Sun ZFS Storage 7320
 
Sun Storage 7210 Unified Storage System
 
Oracle ZFS Storage ZS3-BA
 
Oracle ZFS Storage ZS5-4
 
Oracle ZFS Storage ZS3-2
 
Sun Storage 7410 Unified Storage System
 
Oracle ZFS Storage ZS3-4
 
Sun ZFS Storage 7420
 
Oracle ZFS Storage ZS5-2
 
Oracle ZFS Storage ZS4-4
 
Sun Storage 7310 Unified Storage System
 
Sun Storage 7110 Unified Storage System
 
Sun ZFS Storage 7120
 

PLA-Support>Sun Systems>DISK>ZFS Storage>SN-DK: ZS
 

Using an Active Directory Server for LDAP authentication.

In this Document

Goal

Solution

Applies to:

Goal

Authenticate users via the LDAP to an Active Directory Server.

Solution

The minimum requirements for configuring the LDAP service on the ZFSSA to authenticate users via an Active Directory Server using IDMU. 

The IDMU extensions provide the RFC 2307bis attributes required and were originally added to support authentication via the Windows NIS service.

Authentication will work for Active Directory users that have the unix attributes populated in Active Directory. 

The following article covers installing the extensions on the Active Directory Server:

http://technet.microsoft.com/en-us/library/cc737796(v=ws.10).aspx

Information required to configure the LDAP service on the appliance. 

 
  1.  proxy_dn = the distinguished name  for a user that can bind to Active Directory Server
  2.  proxy_password = The proxy user's password.
  3.  base_dn = top level of the domain
  4.  search_scope = sub - provides for recursion through the directory structure
  5.  cred_level = proxy 
  6.  auth_method = simple
  7.  use_tls = false
  8.  user_mapattr = homeDirectory=UnixHomeDirectory - required if homeDirectory isn't populated.
  9.  user_mapobjclass = posixAccount=user,shadowAccount=person - both are required
 10.  user_search = cn=Users,dc=example,dc=com - must be above all OU's that may contain user entries.
 11.  group_mapattr = 
 12.  group_mapobjclass = posixGroup=group
 13.  group_search = cn=Users,dc=example,dc=com
 
Select a server and specify connection to the standard port 389.
 
To enter user_mapobjclass from the cli quote both object mappings:  set user_mapobjclass="posixAccount=user","shadowAccount=person"

This satisfies the requirements for the simplest form of Active Directory schema and modification is required to match most installations.

Additional mappings can be added as well.

Example:

To get the given name from Active Directory to replace gecos, add another user_mappattr, user_mapattr=gecos=displayName

The effect of this mapping can be seen in the Name field for ZFSSA directory type admin users under Configuration Users:

nas:configuration users> show 
Users: 
 
NAME                     USERNAME                 UID        TYPE 
George Washington        george.washington        172912     Dir 
Jerry L. Lewis           jlewis                   172910     Dir 
John Adams               john.adams               172911     Dir 
Oracle Agent             oracle_agent             2000000001 Loc 

Without the gecos mapping the Name field will contain the value of the gecos attribute which is blank by default.

Check for relevancy - 10-May-2018

This solution has no attachment