How to grant admin access to a CDOT cluster via an Active Directory group

[89sigo]

We have a new 4 node CDOT cluster that we are building out at this time. This is the first on our company as the rest are all running 7-mode.

When I add execute the following commands on our new CDOT cluster, I am able to successfully login via putty or system manager:

security login create -vserver vs1 -username DOMAIN\username -application ontapi -authmethod domain -role admin
security login create -vserver vs1 -username DOMAIN\username -application ssh -authmethod domain -role admin

However, I need to provision security access via AD groups as we have a ot of admins that need access.

If I use the following commands to provision security, the commands are accepted by ONTAP but AD credential sets will not grant access to putty or system manager.

security login create -vserver vs1 -username "DOMAIN\AD Group" -application ontapi -authmethod domain -role admin
security login create -vserver vs1 -username "DOMAIN\AD Group" -application ssh -authmethod domain -role admin

Please provide comments if you have ideas on next steps.

[SMINATHA22]

We have the exact same issue here. Really tough from a management perspective to have to set manually add and remove user admin accounts on the cluster.

[jbastogne]

AD security group is not supported, only AD domain user could be used starting DOT 8.1.1.

From the Release Notes:

Starting with Data ONTAP 8.1.1, you can enable Active Directory (AD) domain users to access the cluster (admin Vserver) by setting up an authentication tunnel through a CIFS-enabled Vserver. You must also create cluster user accounts for the domain users.

[DaleS]

I have done it in 8.3 please see below for the steps

Here are the steps to grant access after you have CIFS setup in your SVM (This portion has to be done before the below steps will allow access)

my-fas8060> security login domain-tunnel create -vserver (nameofSVM)

(gives SSH  login)

my-fas8060> security login create -vserver (nameofSVM) -username domain\group name -application ssh -authmethod domain -role admin

(gives GUI login)

my-fas8060> security login create -vserver (nameofSVM) -username domain\group name -application http -authmethod domain -role admin

my-fas8060> security login create -vserver (nameofSVM) -username domain\group name -application ontapi -authmethod domain -role admin

[aborzenkov]

What credentials are used to log in? You cannot set group password, cannot you?

[JROBERTS6670]

Hi, 

In 8.2.3P4, I found that you have to first create the domain-tunnel SVM, then create the user for the cluster name.

my-fas8060> security login domain-tunnel create -vserver (nameofDomainTunnelSVM)

(gives SSH  login)

my-fas8060> security login create -vserver (nameofCluster) -username domain\group name -application ssh -authmethod domain -role admin

(gives GUI login)

my-fas8060> security login create -vserver (nameofCluster) -username domain\group name -application http -authmethod domain -role admin

my-fas8060> security login create -vserver (nameofCluster) -username domain\group name -application ontapi -authmethod domain -role admin

That is how it worked for me.

-Jack

[Sahana]

Hi,

Refer https://kb.netapp.com/support/index?page=content&id=1013901 for the procedure.

[rpulikool]

Hi,

I was able to set the configuration that you have mentioned, but how do you login once it is set.

Is login id "Domain\username" or "Domain\group\username"

Regards

[piosos]

http://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cm-cmpr-900%2Fsecurity__login__create.html

example ONTAP 9:

cluster1::> security login create -user-or-group-name DOMAIN\adgroup -application ssh -authentication-method domain -role readonly

login as Domain\username

[ARUP-Labs]

Thnaks for this post, it worked for us!

[scottgelb]

8.3 adds support for domain groups over ssh and ontap (not the gui though)

[ilonak]

If the group name has a space in it, the quotes around it should work, yes?  Example:  "DOMAIN\Domain Admins"