Article Number: 000158322
NetWorker: How To Set up LDAP/AD using authc_config scripts
Summary: This KB provides a basic overview for how to add LDAP/AD authentication using the authc_config script template. Active Directory (AD) or Linux LDAP authentication can be used alongside the default NetWorker Administrator account or other local NetWorker Management Console (NMC) accounts. ...
Article Content
Instructions
The following process describes how to use scripts to add AD or LDAP authentication to NetWorker. Other methods are available in the Additional Information section of this KB.
You can use the script templates that are found under the following paths on your NetWorker server:
Syntax:
Once the script is populated, you can run it from command line on the NetWorker server. After the script succeeds, you can confirm that the NetWorker server can authenticate with AD by running the following command:
You can use the script templates that are found under the following paths on your NetWorker server:
Windows: C:\Program Files\EMC NetWorker\nsr\authc-server\scripts\
Linux: /opt/nsr/authc-server/scripts/
NOTE: The ad script is used when a Windows AD controller is used for authentication, the ldap script is for linux/unix authentication. You must remove the .template from the file name before running. If these scripts do not exist, .sh (Linux) or .bat (Windows) can be created with the following information.
Syntax:
call authc_config.bat -u administrator -p <nmc_admin_password> -e add-config ^
-D "config-tenant-id=<tenant_id>" ^
-D "config-active-directory=y" ^
-D "config-name=<authority_name>" ^
-D "config-domain=<domain_name>" ^
-D "config-server-address=<protocol>://<hostname_or_ip_address>:<port>/<base_dn>" ^
-D "config-user-dn=<user_dn>" ^
-D "config-user-dn-password=<user_password>" ^
-D "config-user-search-path=<user_search_path>" ^
-D "config-user-id-attr=sAMAccountName" ^
-D "config-user-object-class=<user_object_class>" ^
-D "config-group-search-path=<group_search_path>" ^
-D "config-group-name-attr=cn" ^
-D "config-group-object-class=group" ^
-D "config-group-member-attr=member" ^
-D "config-user-search-filter=" ^
-D "config-group-search-filter=" ^
-D "config-search-subtree=n" ^
-D "config-user-group-attr=memberOf" ^
-D "config-object-class=objectClass"
NOTE: Any value in the script inside < > must be changed. The values not inside < > can be left as is.
| config-tenant-id | Tenants can be used in environments where more than one authentication method may be used and/or when multiple authorities need to be configured. You do not need to create a tenant if only one AD/LDAP server is being used; You can use the default tenant, config-tenant-id=1. It is important to note that the use of tenants alters your log-in method. When the default tenant is used, you can log in to the NMC using "domain\user" if a tenant other than the default tenant is used you must specify "tenant-name\domain\user" when logging into the NMC. |
| config-active-directory | If you are using a Microsoft Active Directory (AD) server: y If you are using an LDAP server (e.g: OpenLDAP): n Note: There are two different script templates "authc-create-ad-config" and "authc-create-ldap-config." Ensure that you are using the correct template for the authentication platform in use. |
| config-name | This name is only an identifier for the authentication configuration being added to NetWorker. |
| config-domain | This is the domain name that is used for logging into NetWorker. For example "emclab.local" can be set to "emclab". This can be set to align with how you log in to your workstations and systems integrated with AD/LDAP. |
| config-server-address | <protocol>://<hostname_or_ip_address>:<port>/<base_dn> Protocol:
Hostname/IP address:
|
| config-user-dn | Specify the full Distinguished Name  (DN) of a user account that has full read access to the LDAP or AD directory, e.g: CN=Administrator,CN=Users,DC=my,DC=domain,DC=com. |
| config-user-dn-password | Specify the password for the account specified in the config-user-dn. |
| config-user-search-path | This field can be left blank in which case authc can query the full domain. Permissions still must be granted for NMC/ NetWorker server access before these users/groups can log in the NMC and manage the NetWorker server. If a Base DN was specified in the config-server-address, specify the relative path (excluding the Base DN) to the domain. |
| config-user-id-attr | The user ID that is associated with the user object in the LDAP or AD hierarchy.
|
| config-user-object-class | The object class that identifies the users in the LDAP or AD hierarchy. For example, inetOrgPerson (LDAP) or user (AD) |
| config-group-search-path | Like config-user-search-path this field can be left blank in which case authc is capable of querying the full domain. If a Base DN was specified in the config-server-address, specify the relative path (excluding the Base DN) to the domain. |
| config-group-name-attr | The attribute that identifies the group name. For example, cn |
| config-group-object-class | The object class that identifies groups in the LDAP or AD hierarchy.
