NetWorker: How To Set up LDAP/AD using authc_config scripts

Resumen: This KB provides a basic overview for how to add LDAP/AD authentication using the authc_config script template. Microsoft Active Directory (AD) or Linux Lightweight Directory Access Protocol (LDAP) authentication can be used with NetWorker. ...

Este artículo se aplica a Este artículo no se aplica a Este artículo no está vinculado a ningún producto específico. No se identifican todas las versiones del producto en este artículo.

Consulte estos recursos

Instrucciones

NetWorker supports Microsoft Active Directory (AD) or Linux Lightweight Directory Protocol (LDAP). Both solutions use the LDAP protocol to communicate with the external authentication service. This article explains how to use the NetWorker authc_config script templates to add external authority to NetWorker. This article does not provide instructions for configuring Secure LDAP (LDAPS). Instructions for configuring LDAPS can be found in: NetWorker: How To configure LDAPS Authentication

This article can be broken down into the following sections. Carefully review each section before proceeding:

Prerequisites:

Determine which host is the authc server. This is helpful in larger NetWorker datazones. In smaller datazones with a single NetWorker server, the NetWorker server is the authentication server.

Configuring the External Authority Resource:

Create the external authority resource in the authentication service.
Determine external users or groups to be used for NetWorker.
Define which external users or groups have access to the NetWorker Management Console (NMC).
Define the NetWorker server permissions external users and groups have.
(Optional) Configure FULL_CONTROL security permissions for an external user or group.

Prerequisites:

Determine which host is the NetWorker Authentication server. This can be validated in the NetWorker Management Console (NMC) server's gstd.conf file:

Linux: /opt/lgtonmc/etc/gstd.conf
Windows: C:\Program Files\EMC NetWorker\Management\GST\etc\gstd.conf

NOTE: The gstd.conf file contains a string authsvc_hostname which defines the authentication server used to process login requests for the NetWorker Management Console (NMC).

Configuring the External Authority Resource:

The NetWorker authentication server includes authc_config script templates in the following location:

Windows: C:\Program Files\EMC NetWorker\nsr\authc-server\scripts\

Linux: /opt/nsr/authc-server/scripts/

NOTE: The paths shown assume the default NetWorker installation path is used. If NetWorker is installed in another location, modify the paths accordingly.

There are two scripts that can be used. The script used depends on the external authentication method used. Using the incorrect script can result in failures.

For Microsoft Active Directory, use authc-create-ad-config.x.template
For Linux LDAP (OpenLDAP, so forth), use authc-create-ldap-config.x.template

NOTE: The script includes .bat.template if the authentication server is Microsoft Windows, and .sh.template if Linux. Create a copy of the template file needed and remove .template from the file name. This leaves you with a .bat or .sh script to be run from the command line after populating it with the external authority details.

Example contents from authc-create-ad-config.sh.template:

authc_config -u administrator -p <password> -e add-config \
-D "config-tenant-id=<tenant_id>" \
-D "config-active-directory=y" \
-D "config-name=<authority_name>" \
-D "config-domain=<domain_name>" \
-D "config-server-address=<protocol>://<hostname_or_ip_address>:<port>/<base_dn>" \
-D "config-user-dn=<user_dn>" \
-D "config-user-dn-password=<user_password>" \
-D "config-user-search-path=<user_search_path>" \
-D "config-user-id-attr=sAMAccountName" \
-D "config-user-object-class=<user_object_class>" \
-D "config-group-search-path=<group_search_path>" \
-D "config-group-name-attr=cn" \
-D "config-group-object-class=group" \
-D "config-group-member-attr=member" \
-D "config-user-search-filter=" \
-D "config-group-search-filter=" \
-D "config-search-subtree=n" \
-D "config-user-group-attr=memberOf" \
-D "config-object-class=objectClass"

NOTE: Any value in the script inside < > must be changed. The values not inside < > can be left as is.

The following table details the parameters defined in the configuration file.

