Server Type | Select LDAP if the authentication server is a Linux/UNIX LDAP server, Active Directory if you are using a Microsoft Active Directory server. |
Authority Name | Provide a name for this external authentication authority. This name can be whatever you want it to be, it is only to differentiate between other authorities when multiple are configured. |
Provider Server Name | This field should contain the Fully Qualified Domain Name (FQDN) of your AD or LDAP server. |
Tenant | Tenants can be used in environments where more than one authentication method may be used and/or when multiple authorities must be configured. By default, the "default" tenant is selected. The use of tenants alters your log-in method. When the default tenant is used, you can log in to the NMC using "domain\user" if a tenant other than the default tenant is used you must specify "tenant\domain\user" when logging into the NMC. |
Domain | Specify your full domain name (excluding a hostname). Typically this is your base DN which is consisted of your Domain Component (DC) values of your domain. |
Port Number | For LDAP and AD integration use port 389. For LDAP over SSL use port 636. These ports are non-NetWorker default ports on the AD/LDAP server. |
User DN | Specify the Distinguished Name ![]() Specify the relative DN of the user account, or the full DN if overriding the value set in the Domain field. |
User DN Password | Specify the password of the user account specified. |
Group Object Class | The object class that identifies groups in the LDAP or AD hierarchy.
|
Group Search Path | This field can be left blank in which case authc is capable of querying the full domain. Permissions must be granted for NMC/ NetWorker server access before these users/groups can log in the NMC and manage the NetWorker server. Specify the relative path to the domain instead of full DN. |
Group Name Attribute | The attribute that identifies the group name. For example, cn. |
Group Member Attribute | The group membership of the user within a group.
|
User Object Class | The object class that identifies the users in the LDAP or AD hierarchy. For example, inetOrgPerson or user |
User Search Path | Like Group Search Path this field can be left blank in which case authc is capable of querying the full domain. Specify the relative path to the domain instead of full DN. |
User ID Attribute | The user ID that is associated with the user object in the LDAP or AD hierarchy.
|
authc_mgmt -u Administrator -p NetWorker_Admin_Pass -e query-ldap-users -D query-tenant=tenant_name -D query-domain=domain_name
authc_mgmt -u Administrator -p NetWorker_Admin_Pass -e query-ldap-groups -D query-tenant=tenant_name -D query-domain=domain_name
authc_mgmt -u Administrator -p NetWorker_Admin_Pass -e query-ldap-groups-for-user -D query-tenant=tenant_name -D query-domain=domain_name -D user-name=ad/ldap_username
authc_mgmt -u Administrator -p Pa$$w0rd01 -e query-ldap-users -D query-tenant=default -D query-domain=lab.emc.com
The query returns 21 records.
User Name Full Dn Name
Administrator cn=Administrator,cn=Users,dc=lab,dc=emc,dc=com
Guest cn=Guest,cn=Users,dc=lab,dc=emc,dc=com
...
...
authc_mgmt -u Administrator -p Pa$$w0rd01 -e query-ldap-groups -D query-tenant=default -D query-domain=lab.emc.com
The query returns 55 records.
Group Name Full Dn Name
Administrators cn=Administrators,cn=Builtin,dc=lab,dc=emc,dc=com
NetWorker_Admins cn=NetWorker_Admins,cn=Users,dc=lab,dc=emc,dc=com
...
...
authc_mgmt -u Administrator -p Pa$$w0rd01 -e query-ldap-groups-for-user -D query-tenant=default -D query-domain=lab.emc.com -D user-name=bkupadmin
The query returns 5 records.
Group Name Full Dn Name
Domain Admins cn=Domain Admins,cn=Users,dc=lab,dc=emc,dc=com
NetWorker_Admins cn=NetWorker_Admins,cn=Users,dc=lab,dc=emc,dc=com
...
...
nsraddadmin -e "OU=group,CN=you,CN=want,CN=to,CN=add,DC=domain,DC=local"
example:
nsraddadmin -e "CN=NetWorker_Admins,CN=Users,DC=lab,DC=emc,DC=com"
authc_config -u Administrator -p NetWorker_Admin_Pass -e add-permission -D permission-name=FULL_CONTROL -D permission-group-dn="AD/LDAP_group_dn"
e.g:
authc_config -u Administrator -p Pa$$w0rd01 -e add-permission -D permission-name=FULL_CONTROL -D permission-group-dn="cn=NetWorker_Admins,cn=Users,dc=lab,dc=emc,dc=com"
Permission FULL_CONTROL is created successfully.
authc_config -u Administrator -p Pa$$w0rd01 -e find-all-permissions
The query returns 2 records.
Permission Id Permission Name Group DN Pattern Group DN
1 FULL_CONTROL ^cn=Administrators,cn=Groups.*$
2 FULL_CONTROL cn=NetWorker_Admins,cn=Users,dc=lab,...