Powershell Toolkit AD Login not working

[Erik_gruetter]

Hey there

Since upgrading to Netapp Ontap Powershell Toolkit 9.11.1.2208 from PStoolkit 9.10.1.2111, AD login does not work anymore on our controllers:

Connect-NcController : The remote server returned an error: (401) Unauthorized.
At line:1 char:1
+ Connect-NcController XXX
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidResult: (XXX:NcController) [Connect-NcController], WebException
+ FullyQualifiedErrorId : HttpConnectionFailed,DataONTAP.C.PowerShell.SDK.ConnectNcController

However, when using PStoolkit 9.10.1.2111, AD login works without issues (even after reverting back from PStoolkit 9.11.1.2208). When using local accounts, the connection works without issues. Setting the option -https also does not help.

Best regards
Erik

[hmoubara]

Hello @Erik_gruetter 

When connecting using a active directory account, add the -ZapiCall at the end of the connect command should do the trick.

Per example:

PS C:\Users\Administrator.DEMO> Connect-NcController x.x.x.x -cred demo\test -ZapiCall

Thanks 

[Erik_gruetter]

Thanks, that seems to work so far. However, as Zapi gets turned off end of this year, how are we supposed to connect to our controllers via AD once that happens?

[hmoubara · Accepted solution]

Hello @Erik_gruetter 

Some Ontapi command does not have an equivalent REST API call, so you can use the -ONTAPI if you run into a command that is not working.

You can check the below documentation about mapping between Ontapi and REST API:

https://library.netapp.com/ecm/ecm_download_file/ECMLP2882104

Hope this answer your question.

Thanks 

[JoshuaPost-M]

Thank you.  I've been sitting on the Powershell Module 9.10 version waiting to figure out why I couldn't authenticate with my AD Service Account anymore.  Odd that neither -ONTAPI nor -ZAPICALL are listed when you do 'get-help connect-nccontroller' but both of them allow me to authenticate when I couldn't without them.

[yuvaraju]

Equivalent for Active-Directory ZAPI in REST API are planned for next ONTAP release

[NEILHOLMES]

Hi,

thanks for this post. We are currently running ONTAP 9.10.1P12. I have Powershell Toolkit 9.13.1 installed and the use of the -ZapiCall or -ONTAPI flag resolved my 401 connection issue. 

As ONTAP is now on version 9.13.1, I wondered if I can revisit your statement that "Equivalent for Active-Directory ZAPI in REST API are planned for next ONTAP release".

Once we upgrade our systems to ONTAP 9.13.1, will I need to change my Powershell scripts to stop using the -ZapiCall or -ONTAPI flags ?. Is this flag redundant in ONTAP 9.13.1?.

Many thanks.