Connecting an LDAP user domain to a primary or a media server instance
Use the following procedure to connect an LDAP user domain to a primary or a media server instance.
To connect an LDAP user domain
- From the Flex Appliance Console, verify that the instance is on the same network as the LDAP domain. If it is not, edit the settings so that the instance can reach the domain.
- Open the following port between the instance and the remote host if it is not already open:
If you want to enable SSL for the connection: port 389
If you do not want to enable SSL for the connection: port 636
- Open an SSH session to the instance as the appadmin user and run the following command to navigate to the SSSD configuration file:
sudo vi /etc/sssd/sssd.conf
. - Run the following command to copy the file and create a backup:
sudo cp /etc/sssd/sssd.conf /mnt/nbdata/sssd.conf.orig
- In the
sssd.conffile, locate and modify the following entries:ldap_uri =
Enter the LDAP server name and port. If you want to enable SSL for the connection, use port 636. If you do not want to enable SSL, use port 389.
For example: ldap_uri = ldaps://example.cohesity.com:636
ldap_search_base =
Enter the LDAP search domain.
For example: ldap_search_base = dc=example,dc=cohesity,dc=com
ldap_tls_reqcert =
If you want to enable SSL for the connection, enter hard.
If you do not want to enable SSL for the connection, enter never.
For example: ldap_tls_reqcert = hard
Note:
Other fields may also need to be modified depending on your LDAP configuration. Check the LDAP vendor documentation and follow those instructions if there are any differences.
- If you did not enable SSL, proceed to the next step.
If you enabled SSL, perform the following additional steps:
Add the following lines to the
sssd.conffile:ldap_tls_cacertdir = /mnt/nbdata/sssd/certs
ldap_tls_cacert = /mnt/nbdata/sssd/certs/<CA certificate>
Where <CA certificate> is the file name of the LDAP CA certificate.
Run the following command to create a directory for the LDAP certificates:
sudo mkdir -p /mnt/nbdata/sssd/certs
Copy all LDAP certificate files to this directory.
Run the following command to navigate to the LDAP configuration file:
sudo vi /etc/openldap/ldap.conf
Add the following entry to this file:
TLS_CACERTDIR /mnt/nbdata/sssd/certs
- By default, all users on the remote user domain can log in to the instance. If you need to restrict access to specific users or groups, perform the following steps:
Navigate to
/etc/sssd/sssd.confon the instance and verify that the file includes the following line:access_provider = ldap
If it does not, add it.
Add the following filter to the file:
ldap_access_filter = <user list>
Where <user list> is the list of users that you want to have access, in one of the following formats:
To add user groups, replace <user list> with the following:
(memberOf=cn=<common name>,ou=<organizational unit>,dc=<domain component>)
Where everything after memberOf= specifies the group that you want to provide access to.
There may be more than one ou or dc, and you can also add multiple groups to the filter. For example:
ldap_access_filter = (|(memberOf=cn=users1,ou=groups,dc=example,dc=company,dc=com) (memberOf=cn=users2,ou=admins,ou=groups,dc=example,dc=company,dc=com))
To add users, replace <user list> with the following:
(sAMAccountName=<username>)
You can also add multiple users. For example:
ldap_access_filter = (|(sAMAccountName=user1) (sAMAccountName=user2))
For more information on the LDAP access filter, refer to the Red Hat documentation.
Run the following command:
systemctl restart sssd
- By default, LDAP users have super administrator privileges and full access to the instance. To remove those privileges and designate the appadmin user as the only super administrator, perform the following steps:
Navigate to
/etc/ssh/sshd_configand add the following line to the end of the file:AllowUsers appadmin
Run the following command:
systemctl restart sshd
- When the connection is complete, sign in to the instance as the appadmin user from the NetBackup web UI. Add and configure the remote users that you want to have access to the instance from the web UI. See the NetBackup Web UI Administrator's Guide for details.
Note:
The username maintenance is not supported on application instances.