call authc_config.bat -u administrator -p <nmc_admin_password> -e add-config ^
-D "config-tenant-id=<tenant_id>" ^
-D "config-active-directory=y" ^
-D "config-name=<authority_name>" ^
-D "config-domain=<domain_name>" ^
-D "config-server-address=<protocol>://<hostname_or_ip_address>:<port>/<base_dn>" ^
-D "config-user-dn=<user_dn>" ^
-D "config-user-dn-password=<user_password>" ^
-D "config-user-search-path=<user_search_path>" ^
-D "config-user-id-attr=sAMAccountName" ^
-D "config-user-object-class=<user_object_class>" ^
-D "config-group-search-path=<group_search_path>" ^
-D "config-group-name-attr=cn" ^
-D "config-group-object-class=group" ^
-D "config-group-member-attr=member" ^
-D "config-user-search-filter=" ^
-D "config-group-search-filter=" ^
-D "config-search-subtree=n" ^
-D "config-user-group-attr=memberOf" ^
-D "config-object-class=objectClass"
config-tenant-id | Tenants can be used in environments where more than one authentication method may be used and/or when multiple authorities need to be configured. You do not need to create a tenant if only one AD/LDAP server is being used; You can use the default tenant, config-tenant-id=1. It is important to note that the use of tenants alters your log-in method. When the default tenant is used, you can log in to the NMC using "domain\user" if a tenant other than the default tenant is used you must specify "tenant-name\domain\user" when logging into the NMC. |
config-active-directory | If you are using a Microsoft Active Directory (AD) server: y If you are using an LDAP server (e.g: OpenLDAP): n Note: There are two different script templates "authc-create-ad-config" and "authc-create-ldap-config." Ensure that you are using the correct template for the authentication platform in use. |
config-name | This name is only an identifier for the authentication configuration being added to NetWorker. |
config-domain | This is the domain name that is used for logging into NetWorker. For example "emclab.local" can be set to "emclab". This can be set to align with how you log in to your workstations and systems integrated with AD/LDAP. |
config-server-address | <protocol>://<hostname_or_ip_address>:<port>/<base_dn> Protocol:
Hostname/IP address:
|
config-user-dn | Specify the full Distinguished Name ![]() |
config-user-dn-password | Specify the password for the account specified in the config-user-dn. |
config-user-search-path | This field can be left blank in which case authc can query the full domain. Permissions still must be granted for NMC/ NetWorker server access before these users/groups can log in the NMC and manage the NetWorker server. If a Base DN was specified in the config-server-address, specify the relative path (excluding the Base DN) to the domain. |
config-user-id-attr | The user ID that is associated with the user object in the LDAP or AD hierarchy.
|
config-user-object-class | The object class that identifies the users in the LDAP or AD hierarchy. For example, inetOrgPerson (LDAP) or user (AD) |
config-group-search-path | Like config-user-search-path this field can be left blank in which case authc is capable of querying the full domain. If a Base DN was specified in the config-server-address, specify the relative path (excluding the Base DN) to the domain. |
config-group-name-attr | The attribute that identifies the group name. For example, cn |
config-group-object-class | The object class that identifies groups in the LDAP or AD hierarchy.
|
config-group-member-attr | The group membership of the user within a group.
|
config-user-search-filter | (Optional.) The filter that the NetWorker Authentication Service can use to perform user searches in the LDAP or AD hierarchy. RFC 2254 defines the filter format. |
config-group-search-filter | (Optional.) The filter that the NetWorker Authentication Service can use to perform group searches in the LDAP or AD hierarchy. RFC 2254 defines the filter format. |
config-search-subtree | (Optional.) A yes or no value that specifies if the external authority should perform subtree searches. Default value: no |
config-user-group-attr | (Optional.) This option supports configurations that identify the group membership for a user within the properties of the user object. For example, for AD, specify the attribute memberOf. |
config-object-class | (Optional.) The object class of the external authentication authority. RFC 4512 defines the object class. Default value: objectclass. |
call "C:\Program Files\EMC NetWorker\nsr\authc-server\bin\authc_config.bat" -u administrator -p Pa$$w0rd04 -e add-config ^
-D "config-tenant-id=1" ^
-D "config-active-directory=y" ^
-D "config-name=ad" ^
-D "config-domain=emclab" ^
-D "config-server-address=ldap://winsrvr2k12.emclab.local:389/DC=emclab,DC=local" ^
-D "config-user-dn=CN=Administrator,CN=Users,DC=emclab,DC=local" ^
-D "config-user-dn-password=XXXXXXXX" ^
-D "config-user-search-path=CN=Users" ^
-D "config-user-id-attr=sAMAccountName" ^
-D "config-user-object-class=user" ^
-D "config-group-search-path=CN=NetWorker_Admins,CN=Users" ^
-D "config-group-name-attr=cn" ^
-D "config-group-object-class=group" ^
-D "config-group-member-attr=member" ^
-D "config-user-search-filter=" ^
-D "config-group-search-filter=" ^
-D "config-search-subtree=y" ^
-D "config-user-group-attr=memberOf" ^
-D "config-object-class=objectClass"
C:\Program Files\EMC NetWorker\nsr\authc-server\scripts>authc-create-ad-config.bat
Configuration ad is created successfully.
nsrlogin -t default -d emclab -u bkupadmin
130136:nsrlogin: Please enter password:
Authentication succeeded
authc_mgmt -u administrator -p nmc_admin_password -e query-ldap-groups-for-user -D query-tenant=tenant-name -D query-domain=domain_name -D user-name=ad_user_name
authc_mgmt -u Administrator -p Pa$$w0rd04 -e query-ldap-groups-for-user -D query-tenant=default -D query-domain=emclab -D user-name=bkupadmin
The query returns 1 records.
Group Name Full Dn Name
NetWorker_Admins cn=NetWorker_Admins,cn=Users,dc=emclab,dc=local