NetWorker: How To configure LDAPS Authentication

keytool -delete -alias ALIAS_NAME -keystore /opt/nre/java/latest/lib/security/cacerts -storepass changeit

-----BEGIN CERTIFICATE-----
MIIGQDCCBSigAwIBAgITbgAAAAiwkngyAQWDwwACAAAACDANBgkqhkiG9w0BAQsF
ADBPMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxFjAUBgoJkiaJk/IsZAEZFgZlbWNs
...
7NZfi9DiEBhpFmbF8xP96qB/kTJC+29t/0VE8Fvlg87fRhs5BceIoX8nUnetNCdm
m4mGyefXz4TBTwD06opJf4NQIDo=
-----END CERTIFICATE-----

keytool -import -alias ALIAS_NAME -keystore /opt/nre/java/latest/lib/security/cacerts -storepass changeit -file PATH_TO\CERT_FILE

C:\Program Files\NRE\java\jrex.x.x_xxx\bin>keytool -import -alias winsrvr2k16.emclab.local -keystore "C:\Program Files\NRE\java\jrex.x.x_xxx\lib\security\cacerts" -storepass changeit -file C:\root-ca.cer
Owner: CN=emclab-WINSRVR2K16-CA, DC=emclab, DC=local
Issuer: CN=emclab-WINSRVR2K16-CA, DC=emclab, DC=local
Serial number: 183db0ae21d3108244254c8aad129ecd
...
...
...

Trust this certificate? [no]:  yes
Certificate was added to keystore

5) Confirm that the certificate is shown in the keystore:

keytool -list -keystore /opt/nre/java/latest/lib/security/cacerts -storepass changeit

NOTE: Pipe (|) the operating system grep or findstr command to the above to narrow the result.

C:\Program Files\NRE\java\jrex.x.x_xxx\bin>keytool -list -keystore "C:\Program Files\Java\jre1.8.0_201\lib\security\cacerts" -storepass changeit | findstr winsrvr2k16
winsrvr2k16.emclab.local, Feb 20, 2019, trustedCertEntry,

6) Restart the NetWorker server services. 
 

Linux: nsr_shutdown
      service networker start
Windows: net stop nsrd
         net start nsrd

NOTE: If the NetWorker server services are not restarted, authc will not read the cacerts file, and it will not detect the imported certificates required for establishing SSL communication with the LDAP server.

7, a) If your authentication server is LDAP (Linux LDAP server) or you are using an existing Active Directory (AD) external authority configuration then perform the following. If your authentication server is Active Directory (AD) and you are creating a new external authority go to step 8.

7, b) log in to the NetWorker Management Console (NMC) with your NetWorker Administrator account. Select Setup-->Users and Roles-->External Authority.

7, c) Create or modify your existing external authority configuration, select LDAP over SSL from the Server Type drop down. This will automatically change the port from 389 to 636:

NOTE: Expand the Show Advanced Options field and ensure that the correct values are set for your authentication server. See the Notes field of this KB for a table explaining the fields and values.

8, a ) There is a known issue where selecting LDAP over SSL sets the internal configuration parameter "is active directory" to false. This prevents successful AD logins even though the configuration succeeds. This can be avoided by using the method detailed in the Limitations section or by using the authc script method outlined in: https://www.dell.com/support/kbdoc/000020799

When using the AD script template the configuration should show:
 

root@nwserver:~/#: authc_config -u Administrator -e find-all-configs
Enter password:
The query returns 1 records.
Config Id Config Name
3         AD_over_SSL

root@nwserver:~/#: authc_config -u Administrator -e find-config -D config-id=3
Enter password:
Config Id                    : 3
Config Tenant Id             : 1
Config Name                  : AD_over_SSL
Config Domain                : emclab.local
Config Server Address        : ldaps://winsrvr2k16.emclab.local:636/dc=emclab,dc=local
Config User DN               : cn=Administrator,cn=users,dc=emclab,dc=local
Config User Group Attribute  : memberOf
Config User ID Attribute     : sAMAccountName
Config User Object Class     : user
Config User Search Filter    :
Config User Search Path      :
Config Group Member Attribute: member
Config Group Name Attribute  : cn
Config Group Object Class    : group
Config Group Search Filter   :
Config Group Search Path     :
Config Object Class          : objectclass
Is Active Directory          : true
Config Search Subtree        : true

authc_mgmt -u Administrator -p NetWorker_Admin_Pass -e query-ldap-users -D query-tenant=tenant_name -D query-domain=domain_name
authc_mgmt -u Administrator -p NetWorker_Admin_Pass -e query-ldap-groups -D query-tenant=tenant_name -D query-domain=domain_name
authc_mgmt -u Administrator -p NetWorker_Admin_Pass -e query-ldap-groups-for-user -D query-tenant=tenant_name -D query-domain=domain_name -D user-name=ad/ldap_username

authc_mgmt -u Administrator -p Pa$$w0rd01 -e query-ldap-users -D query-tenant=default -D query-domain=emclab.local
The query returns 21 records.
User Name      Full Dn Name
Administrator  cn=Administrator,cn=Users,dc=emclab,dc=local
Guest          cn=Guest,cn=Users,dc=emclab,dc=local
...
...

authc_mgmt -u Administrator -p Pa$$w0rd01 -e query-ldap-groups -D query-tenant=default -D query-domain=emclab.local
The query returns 55 records.
Group Name                              Full Dn Name
Administrators                          cn=Administrators,cn=Builtin,dc=emclab,dc=local
NetWorker_Admins                        cn=NetWorker_Admins,cn=Users,dc=emclab,dc=local
...
...

authc_mgmt -u Administrator -p Pa$$w0rd01 -e query-ldap-groups-for-user -D query-tenant=default -D query-domain=emclab.local -D user-name=bkupadmin
The query returns 5 records.
Group Name              Full Dn Name
Domain Admins           cn=Domain Admins,cn=Users,dc=emclab,dc=local
NetWorker_Admins        cn=NetWorker_Admins,cn=Users,dc=emclab,dc=local
...
...

10) When logged into the NMC as the default NetWorker Administrator account, open Setup-->Users and Roles-->NMC Roles. Open the properties of the Console Application Administrators role and enter the Distinguished Name   (DN) of a AD/LDAP group (collected in step 9) in the external roles field. For users who require the same level permissions as the default NetWorker Administrator account, you must specify the AD/LDAP group DN in the Console Security Administrators role. For AD users or groups who do not need administrative rights to the NMC Console, add their full DN in the Console User external roles.

authc_config -u Administrator -p NetWorker_Admin_Pass -e add-permission -D permission-name=FULL_CONTROL -D permission-group-dn="AD/LDAP_group_dn"