config-tenant-id	Tenants can be used in environments where more than one authentication method may be used or when multiple authorities must be configured. Creating a tenant is optional. You can use the default tenant, config-tenant-id=1. When the default tenant is used, you can log in to the NMC using "domain\user" When a tenant (other than default is used), you must specify it during authentication "tenant\domain\user"
config-active-directory	If you are using a Microsoft Active Directory (AD) server: y. This is the default setting in the authc-create-ad-config.x.template. If you are using an LDAP server (e.g: OpenLDAP): n. This is the default setting in the authc-create-ldap-config.x.template.
config-name	This name is only an identifier for the authentication configuration being added to NetWorker.
config-domain	This is the domain name that is used for logging into NetWorker, for example: networker.lan. This field should match the Domain Component (DC) values of the domain.
config-server-address	*<protocol>://<hostname_or_ip_address>:<port>/<base_dn>* Protocol: Specify ldap if non-SSL communication is used. Specify ldaps if you are configuring SSL communication. Notes: Before you configure the NetWorker Authentication Service to use LDAPS, you must store the CA certificate from the LDAPS server in the Java trust keystore. For more information about this procedure, see NetWorker: How To configure LDAPS Authentication ldap/ldaps must be lower case. Hostname/IP address: Specify the fully resolvable hostname or IP address of your AD or LDAP server. Port: If you are using LDAP, specify port 389. If you are using LDAPS, specify port 636. Base-DN: Specify your Base Distinguished Name (DN) which is consisted of your Domain Component (DC) values of your domain, for example: DC=my,DC=domain,DC=com.
config-user-dn	Specify the full Distinguished Name (DN) of a user account that has full read access to the LDAP or AD directory, for example: CN=Administrator,CN=Users,DC=my,DC=domain,DC=com.
config-user-dn-password	Specify the password for the account specified in the config-user-dn.
config-user-search-path	This field can be left blank in which case authc can query the full domain. Permissions must be granted for NMC/ NetWorker server access before these users/groups can log in the NMC and manage the NetWorker server. If a Base DN was specified in the config-server-address, specify the relative path (excluding the Base DN) to the domain.
config-user-id-attr	The user ID that is associated with the user object in the LDAP or AD hierarchy. For LDAP, this attribute is commonly uid. For AD, this attribute is commonly sAMAccountName.
config-user-object-class	The object class that identifies the users in the LDAP or AD hierarchy. For example, inetOrgPerson (LDAP) or user (AD)
config-group-search-path	Like config-user-search-path this field can be left blank in which case authc is capable of querying the full domain. If a Base DN was specified in the config-server-address, specify the relative path (excluding the Base DN) to the domain.
config-group-name-attr	The attribute that identifies the group name. For example, cn
config-group-object-class	The object class that identifies groups in the LDAP or AD hierarchy. For LDAP, use groupOfUniqueNames or groupOfNames Note: There are other group object classes aside from groupOfUniqueNames and groupOfNames. Use whatever object class is configured in the LDAP server. For AD, use group
config-group-member-attr	The group membership of the user within a group For LDAP: When the Group Object Class is groupOfNames, the attribute is commonly member. When the Group Object Class is groupOfUniqueNames, the attribute is commonly uniquemember. For AD, the value is commonly member.
config-user-search-filter	(Optional.) The filter that the NetWorker Authentication Service can use to perform user searches in the LDAP or AD hierarchy. RFC 2254 defines the filter format.
config-group-search-filter	(Optional.) The filter that the NetWorker Authentication Service can use to perform group searches in the LDAP or AD hierarchy. RFC 2254 defines the filter format.
config-search-subtree	(Optional.) A yes or no value that specifies if the external authority should perform subtree searches. Default value: no
config-user-group-attr	(Optional.) This option supports configurations that identify the group membership for a user within the properties of the user object. For example, for AD, specify the attribute memberOf.
config-object-class	(Optional.) The object class of the external authentication authority. RFC 4512 defines the object class. Default value: objectclass.

Example:

authc_config -u administrator -p 'NetWorker_Administrator_Password' -e add-config \
-D "config-tenant-id=1" \
-D "config-active-directory=y" \
-D "config-name=ad" \
-D "config-domain=networker.lan" \
-D "config-server-address=ldap://dc.networker.lan:389/DC=networker,DC=lan" \
-D "config-user-dn=CN=Administrator,CN=Users,DC=networker,DC=lan" \
-D "config-user-dn-password=XXXXXXXX" \
-D "config-user-search-path=" \
-D "config-user-id-attr=sAMAccountName" \
-D "config-user-object-class=user" \
-D "config-group-search-path=" \
-D "config-group-name-attr=cn" \
-D "config-group-object-class=group" \
-D "config-group-member-attr=member" \
-D "config-user-search-filter=" \
-D "config-group-search-filter=" \
-D "config-search-subtree=y" \
-D "config-user-group-attr=memberOf" \
-D "config-object-class=objectClass"

Once the script is populated, run it from an Administrator command prompt (Windows) or root SSH session (Linux)

[root@nsr ~]# /opt/nsr/authc-server/scripts/authc-create-ad-config.sh
Configuration ad is created successfully.

Determine external users or groups to be used for NetWorker.

After adding the external authentication resource, the Distinguished Name

This hyperlink is taking you to a website outside of Dell Technologies.

(DN) of your AD NetWorker/backup administrators group by running the following command on your NetWorker server:

Syntax:

authc_mgmt -u administrator -p 'NetWorker_Administrator_Password' -e query-ldap-groups-for-user -D query-tenant=Tenant_Name -D query-domain=Domain_Name -D user-name=AD/LDAP_Username

Example:

[root@nsr ~]#  authc_mgmt -u Administrator -p '!Password1' -e query-ldap-groups-for-user -D query-tenant=default -D query-domain=networker.lan -D user-name=bkupadmin
The query returns 1 records.
Group Name       Full Dn Name
NetWorker_Admins CN=NetWorker_Admins,OU=DELL,dc=networker,dc=lan

Collect the DN of your NetWorker/backup administrator's group.

