Hi

That worked fine, but i was not able to logon using either Putty or the web gui when adding the ISI_PRIV_LOGIN_PAPI priviliege.

Is there a additional step when dealing with AD accounts and authentication?

ISI_PRIV_LOGIN_PAPI shouldn't be required for PuTTY login -- assuming you are connecting via SSH, that's ISI_PRIV_LOGIN_SSH. (If you are connecting via the serial console, that's ISI_PRIV_LOGIN_CONSOLE.)

There aren't really any additional steps you should be needing with AD accounts, the only real "trick" is that the "\" character and spaces in user/group names both need to be escaped in some situations. (I believe the \ character doesn't need to be escaped during login.)

You can find out what privileges the system believes a given user has by using the

# isi auth mapping token --user=DOMAIN\\username

command... that will list a number of things about a user, including the uid and SID apply to the user, the primary and supplemental groups the user belongs to, and the privileges that are granted to that user.

In your case, the next step would be to look at the token of one of the users in question and make sure it contains the privileges we think it should.

Jim

If im not mistaken it seems i need to implement some way of mapping AD users to Isilon.

I only get "failed to map user 'domain\username': Unknown active directory domain" when trying to run the token command.

You need to join the cluster to your domain if you haven't already. It's pretty straightforward from the gui. From the command line you use:

# isi auth ads create [domain] [admin username]   then it will prompt you for the password there are a ton of extra parameters that are easier to look at through the gui though.

check to make sure you're connected:

# isi auth ads list

run the commands like Jim said above:

isi auth roles create --name=ifsonly

isi auth roles modify --role=ifsonly --add-priv="ISI_ ... "  --add-group=[domain]\\"domain admins"

then you can check on anyone in the group (or just a user if you wanted to go per user bases):

isi auth mapping token --user=[domain]\\[user]

try this command as well to make sure you see your users:

#isi auth users list --domain=[domain]

if that doesn't work then you might have some AD problems.

when i connect via ssh i usually lead with the domain  for the username.. I've never tried it without:

[domain]\[user]   then the password

this works for me.

hope this helps

Finally found the issue. The option for ignoring trusted domains was enabled on the AD configuration page for some reason.

It worked perfectly after turning this off

Hi Dilbert, while you are having issues login to the cluster through CLI, is it just that the user can't login to cluster through CLI but can through GUI

I am on OneFS 7103 where AD users can login to cluster using their AD credentials but can't login through SSH trying with below mentioned formats

\\username

\username