Connecting an Active Directory user domain to a primary or a media server instance
Use the following procedure to connect an Active Directory (AD) user domain to a primary or a media server instance.
To connect an AD user domain
- From the Flex Appliance Console, verify that the instance is on the same network as the AD domain. If it is not, edit the settings so that the instance can reach the domain.
- Open the following ports between the instance and the remote host if they are not already open:
139
445
- Open an SSH session to the instance as the appadmin user and run the following command:
sudo realm join <domain name> -v -U <domain administrator>
Where <domain name> is the domain that you want to connect, and <domain administrator> is the username of an administrator user on that domain.
Enter the appadmin user password when prompted.
- When the following prompts appear, enter the password for the domain administrator user:
Password for Administrator:
Enter Administrator's password:
- Wait for the process to complete. The following message should appear:
Successfully enrolled machine in realm
Run the following command to confirm:
sudo realm list
- If you need to add user groups from this domain in the NetBackup web UI, you must modify the
sssd.conffile before you can add the groups. If you do not need to add user groups and plan to add each user individually, do not perform this step.To modify the
sssd.conffile:Navigate to
/etc/sssd/sssd.confon the instance and locate the following section:[domain/<domain name>]
Add the following directive to this section:
enumerate = True
Note:
If you have a large AD environment, you may need to perform additional tuning of the
sssd.conffile. Refer to the Red Hat documentation or contact Technical Support. - By default, all users on the remote user domain can log in to the instance. If you need to restrict access to specific users or groups, perform the following steps:
Navigate to
/etc/sssd/sssd.confon the instance and verify that the file includes the following line:access_provider = ad
If it does not, add it.
Add the following filter to the file:
ad_access_filter = <user list>
Where <user list> is the list of users that you want to have access, in one of the following formats:
To add user groups, replace <user list> with the following:
(memberOf=cn=<common name>,ou=<organizational unit>,dc=<domain component>)
Where everything after memberOf= specifies the group that you want to provide access to.
There may be more than one ou or dc, and you can also add multiple groups to the filter. For example:
ad_access_filter = (|(memberOf=cn=users1,ou=groups,dc=example,dc=company,dc=com) (memberOf=cn=users2,ou=admins,ou=groups,dc=example,dc=company,dc=com))
To add users, replace <user list> with the following:
(sAMAccountName=<username>)
You can also add multiple users. For example:
ad_access_filter = (|(sAMAccountName=user1) (sAMAccountName=user2))
For more information on the AD access filter, refer to the Red Hat documentation.
Run the following command:
systemctl restart sssd
- By default, AD users have super administrator privileges and full access to the instance. To remove those privileges and designate the appadmin user as the only super administrator, perform the following steps:
Navigate to
/etc/ssh/sshd_configand add the following line to the end of the file:AllowUsers appadmin
Run the following command:
systemctl restart sshd
- When the connection is complete, sign in to the instance as the appadmin user from the NetBackup web UI. Add and configure the remote users that you want to have access to the instance from the web UI. See the NetBackup Web UI Administrator's Guide for details.
Note:
The username maintenance is not supported on application instances.