ONTAP Discussions

How to grant admin access to a CDOT cluster via an Active Directory group

89sigo
25,208 Views

We have a new 4 node CDOT cluster that we are building out at this time. This is the first on our company as the rest are all running 7-mode.

When I add execute the following commands on our new CDOT cluster, I am able to successfully login via putty or system manager:

security login create -vserver vs1 -username DOMAIN\username -application ontapi -authmethod domain -role admin
security login create -vserver vs1 -username DOMAIN\username -application ssh -authmethod domain -role admin

However, I need to provision security access via AD groups as we have a ot of admins that need access.

If I use the following commands to provision security, the commands are accepted by ONTAP but AD credential sets will not grant access to putty or system manager.

security login create -vserver vs1 -username "DOMAIN\AD Group" -application ontapi -authmethod domain -role admin
security login create -vserver vs1 -username "DOMAIN\AD Group" -application ssh -authmethod domain -role admin

Please provide comments if you have ideas on next steps.

11 REPLIES 11

SMINATHA22
25,169 Views

We have the exact same issue here. Really tough from a management perspective to have to set manually add and remove user admin accounts on the cluster.

jbastogne
25,169 Views

AD security group is not supported, only AD domain user could be used starting DOT 8.1.1.

From the Release Notes:

Starting with Data ONTAP 8.1.1, you can enable Active Directory (AD) domain users to access the cluster (admin Vserver) by setting up an authentication tunnel through a CIFS-enabled Vserver. You must also create cluster user accounts for the domain users.

DaleS
23,379 Views

I have done it in 8.3 please see below for the steps

 

Here are the steps to grant access after you have CIFS setup in your SVM (This portion has to be done before the below steps will allow access)

 

my-fas8060> security login domain-tunnel create -vserver (nameofSVM)

 

(gives SSH  login)

my-fas8060> security login create -vserver (nameofSVM) -username domain\group name -application ssh -authmethod domain -role admin

 

(gives GUI login)

my-fas8060> security login create -vserver (nameofSVM) -username domain\group name -application http -authmethod domain -role admin

 

my-fas8060> security login create -vserver (nameofSVM) -username domain\group name -application ontapi -authmethod domain -role admin

aborzenkov
23,333 Views

What credentials are used to log in? You cannot set group password, cannot you?

JROBERTS6670
21,994 Views

Hi, 

 

In 8.2.3P4, I found that you have to first create the domain-tunnel SVM, then create the user for the cluster name.

 

my-fas8060> security login domain-tunnel create -vserver (nameofDomainTunnelSVM)

 

(gives SSH  login)

my-fas8060> security login create -vserver (nameofCluster) -username domain\group name -application ssh -authmethod domain -role admin

 

(gives GUI login)

my-fas8060> security login create -vserver (nameofCluster) -username domain\group name -application http -authmethod domain -role admin

 

my-fas8060> security login create -vserver (nameofCluster) -username domain\group name -application ontapi -authmethod domain -role admin

 

That is how it worked for me.

 

-Jack

Sahana
21,982 Views

Hi,

 

Refer https://kb.netapp.com/support/index?page=content&id=1013901 for the procedure.

If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.

rpulikool
17,650 Views

Hi,

 

I was able to set the configuration that you have mentioned, but how do you login once it is set.

 

Is login id "Domain\username" or "Domain\group\username"

 

Regards

piosos
7,839 Views

 

http://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cm-cmpr-900%2Fsecurity__login__create.html

 

example ONTAP 9:

 

cluster1::> security login create -user-or-group-name DOMAIN\adgroup -application ssh -authentication-method domain -role readonly

 

 

login as Domain\username

ARUP-Labs
7,404 Views

Thnaks for this post, it worked for us!

scottgelb
23,283 Views

8.3 adds support for domain groups over ssh and ontap (not the gui though)

ilonak
23,175 Views

If the group name has a space in it, the quotes around it should work, yes?  Example:  "DOMAIN\Domain Admins"

Public