admin Verify support for ADS groups

dbenadib — Fri, 30 Sep 2022 08:13:38 GMT

It looks like an issue on Ure environment, In my lab it works

DEMO\user1 tried to delete a snapshot on volume vol3

it generates the request with index #8

Demo\user2 approved the request

Demo\user1 retried to delete snapshot with success:

Re: Multi-admin Verify support for ADS groups

a_lehn — Tue, 04 Oct 2022 11:04:58 GMT

It works if you use AD user, correct... but not when using AD groups.
One thing that I noticed about it, when you use AD users, you have to be careful how you write the domain\username when you create approval-group

security multi-admin-verify approval-group create -name mav-grp1 -approvers DDDD\username......

If you login with lowercase "dddd\username" it work on SSH level but MAV will not work correctly, it have to be the same upper/lowercase....

Re: Multi-admin Verify support for ADS groups

MicheldeBruin — Tue, 14 Feb 2023 14:00:24 GMT

So Active Directory Groups still cannot be used, we have specific groups to manage our netapps and are already waiting several years, to make this happen. especially for SSO on system manager.

we have a lot of netapps that needs to be managed by a group af support administrator, but these also change regurarly

kind regards,
Michel de Bruin

Re: Multi-admin Verify support for ADS groups

Reinhard089 — Tue, 02 May 2023 14:33:10 GMT

Hi,

we do have the same problem, it is nice to know that only AD-Users are working, but we need AD-Groups working with MAV.
nice regards

reinhard

Re: Multi-admin Verify support for ADS groups

a_lehn — Wed, 03 May 2023 07:20:14 GMT

Hi,
After dialog with Netapp, they told me that ADS-groups will be supported in future ONTAP releases.
Best regards
Anders

Re: Multi-admin Verify support for ADS groups

PatrickNgo — Thu, 07 Dec 2023 05:11:56 GMT

@a_lehnDo we have any developments on this? Customer is interested in using MAV with AD groups rather than users.

Re: Multi-admin Verify support for ADS groups

Reinhard089 — Thu, 07 Dec 2023 07:09:28 GMT

no, we are still waiting for the "new upcoming" ontap release. to use MAV with AD groups.

we want to secure some, not all, admin work with MAV. and it is not important if this feature is working with an outage of AD, than we wait with this kind of work, till AD is reachable again.

our problem is, that we do not want to be user-admins and take care who is in that backup team, that's the job of the teamleader (, of that Backupteam).

Re: Multi-admin Verify support for ADS groups

PatrickNgo — Thu, 07 Dec 2023 07:38:33 GMT

Thank you @Reinhard089

Re: Multi-admin Verify support for ADS groups

TMADOCTHOMAS — Fri, 05 Apr 2024 19:46:30 GMT

@Reinhard089 or @a_lehn (or anyone), I'm adding my "+1" to this request. I am just testing MAV for the first time and ran across the group limitation. Are there any updates on (a) adding the ability to use AD groups, and (b) removing the case sensitivity from AD users (and groups if they are added)?

I'm very thankful I thought to add a second local account before testing "just in case" or my entire simulator would have had to be rebuilt.