Data ONTAP Discussions

About LDAP schema MS-AD-BIS for CIFS and NFS

I was reading that the schema MS-AD-BIS allows for nexted grouping.  However, the only place I can find the text 'ms-ad-bis' is on the NetApp site, and only referring to the schema.  There is nothing I can find at Microsoft, or indeed via a general search about how to implement it in Windows, which versions it is supported by and so on.

Has any a clue where to find more information?

Hint:  The ONTAP developers must know something about it, since they have included it in the LDAP client schema list.

TasP

2 REPLIES 2

Re: About LDAP schema MS-AD-BIS for CIFS and NFS

Hi,

 

Got curious to find out what is 'MS-AD-BIS', Looks like it is refering to RFC2307bis.

 

ONTAP 9.0 introduced a new built-in schema template for RFC-2307bis environments, specifically with
Active Directory in mind. This schema is called MS-AD-BIS and should be used with Microsoft Active
Directory LDAP servers whenever possible.

 

Found some some reference below:

This is a new schema (AD-MS-BIS) template available in ONTAP 9 for use with RFC-2307bis schemas, please refer to links below:

 

How to configure RFC 2307bis for Windows: (ldap_schema = rfc2307bis)

https://kb.netapp.com/app/answers/answer_view/a_id/1031211/loc/en_US
https://kb.netapp.com/app/answers/answer_view/a_id/1074006/loc/en_US
https://unofficialaciguide.com/2019/07/31/ldap-schemas-for-aci-administrators-rfc2307-vs-rfc2307bis/
https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.cdot-famg-nfs%2FGUID-B1CCBCC8-9FF0-4270-A4F4-679BE315C58A.html
https://www.netapp.com/us/media/tr-3458.pdf
https://whyistheinternetbroken.wordpress.com/2018/08/16/securing-nfs-mounts-in-a-docker-container/
https://blogs.msdn.microsoft.com/sfu/2010/06/21/proof-of-concept-nfs-attributes-editor/


Secure Unified Authentication (MS-AD-BIS) : This PDF looks useful.
https://www.netapp.com/us/media/tr-4073.pdf (Page:122)
https://tools.ietf.org/html/draft-howard-rfc2307bis-02


Thanks!

Re: About LDAP schema MS-AD-BIS for CIFS and NFS

Thank you Ontapforrum:

 

It looks like I have a little reading to do.  We have several flavors of LDS, including, believe it or not, Adam still running;  unfortunately we don't have an ID SME, so I'm trying to figure out how to go forward.

Our aim is to manage permissions from one platform, but have them apply to both SMB and NFS (non-kerb).

 

Justin Parisi recommended using SMB/NTFS as the driving protocol, but I need to document the implementation, management and operation of permissions for all groups involved, i.e. Windows, AD, Help Desk, Storage, Smiley Wink.  Being able to next groups in LDAP will make things alot easier.

 

I will read, and flag this as an answer in a few days.  Hope you don't mind waiting...

TasP

Forums