Configuring NMC to accept external authentication:

Log in to the NMC as the default NetWorker Administrator account.
Go to Setup-->Users and Roles-->NMC Roles.
Add the group DN collected from the above step to the "External Roles" field of the appropriate roles for that AD group. Full Administrators should have "Console Application Administrator" and "Console Security Administrator" Roles. (See the NetWorker Security Configuration Guide for more information about these roles.)

Configuring the NetWorker server external user permissions:

As the default NetWorker Administrator account, connect to the NetWorker server.
Go to Server-->User Groups.
Add the group DN to the "External Roles" field of the appropriate roles for that AD group. Full Administrators should have "Application Administrators" and "Security Administrators" permissions.

Alternatively, this can be accomplished using the nsraddadmin command on the NetWorker server:

nsraddadmin -e "USER/GROUP_DN"

Example:

[root@nsr ~]#  nsraddadmin -e "CN=NetWorker_Admins,OU=DELL,dc=networker,dc=lan"
134749:nsraddadmin: 'CN=NetWorker_Admins,OU=DELL,dc=networker,dc=lan' added to the 'external roles' list of 'Security Administrators' user group.
134749:nsraddadmin: 'CN=NetWorker_Admins,OU=DELL,dc=networker,dc=lan' added to the 'external roles' list of 'Application Administrators' user group.

Access the NMC:

You should have access to the NMC and NetWorker server with the external users who have been granted permission to do so.

logging in to the NMC with an external user

Once logged in the AD/LDAP username appears in the upper right corner of the NMC:

authenticated external user shown in NMC

Extra Security Permissions

(OPTIONAL) If you want an AD/LDAP group to be able to manage External Authorities you must perform the following on the NetWorker server.

Using the AD group DN you want to grant FULL_CONTROL permission to run:

authc_config -u Administrator -p 'NetWorker_Administrator_Password' -e add-permission -D permission-name=FULL_CONTROL -D permission-group-dn="AD/LDAP_group_dn"

Example:

[root@nsr ~]# authc_config -u Administrator -p '!Password1' -e add-permission -D permission-name=FULL_CONTROL -D permission-group-dn="CN=NetWorker_Admins,OU=DELL,dc=networker,dc=lan"
Permission FULL_CONTROL is created successfully.

nve:~ # authc_config -u Administrator -p '!Password1' -e find-all-permissions
The query returns 2 records.
Permission Id Permission Name Group DN Pattern                Group DN
1             FULL_CONTROL    ^cn=Administrators,cn=Groups.*$
2             FULL_CONTROL                                    CN=NetWorker_Admins,OU=DELL,dc=networ...

Información adicional

NetWorker: How To Set up AD/LDAP Authentication
NetWorker NWUI: How to Configure AD/LDAP from the NetWorker Web User Interface

Productos afectados

NetWorker

Productos

NetWorker, NetWorker Management Console

Número del artículo: 000158322

Tipo de artículo: How To

Última modificación: 18 mar 2025

Versión: 7

Compruebe si el dispositivo está cubierto por los servicios de soporte.

NetWorker: How To Set up LDAP/AD using authc_config scripts

Resumen: This KB provides a basic overview for how to add LDAP/AD authentication using the authc_config script template. Microsoft Active Directory (AD) or Linux Lightweight Directory Access Protocol (LDAP) authentication can be used with NetWorker. ...

Instrucciones

Prerequisites:

Configuring the External Authority Resource:

Determine external users or groups to be used for NetWorker.

Configuring NMC to accept external authentication:

Configuring the NetWorker server external user permissions:

Access the NMC:

Extra Security Permissions

Información adicional

Productos afectados

Productos

Propiedades del artículo

Encuentre respuestas a sus preguntas de otros usuarios de Dell

Servicios de soporte

Propiedades del artículo

Encuentre respuestas a sus preguntas de otros usuarios de Dell

Servicios de soporte

Bienvenido

Bienvenido a Dell

NetWorker: How To Set up LDAP/AD using authc_config scripts

Resumen: This KB provides a basic overview for how to add LDAP/AD authentication using the authc_config script template. Microsoft Active Directory (AD) or Linux Lightweight Directory Access Protocol (LDAP) authentication can be used with NetWorker. ... Ver más Ver menos

Artículo detallado

Instrucciones

Información adicional

Productos afectados

Instrucciones

Prerequisites:

Configuring the External Authority Resource:

Determine external users or groups to be used for NetWorker.

Configuring NMC to accept external authentication:

Configuring the NetWorker server external user permissions:

Access the NMC:

Extra Security Permissions

Información adicional

Productos afectados

Productos

Propiedades del artículo

Encuentre respuestas a sus preguntas de otros usuarios de Dell

Servicios de soporte

Propiedades del artículo

Encuentre respuestas a sus preguntas de otros usuarios de Dell

Servicios de soporte

Resumen: This KB provides a basic overview for how to add LDAP/AD authentication using the authc_config script template. Microsoft Active Directory (AD) or Linux Lightweight Directory Access Protocol (LDAP) authentication can be used with NetWorker. ...