PowerScale OneFS 9.8.0.0 Web Administration Guide

Identity management overview

In environments with several different types of directory services, OneFS maps the users and groups from the separate services to provide a single unified identity on a cluster and uniform access control to files and directories, regardless of the incoming protocol. This process is called identity mapping.

PowerScale clusters are frequently deployed in multiprotocol environments with multiple types of directory services, such as Active Directory and LDAP. When a user with accounts in multiple directory services logs in to a cluster, OneFS combines the user’s identities and privileges from all the directory services into a native access token.

You can configure OneFS settings to include a list of rules for access token manipulation to control user identity and privileges. For example, you can set a user mapping rule to merge an Active Directory identity and an LDAP identity into a single token that works for access to files stored over both SMB and NFS. The token can include groups from Active Directory and LDAP. The mapping rules that you create can solve identity problems by manipulating access tokens in many ways, including the following examples:

• Authenticate a user with Active Directory but give the user a UNIX identity.
• Select a primary group from competing choices in Active Directory or LDAP.
• Disallow login of users that do not exist in both Active Directory and LDAP.

For more information about identity management, see the white paper OneFS User Mapping - Mapping Identities across Authentication Providers.