|
| config-group-member-attr | The group membership of the user within a group.
|
| config-user-search-filter | (Optional.) The filter that the NetWorker Authentication Service can use to perform user searches in the LDAP or AD hierarchy. RFC 2254 defines the filter format. |
| config-group-search-filter | (Optional.) The filter that the NetWorker Authentication Service can use to perform group searches in the LDAP or AD hierarchy. RFC 2254 defines the filter format. |
| config-search-subtree | (Optional.) A yes or no value that specifies if the external authority should perform subtree searches. Default value: no |
| config-user-group-attr | (Optional.) This option supports configurations that identify the group membership for a user within the properties of the user object. For example, for AD, specify the attribute memberOf. |
| config-object-class | (Optional.) The object class of the external authentication authority. RFC 4512 defines the object class. Default value: objectclass. |
Example:
call "C:\Program Files\EMC NetWorker\nsr\authc-server\bin\authc_config.bat" -u administrator -p Pa$$w0rd04 -e add-config ^
-D "config-tenant-id=1" ^
-D "config-active-directory=y" ^
-D "config-name=ad" ^
-D "config-domain=emclab" ^
-D "config-server-address=ldap://winsrvr2k12.emclab.local:389/DC=emclab,DC=local" ^
-D "config-user-dn=CN=Administrator,CN=Users,DC=emclab,DC=local" ^
-D "config-user-dn-password=XXXXXXXX" ^
-D "config-user-search-path=CN=Users" ^
-D "config-user-id-attr=sAMAccountName" ^
-D "config-user-object-class=user" ^
-D "config-group-search-path=CN=NetWorker_Admins,CN=Users" ^
-D "config-group-name-attr=cn" ^
-D "config-group-object-class=group" ^
-D "config-group-member-attr=member" ^
-D "config-user-search-filter=" ^
-D "config-group-search-filter=" ^
-D "config-search-subtree=y" ^
-D "config-user-group-attr=memberOf" ^
-D "config-object-class=objectClass"
Once the script is populated, you can run it from command line on the NetWorker server.
C:\Program Files\EMC NetWorker\nsr\authc-server\scripts>authc-create-ad-config.bat
Configuration ad is created successfully.
Syntax: nsrlogin -t tenant -d domain -u user
Example:
nsrlogin -t default -d emclab -u bkupadmin
130136:nsrlogin: Please enter password:
Authentication succeeded
If authentication succeeds collect the Distinguished Name
(DN) of your AD NetWorker/backup administrators group by running the following command on your NetWorker server:
(DN) of your AD NetWorker/backup administrators group by running the following command on your NetWorker server:
Syntax:
authc_mgmt -u administrator -p nmc_admin_password -e query-ldap-groups-for-user -D query-tenant=tenant-name -D query-domain=domain_name -D user-name=ad_user_name
Example:
authc_mgmt -u Administrator -p Pa$$w0rd04 -e query-ldap-groups-for-user -D query-tenant=default -D query-domain=emclab -D user-name=bkupadmin
The query returns 1 records.
Group Name Full Dn Name
NetWorker_Admins cn=NetWorker_Admins,cn=Users,dc=emclab,dc=local
Collect the DN of your NetWorker/backup administrator's group.
Log in to the NMC as the default NetWorker Administrator account. Under Setup-->Users and Roles-->NMC Roles, add the group DN collected from the above step to the "External Roles" field of the appropriate roles for that AD group. Full Administrators should have "Console Application Administrator" and "Console Security Administrator" Roles. (See the NetWorker Security Configuration Guide for more information about these roles.)
Log in to the NMC as the default NetWorker Administrator account. Under Setup-->Users and Roles-->NMC Roles, add the group DN collected from the above step to the "External Roles" field of the appropriate roles for that AD group. Full Administrators should have "Console Application Administrator" and "Console Security Administrator" Roles. (See the NetWorker Security Configuration Guide for more information about these roles.)
This makes it so that your AD users can log in to and manage the NMC console; however, you will must provide permissions to these users on the NetWorker server. As the default NetWorker Administrator account connect to the NetWorker server. Under Server-->User Groups, add the group DN to the "External Roles" field of the appropriate roles for that AD group. Full Administrators should have "Application Administrators" and "Security Administrators" permissions.
After the AD group DNs have been added to the External Roles fields on both the NMC and NetWorker server, attempt to log in to the NMC using your AD account.
Once logged in the AD/LDAP username appears in the upper right corner of the NMC:
Additional Information
Article Properties
Affected Product
NetWorker
Product
NetWorker, NetWorker Management Console
Last Published Date
10 Oct 2023
Version
6
Article Type
How To