topic Unable to log in using AD account on. in ONTAP Discussions

Unable to log in using AD account on.

Linux1987 — Tue, 05 Aug 2025 03:19:49 GMT

security login create -user-or-group-name domain\group -application ssh -authentication-method domain -role admin.

security login create -user-or-group-name domain\group -application ontapi -authentication-method domain -role admin.

security login create -user-or-group-name domain\group -application http -authentication-method domain -role admin.

For the user-or-group name should I use the Admin SVM or Data SVM ?

For vserver active-directory create -vserver should I use Admin SVM or Data SVM ?

Re: Unable to log in using AD account on.

Sanaman — Tue, 05 Aug 2025 03:36:14 GMT

If your user is cluster wide admin, then vserver=cluster_name

If you user is vserver (vsadmin) then vserver=svm_name

Re: Unable to log in using AD account on.

Linux1987 — Tue, 05 Aug 2025 05:20:11 GMT

Let's say my cluster name is letos, the domain name is netapp.los, and the Active Directory group name is red.

I ran the following commands to create logins for the group:

security login create -user-or-group-name NETAPP\red -vserver letos -application ssh -authentication-method domain -role admin
security login create -user-or-group-name NETAPP\red -vserver letos -application ontapi -authentication-method domain -role admin
security login create -user-or-group-name NETAPP\red -vserver letos -application http -authentication-method domain -role admin

After that, when I run the command:

vserver active-directory create -vserver <TAB>
I don’t see letos or an option that looks like the admin vserver for my cluster. Instead, I see other vsadmin users listed. I'm unsure which one to select for this step. How do I identify the correct vserver to use when joining the domain?

Re: Unable to log in using AD account on.

TMACMD — Tue, 05 Aug 2025 10:32:35 GMT

In order to create the Active Directory svm in the admin svm you must be on 9.16 or higher. Anything earlier than 9.16 you must create the Active Directory (or cifs) svm in a data svm and then create a domain tunnel ( security login domain-tunnel create -vserver xxxx)

Re: Unable to log in using AD account on.

Linux1987 — Tue, 05 Aug 2025 12:57:44 GMT

I'm running NetApp ONTAP version 9.16.

#security login create -vserver letos -user-or-group-name netapp\red -application http -authmethod domain -role admin
#security login create -vserver letos -user-or-group-name netapp\red -application ontapi -authmethod domain -role admin
#security login create -vserver letos -user-or-group-name netapp\red -application ssh -authmethod domain -role admin
#vserver active-directory create -vserver ras -account-name ras-gx -domain NETAPP.los -ou 'OU=NetApp Servers,DC=leos,DC=eos'

After running these commands, I'm unable to log in with my Active Directory account (netapp\red) and receive an error. What could I be missing?

Re: Unable to log in using AD account on.

TMACMD — Tue, 05 Aug 2025 16:45:42 GMT

You are mixing vservers

the user accounts are being created in vserver letos and the active-directory svm is being created in ras

Which is the admin svm?

You create the users in the admin svm.
you create the Active Directory in the admin svm

that’s likely your issue

Re: Unable to log in using AD account on.

Linux1987 — Tue, 05 Aug 2025 18:20:13 GMT

The admin SVM (Cluster) is named letos.

when I try to run: vserver active-directory create -vserver letos it doesn’t work for me that's why I was trying to use ras(Data SVM).

Re: Unable to log in using AD account on.

TMACMD — Tue, 05 Aug 2025 18:43:01 GMT

Are you SURE you are on 9.16? Every install I have done, with 9.16, this has worked without incident.

If you want to keep what you have:

security login domain-tunnel create ras

That will allow the admin SVM to tunnel through. If it is 9.16 and it is NOT working, something may be blocking you. Has anyone turned on any kind of Role-based access control? You may wish to open a ticket to correct.

verify: version

Re: Unable to log in using AD account on.

Linux1987 — Tue, 05 Aug 2025 21:51:09 GMT

Yes, I’m running version 9.16.1RC1. I’ll verify the role-based access and provide an update tomorrow.

Re: Unable to log in using AD account on.

TMACMD — Tue, 05 Aug 2025 22:19:50 GMT

OMG. please please update

9.16.1P6 is and has been out for a little while. Please get off the release candidate code!

Re: Unable to log in using AD account on.

Linux1987 — Tue, 05 Aug 2025 22:35:11 GMT

Haha, I'll update it first thing in the morning. Does the update fix the issue I was experiencing?

Re: Unable to log in using AD account on.

TMACMD — Tue, 05 Aug 2025 22:37:28 GMT

Not sure but there are likely hundreds of fixes and firmware updates that you are missing. I’d update and try again first

Re: Unable to log in using AD account on.

Linux1987 — Tue, 05 Aug 2025 23:04:26 GMT

Got it. I’ll update to that version and see if it resolves the issue. If it does, I’ll share the solution here for others. Thank you!