Managing Active Directory LDAP servers
About Active Directory LDAP servers
Data ONTAP provides the ability to connect to Active Directory for LDAP lookup services.
For detailed information, see the following sections:
Using Active Directory LDAP servers
To use Active Directory for LDAP services, enter the fully qualified Active Directory domain into the Data ONTAP ldap.ADdomain option.
As Windows-to-UNIX mapping is performed using Active Directory, Data ONTAP does the following:
- Verifies that the user account exists within the Active Directory domain specified for that account
- Performs a query to the Active Directory domain specified in the ldap.ADdomain option
- Returns the UNIX user account information and verifies that the user account exists
Requirements for Active Directory LDAP servers
In order to use Active Directory as your LDAP server, you must
- Have a valid CIFS license
- Have your storage system joined to an Active Directory domain
- Have a two-way trust relationship established between your storage system's domain and your LDAP server's domain, if they are different
Configuring Data ONTAP for Active Directory LDAP lookup services
To specify Active Directory LDAP lookup services, complete the following steps:
Step
|
Action
|
|---|
|
1
|
If your UNIX user account information is in Active Directory, or if it is in a non-Active Directory LDAP server that is configured to allow anonymous user searches, go on to Step 2.
To configure Data ONTAP for simple LDAP server authentication, enter the user name and password to be used for LDAP lookups into the ldap.name and ldap.passwd options, respectively.
options ldap.name user_name
options ldap.passwd password
|
|
2
|
In the etc/nsswitch.conf file, specify ldap for the passwd entry, the group entry, or both, to designate LDAP as the lookup service to use.
|
|
3
|
If you have a custom schema, enter values for NSSMAP options, as described in the section Configuring Data ONTAP for custom LDAP schemas.
|
|
4
|
From the Data ONTAP command line, enter the following command:
options ldap.ADdomain fully_qualified_domain_name
Note
The domain you enter must either be the local domain or a domain that shares a trust relationship with the local domain. Example:
options ldap.ADdomain group.company.com
|
Monitoring Active Directory LDAP server connections
Displaying connection status for all LDAP server types
To display information about LDAP server connection status for all server types, complete the following step.
Step
|
Action
|
|---|
|
1
|
From the Data ONTAP command line, enter the following command:
netstat
Result
Both Active Directory and non-Active Directory LDAP server connection state information is shown on port 389 (or the non-default value assigned using the ldap.port option).
|
Displaying Active Directory LDAP server information
To display information about current Active Directory LDAP server connections and Active Directory LDAP server selection preferences, complete the following step.
Step
|
Action
|
|---|
|
1
|
From the Data ONTAP command line, enter the following command:
cifs domaininfo
Result
Following the list of domain controller connections and domain controller selection preferences, a list of Active Directory LDAP server connections is displayed, followed by the list of LDAP server selection preferences.
|
Troubleshooting Active Directory LDAP server connections
To log Active Directory LDAP server connection attempts, complete the following step.
Step
|
Action
|
|---|
|
1
|
From the Data ONTAP command line, enter the following command:
options cifs.trace_dc_connection
Result
Information about attempts to connect Active Directory LDAP servers are entered in the system log.
|
Active Directory LDAP server connection pooling and selection
Data ONTAP performs the following operations, to improve LDAP performance:
- Active Directory LDAP server connections are pooled on a per-domain basis.
- When no response is received from the current LDAP server, subsequent connections are made to the next best available LDAP server.
- Once every minute, Data ONTAP performs a check to see whether a better LDAP server has become available.
- Every four hours, Data ONTAP discovers the available Active Directory LDAP servers and reorders the list, sorting servers in the following order:
- Preferred servers, left in the order specified by the prefdc command.
- Favored servers, sorted by fastest response time
- Other Active Directory LDAP servers, sorted by fastest response time
Configuring Data ONTAP for non-Active Directory LDAP servers
Data ONTAP provides the ability to designate one or more LDAP servers by entering one or more IP addresses or fully qualified domain names, separated by commas, as the values for these two Data ONTAP options:
- ldap.preferred.servers
- ldap.servers
Data ONTAP connects to servers specified by these two option values and attempts to authenticate using a simple bind. Because simple binds do not provide sufficient authentication to establish a connection with Active Directory servers, do not specify Active Directory servers within these two option values.
Copyright © 1994-2005, Network Appliance, Inc. All rights
reserved.
Part No. 210-01086_B0
File: 7multi25.htm
Last updated: 08-Dec-2005 13:19:49