Dell NetWorker 19.9 Administration Guide

Using nsrlogin for authentication and authorization

When you configure the NetWorker Authentication Service to use LDAP/AD authentication, you modify the External Roles attribute in the User Group resource to assign privileges to LDAP and AD users. As a result, NetWorker command line operations and NetWorker module operations might fail due to insufficient privileges. To resolve this issue, use the nsrlogin command to contact the NetWorker Authentication Service and authenticate a user. When user authentication succeeds, the NetWorker Authentication Service issues a token to the NetWorker host for the user, which provides CLI operations with token-based authentication until the token expires.

1. To validate a user and generate a token for the user, use the nsrlogin command:

   nsrlogin [-s NetWorker_server] [-H authentication_host] [-P port] [-t tenant] [-d domain]
   [-p password] [-f] [-u user]

   where:

   • -s NetWorker_server—Specifies the name of the NetWorker Server. Use this option when you use the nsrlogin command on a NetWorker host that is not the NetWorker Server.
   • -H authentication_host—Specifies the name of the NetWorker Authentication Service host. Use this option when you use the nsrlogin command on a NetWorker host that is not the NetWorker Server. This option is only required when you do not use the -s option.
   • -P port—Specifies the NetWorker Authentication Service port number. Use this option when you do not use the -s option and when the NetWorker Authentication Service does not use the default port number 9090 for communications.
   • -t tenant— Specifies the tenant name that the NetWorker Authentication Service should use to verify the username and password. When you omit this option, NetWorker Authentication Service uses the Default tenant to verify the user credentials.
   • -d logindomain—Specifies the domain name that the NetWorker Authentication Service should use to verify the username and password with an external authentication authority. When you omit this option, the NetWorker Authentication Service uses the local user database to verify the user credentials.
   • -f— Allows nsrlogin to be run as a root user.
   • -u username—Specifies the username that the NetWorker Authentication Service should validate to generate a token. The user string might be a username, email address, or another string, depending on configuration of the identity provider. After successful authentication, the banner is displayed on the screen with a prompt to accept or reject the banner. If the user enters yes, the user can proceed. Otherwise, the user is logged out.
     NOTE: The banner content is empty by default. If banner content is empty, the confirmation prompt does not appear.
   • -p "password"—Specifies the password to send to the identity provider to verify the user. If this argument is not provided, nsrlogin prompts the user to specify the password. If the password contains special characters, the password must be enclosed in double quote marks (""). After successful authentication, the banner is displayed on the screen.

   For example, to generate a token for user Konstantin in the idddomain domain and the idd tenant, type the following command:

   If the /nsr/authc-server/conf/banner.txt file is empty, no banner content is displayed.

   nsrlogin -s bu-idd-nwserver2 -d idddomain -u Konstantin -p "1.Password"
   Authentication succeeded
   

   If the /nsr/authc-server/conf/banner.txt is updated with content, the banner content is displayed on successful authentication.

   nsrlogin -s bu-idd-nwserver2 -d idddomain -u Konstantin -p "1.Password"
   Authentication succeeded
   <Banner Content>
   

   Log in to the NetWorker server with username Konstantin, which is defined in the local user directory with the password 1.Password. When you enter Yes at the prompt, the banner content is accepted and you can proceed. When you enter No at the prompt, the banner content is rejected and user is logged out.

   nsrlogin -u Konstantin
   Enter the password: <password>
   Authentication succeeded
   <Banner Content>
   Do you wish to accept and continue (Yes/No)? Yes
   

   When the NetWorker Authentication Service successfully validates the user, the service issues an authentication token to the requesting host.
2. At the command prompt, type the NetWorker command.
   If the validated user does not have the appropriate privileges to run the command, an error message appears or the command does not return the expected result. For example, when you try to perform an operation with a user account that does not have the required privilege, a message similar to the following appears:

   Permission denied, user must have the 'Operate NetWorker' privilege'.