ONTAP Discussions

About LDAP schema MS-AD-BIS for CIFS and NFS


I was reading that the schema MS-AD-BIS allows for nexted grouping.  However, the only place I can find the text 'ms-ad-bis' is on the NetApp site, and only referring to the schema.  There is nothing I can find at Microsoft, or indeed via a general search about how to implement it in Windows, which versions it is supported by and so on.

Has any a clue where to find more information?

Hint:  The ONTAP developers must know something about it, since they have included it in the LDAP client schema list.



Re: About LDAP schema MS-AD-BIS for CIFS and NFS




Got curious to find out what is 'MS-AD-BIS', Looks like it is refering to RFC2307bis.


ONTAP 9.0 introduced a new built-in schema template for RFC-2307bis environments, specifically with
Active Directory in mind. This schema is called MS-AD-BIS and should be used with Microsoft Active
Directory LDAP servers whenever possible.


Found some some reference below:

This is a new schema (AD-MS-BIS) template available in ONTAP 9 for use with RFC-2307bis schemas, please refer to links below:


How to configure RFC 2307bis for Windows: (ldap_schema = rfc2307bis)


Secure Unified Authentication (MS-AD-BIS) : This PDF looks useful.
https://www.netapp.com/us/media/tr-4073.pdf (Page:122)


View solution in original post

Re: About LDAP schema MS-AD-BIS for CIFS and NFS


Thank you Ontapforrum:


It looks like I have a little reading to do.  We have several flavors of LDS, including, believe it or not, Adam still running;  unfortunately we don't have an ID SME, so I'm trying to figure out how to go forward.

Our aim is to manage permissions from one platform, but have them apply to both SMB and NFS (non-kerb).


Justin Parisi recommended using SMB/NTFS as the driving protocol, but I need to document the implementation, management and operation of permissions for all groups involved, i.e. Windows, AD, Help Desk, Storage, ;).  Being able to next groups in LDAP will make things alot easier.


I will read, and flag this as an answer in a few days.  Hope you don't mind waiting...


Re: About LDAP schema MS-AD-BIS for CIFS and NFS


I hope the link below provides all the information you need:

File sharing between NFS and CIFS 

Re: About LDAP schema MS-AD-BIS for CIFS and NFS


Hi Tasp:


Just wanted to know if you were able to achieve what you wanted.

We have a similar requirement to map every NFS or CIFs access to a user in Active Directory.

The solution proposed seems to be the one, but have not tried it yet.




Re: About LDAP schema MS-AD-BIS for CIFS and NFS




Sorry for the late reply.  I've tried using BIS, and for some reason I lose LDAP access from AD when I use it.  That doesn't mean I have done something wrong, or perhaps it is because of an option in our AD.  Unfortunately we don't have AD Identity Management SME's on site, and I don't have a lab nor the time to play with.  If you do try it and are successful, would you kindly let me know?



Earn Rewards for Your Review!
GPI Review Banner
All Community Forums