Skip to main content
Sign Out

Welcome to Dell

My Account
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Enjoy members-only rewards and discounts
  • Create and access a list of your products
  • Manage your Dell EMC sites, products, and product-level contacts using Company Administration.
Sign In Create an Account Dell Financial Services Premier Sign In Partner Program Sign In
Contact Us

Your Dell.com Carts

Dell Storage Manager 2020 R1 Administrator's Guide

PDF

Configure the Data Collector to Use a Directory Service

Configure the Data Collector to use an Active Directory or OpenLDAP directory service.

Prerequisites

  • An Active Directory or OpenLDAP directory service must be deployed in your network environment.
  • The directory service must meet specific configuration requirements.
    • Active Directory: The directory service must be configured to use Kerberos authentication.
    • OpenLDAP: The directory service must be configured to use LDAP with the StartTLS extension or LDAPS (LDAP over SSL).
  • If the directory service is OpenLDAP, the SSL certificate public key file (DER or PEM encoding) for the directory server must be exported and transferred to the server that hosts the Data Collector.
  • The Data Collector must have network connectivity to the directory service.
  • DNS SRV records must be correctly configured in your environment to allow the Data Collector to determine how to interact with the directory service. If SRV records are not defined or are improperly configured, you must configure the directory service settings manually.
  • The Data Collector requires a user that has permission to query the directory service. For Active Directory, this user must also have a User Principal Name attribute (username@example.com) on his or her entry in the directory.
  • To use Kerberos authentication, you must provide the user name and password for a directory service user who has Administrator privileges or use an existing service account.
  • If a directory service is configured and you want to reconfigure the Data Collector to use a directory service in a different domain, the directory services configuration must be disabled and applied before you continue.
  • To authenticate Active Directory users that belong to domains in a different forest, a one-way or two-way trust must be configured between the local forest and remote forest.

Steps

  1. Connect to the Data Collector.
    1. Open a web browser.
    2. Type the address of the Data Collector in the web browser using the following format:
      https://data_collector_host_name_or_IP_address:3033/
    3. Press Enter.
      The Unisphere Central login page is displayed.
    4. Type the user name and password of a Data Collector user with Administrator privileges in the User Name and Password field.
    5. Click Log In.
  2. If a Storage Center is selected from the drop-down list in Unisphere Central, click Home button(Home).
    The Unisphere CentralHome page is displayed.
  3. Click Data Collector iconData Collector.
    The Data Collector view is displayed.
  4. Click the Environment tab and then select the Directory Service subtab.
  5. Click Edit.
    The Service Settings dialog box opens.
  6. Configure LDAP settings.
    1. Select the Enabled checkbox.
    2. In the Domain field, type the name of the domain to search.
      NOTE:If the server that hosts the Data Collector belongs to a domain, the Domain field is automatically populated.
    3. In the Authentication Bind DN field, type the Distinguished Name or User Principal Name of the user that the Data Collector uses to connect to and search the LDAP server. The user name Administrator is not allowed.
      • Example Distinguished Name: CN=Firstname Lastname,CN=users,DC=corp,DC=Company,DC=COM
      • Example User Principal Name: username@example.com
    4. In the Authentication Bind Password field, type the password for the auth bind Distinguished Name.
    5. If you modified the Domain field, click Discover to locate the directory service for the specified domain.
  7. (Optional) Manually configure the directory service settings.
    1. From the Type drop-down menu, select Active Directory or OpenLDAP.
    2. In the Directory Servers field, type the fully qualified domain name (FQDN) of each directory server on a separate line.
      NOTE:To verify that the Data Collector can communicate with the specified directory server(s) using the selected protocol, click Test.
    3. In the Base DN field, type the base Distinguished Name for the LDAP server. This name is the starting point when searching for users.
    4. In the Connection Timeout field, type the maximum time (in minutes) that the Data Collector will wait while attempting to connect to an LDAP server.
  8. (Optional) Configure Kerberos authentication. To allow users to log in with the Client automatically using his or her Windows session credentials, Kerberos authentication must be configured.
    1. Select the Kerberos Enabled checkbox.
    2. In the Kerberos Domain Realm field, type the Kerberos realm to authenticate against. In Windows networks, this realm is usually the Windows domain name in uppercase characters.
    3. (OpenLDAP only) Type the host name or IP address of the Key Distribution Center (KDC) in the KDC Host Name or IP Address field.
    4. In the Data Collector Host Name field, type the fully qualified domain name (FQDN) of the server that hosts the Data Collector.
  9. (Optional — Open LDAP only) If Transport Layer Security (TLS) is enabled, upload a Certificate Authority PEM file...
    1. Browse to the location of the PEM file, select the file, and click Open. .
      The Upload TLS Certificate dialog box opens.
      NOTE:If you select the wrong PEM file, click Upload Certificate in the Upload TLS Certificate dialog box to select a new file
    2. c. Click OK to upload the certificate.
  10. (Active Directory Only) To register the Data Collector on the domain, select Register the Data Collector on the domain.
    1. Type the user name and password of a domain administrator.
      These credentials are used only to register the Data Collector and are not saved.
    2. Click OK.
  11. To use an existing service account, select Use an existing service account for joining the domain.
    1. Type the user name and password for the service account.
      NOTE:The existing service account must include a servicePrincipalName attribute with the following values in the form:

      HTTP/<host name>dc.<domain>@<realm>

      HTTP/<host name>dc.<domain>

      These values can be set using the Microsoft setspn.exe tool or the equivalent.
    2. Click OK.

Rate this content

Accurate
Useful
Easy to understand
Was this article helpful?
0/3000 characters
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please select whether the article was helpful or not.
  Comments cannot contain these special characters: <>()\