Celerra Manager with Custom Active Directory

Question

Hi of all, I'm trying to setup a custom Active Directory to use domain users in Celerra Manager. I have followed the steps in the Appendix B of EMC Celerra Security Configuration Guide with negative results. The test button in the 'Domain Settings' page works. I have created a Domain mapped group with nasdmin role. If I try to enter in the Celerra Manager with a domain user I have an 'Authentication failed' error. I see the log in /var/log/messages and I have this error check_user(pam_unix)[2316]: authentication failure; logname= uid=48 euid=0 tty= ruser= rhost= as if the system tries to find the user in local database and not in Active Directory. What's the wrong? Thanks.

abuhler · Answer

Did you ever manage to get it working. I have tried many times....with different settings......and no joy.

sebbyr · Answer

Good morning buhler4224

What have you tried? What error are you getting? It is always good to use an AD administrative account when configuring this in Celerra manager. This account should have sufficient rights to traverse the different account OUs.

- Sebby Robles

* If this post was able to help or resolve your question, please take a moment to rate it. Thank you. *

abuhler · Answer

Hi Sebby,

I have been able to configure the domain settings correctly as the test is successful, however when I try and logon using a domain mapped account, I receive the following message:-

Access Denied error (you do not have administrative privileges, please contact the system administrator)

I have tried logging on using all of the following ways without success:-

The supported domain-mapped user login formats are:

◆ \ (for example, mycompany\anne)

◆ \ (for example, mycompany.com\anne)

◆ @ (for example, anne@mycompany)

◆ @ (for example, anne@mycompany.com)

sebbyr · Answer

Did you create an AD group for Celerra administrators? This group needs to added to the CS, and any AD account you want to have log into the CS needs to be a member of this group.

Thanks.

- Sebby Robles

SAMEERK1 · Answer

Hi, Make sure that the clock of the control station matches the clock of your AD. Sameer Kulkarni

SAMEERK1 · Answer

This works for me fine and should work for all as well.

-->you have to just map the group not add the domain group

-->Be sure the clock of CS matches the Clock of AD.

1. create a group in celerra or use the existing group.

2. add the domain users to the newly created group in domain or the existing one, these users are those you want to use for CS login.

3. configure the Domain Settings in the Celerra manager(with correct credentials) and run the test..

4. map the group with the appropriate domain group name and domain name.

5. logout and login as the domain user as \ & the domain password

You should be able to login from here...

Sameer Kulkarni

SAMEERK1 · Answer

Any updates on this issue , did that work?

I would like to know if any others tried it and it didnt work for them or if worked please let us know the steps you followed to avoid the errors.

Sameer Kulkarni

abuhler · Answer

Yes, it worked perfectly. Thank You. I am now trying to get it to work with a Custom Active Directory

SAMEERK1 · Answer

I dont think there should be any issue unless you get the values right in respective fields. If any let us know. Please do rate the answer if it was helpfull for you. Sameer Kulkarni.

Celerra

Was this post helpful?