Active Directory & Navisphere

Question

We are new Clariion CX4-480 users with Navisphere Manager. We would like to use Active Directory to control our storage team logins for Navisphere like we do with EMC Control Center.

Anyone have good hints for implementing AD with Navisphere? The instructions are very vague and I do not remember having to supply all the information that Navisphere is requesting when we did ECC.

Thanks for any hints.

AranH1 · Accepted Answer

Ann,I typed up some basic instructions below. See if this helps you.On the Server tab:Use the IP address of a AD Domain Controller and the port number to use for connecting to LDAP. If you are going to use Secure LDAP (LDAPS) then you will need the secure port number. We use this and I recommend it.Select the Server Type of Active Directory and LDAP or LDAPS depending on which port you used above.BindDN is the Distinguished Name of the service account used to bind to Active Directory. So if I have a user account called san in the Service Accounts OU, which is under the Servers OU which is at the root of the corp.com domain, then the DN I will use in this field is:CN=san,OU=Service Accounts,OU=servers,DC=corp,DC=comThe Bind Password is just the password of the user account above.The User Search path and Group Search Path fields are just an LDAP reference used for searching the directory for users and groups. You can be as broad or narrow in your search as you like. For our example above I would just use the broadest approach (unless you have a really large directory):DC=corp,DC=comOn the Role Mapping tab:For my environment I use AD groups to control access to Navisphere. So all users that need access to Navisphere I place in a Group called SAN Admins. For the Role Mapping select Group from the first drop down box, type the name of the group in the Name box, and select the Role you want to assign to the group. On the Advanced tab:I use the following values which I find to work well:User ID Attribute: sAMAccountNameUser Name Attribute: cnGroup Name Attribute: cnGroup Member Attribute: memberUser Object Class:Group Object Class: groupHopefully this will help you setup the connection.

Allen Ward · Answer

Sorry, the last time we looked at this it was going to be too painful to implement so we just stuck with NaviSphere authentication.

If you figure it out and find out it is easier than it looks, I'm sure I'm not the only one who would be interested in hearing about it.

Anyone else have any experience with this?

AranH1 · Answer

I didn't have any problems following the directions, but I used to design, deploy, and migrate Active Directory before getting into SAN management full time so I think I have an unfair advantage

Ann, Allen,
The trick may be in getting the correct format for the DN (Distinguished Name) used for the connection to AD. I can help you find the correct information for the connection.

Aran

bertog · Answer

Ann and Alan,I would appreciate it if you could provide some additional information about where you are stuck and where the pain points are with configuring LDAP authentication with Navisphere Manager. It would be good to understand specifically what is causing the hang up here, and more generally how the implementation process could be improved.Specifically, if in Navisphere Manager you click Help topics, and 'LDAP' are there holes in that documentation that you think need to be addressed?thank you.

AranH1 · Answer

Hi Ann,We use it in our environment. I was able to successfully setup a connection to AD and authenticate using users and groups.What part of the setup are you stuck on?Aran

bertog · Answer

Additionally,
The following White Paper may be of value to folks implementing LDAP:
"Securely Managing EMC CLARiiON Storage Systems"
available on Powerlink here:

http://powerlink.emc.com/km/live1/en_US/Offering_Technical/White_Paper/C1114_Securely_Mng_EMC_CLARiiON_Storage_Sys_WP_ldv.pdf

The paper was written for Flare Release 26, but the concepts are the same with Release 28 on the CX4-480.

zippityann · Answer

I had my active directory guy here look at the
Navisphere screen for the LDAP/AD parameters this
morning and he couldn't image why you all needed DN,
etc.

For ECC, when we set up the AD for logon, we did not
have to enter all the AD information required for
Navisphere.

bertog · Answer

Thanks Ann,Were there specific fields that you did not have information to fill in, or you just not not feel comfortable inputting the information requested?

AranH1 · Answer

I had my active directory guy here look at the
Navisphere screen for the LDAP/AD parameters this
morning and he couldn't image why you all needed DN,
etc.

For ECC, when we set up the AD for logon, we did not
have to enter all the AD information required for
Navisphere.

The he needs to go back to AD class

Those are basic LDAP connection strings. He should know what each of those are for and what to put in there.

Navisphere appears to be using native LDAP for connecting to Active Directory and authentication. ECC may not be using LDAP and may be either using a backwards compatibility authentication, which is like NT 4, or may be Active Directory aware and is sending a specifically crafted AD authentication session to AD.

AranH1 · Answer

Ann,Let me know if what I wrote up helps. I think changing the default settings on the Advanced tab (it didn't work until I changed them to the values I recommended) and getting the format of the BindDN are the biggest hurdles to getting this implemented. It has worked great for me following the steps I laid out.Aran

zippityann · Answer

We are able to logon in now with individuals AD logins in the role mapping. When we just put our AD Group SAN Team in the role mapping and remove our individual IDs we cannot get logged on. It is like the group is not being searched.

We use the group for our access to our ECC console through AD and in some tools as well and it works successfully.

Any suggestions?

AranH1 · Answer

Did you change the settings on the Advanced tab to what I recommended above? I had the same problem until I changed the attribute mapping parameters.

ECC does not use LDAP for AD authentication that I can tell. It looks like it is using the old LANMAN authentication from NT. This is still available in AD for backwards compatibility.

zippityann · Answer

Well, actually the parameters you specified are the defaults that show up when you select AD. So the answer is yes, the parameters are set up as you indicated.

AranH1 · Answer

Hmmm..... have you tried manually synchronizing the connection? And I know this sounds stupid but did you double check that the group name in the Role Mapping does not have extra spaces etc?

bertog · Answer

Is the group in the same area of the directory (unless you specified a group search path) as the user accounts? Otherwise, you might need a group search path.

CLARiiON

Active Directory & Navisphere

Was this post helpful?