Arctera Insight Information Governance Administrator's Guide

To use domain user credentials to configure a NetApp cluster

1. Log on using SSH to the NetApp cluster with administrator credentials. Do one of the following:

   • If the NetApp cluster has a data SVM with a CIFS server that is already created, you can use that data SVM as an authentication tunnel. Use the following command:

     security login domain-tunnel create -vserver name of data SVM

     The following security command displays the specified authentication tunnel:

     login domain-tunnel show

   • If the cluster does not have a data Storage Virtual Machine (SVM) with a CIFS server created, you can use any data SVM in the cluster and join it to a domain by using the vserver active-directory create command. Set the --vserver parameter to the data SVM. Joining a data SVM to a domain does not create a CIFS server or require a CIFS license. However, it enables the authentication of users and groups at the SVM or cluster-level.

2. Grant a user or a group access to the cluster or SVM with the -authmethod parameter set to domain.

   Also, create a new role, for example testrole, using the useradmin utility on the filer.

   The following command enables <testuser> in the <DOMAIN1> domain to access the cluster through SSH:

   	cluster1::> security login create -vserver cluster1 <-user-or-group-name>
   <DOMAIN1\testuser> -application ontapi -authmethod domain  - role testrole

   Where, <cluster1> is the name of Admin Vserver.

   Note:

   For FpolicyCmod devices with ONTAP 9.6 or greater, create the following:

   cluster1::> security login create -vserver cluster1 
   <-user-or-group-name<DOMAIN1\testuser> -application 
   http -authmethod domain  - role testrole

   Note the following:

   • The value of the -user and -group-name parameter must be specified in the format domainname\username, where <domain name> is the name of the CIFS domain server and user name is the name of the user or group you want to grant access to.

   • The user group authentication supports only SSH and ONTAPI for the -application parameter.

   • If the authentication tunnel is deleted, the directory service logon sessions cannot be authenticated by the cluster, and users and groups cannot access the cluster. The open sessions that were authenticated before the deletion of the authentication tunnel remain unaffected.

3. You can also choose to assign specific capabilities to the role.

   security login role create -role testrole -cmddirname "version"-access all

   Enables you to log into the NetApp filer and run commands. With this capability, you can get latency statistics (for scan throttling), volume size information or discover shares.

   Run the following commands to create the role with specific privileges:

   Security login role create -role testrole -cmddirname "vserver fpolicy engine-connect" -access all

   Security login role create -role testrole -cmddirname "vserver fpolicy engine-disconnect" -access all

   security login role create -role testrole -cmddirname "version"-access all

   security login role create -role testrole -cmddirname "vserver cifs"-access readonly

   security login role create -role testrole -cmddirname "vserver nfs" -access all

   security login role create -role testrole -cmddirname "vserver"-access readonly

   security login role create -role testrole -cmddirname "volume"-access readonly

   security login role create -role testrole - cmddirname "vserver fpolicy policy" -access all

   security login role create -role testrole - cmddirname "vserver fpolicy" -access readonly

   security login role create -role testrole - cmddirname "vserver fpolicy enable" -access all

   security login role create -role testrole - cmddirname "vserver fpolicy disable" -access all

   security login role create -role testrole - cmddirname "statistics" -access readonly

   security login role create -role testorle -cmddirname "network interface show" -access readonly

   The network interface show privilege automatically assigns the following privileges to the role:

   • network interface create

   • network interface modify

   For NetApp ONTAP 9.14 and later, grant the following privileges to the role to support Persistent Store and Persistent Volume Creation.

   security login role create -role testrole -cmddirname "vserver 
   fpolicy persistent-store" -access all.

   security login role create -role testrole -cmddirname 
   "volume create" -access all 
   

   You can optionally specify a default role such as admin/vsadmin which already has these privileges.