Veritas NetBackup™ Flex Scale Administrator's Guide
- Product overview
- Viewing information about the NetBackup Flex Scale cluster environment
- NetBackup Flex Scale infrastructure management
- User management
- Considerations for managing NetBackup Flex Scale users
- Adding users
- Changing user password
- Removing users
- Considerations for configuring AD/LDAP
- Configuring AD server for Universal shares and Instant Access
- Configuring AD/LDAP servers for NetBackup services
- Configuring additional AD/LDAP servers for managing NetBackup services/Universal Shares/Instant Access
- Configuring AD/LDAP servers on clusters deployed with only media servers
- Directory services and certificate management
- Region settings management
- About NetBackup Flex Scale storage
- About Universal Shares
- Node and disk management
- License management
- User management
- NetBackup Flex Scale network management
- About network management
- Modifying DNS settings
- About bonding Ethernet interfaces
- Bonding operations
- Configuring NetBackup Flex Scale in a non-DNS environment
- Data network configurations
- NetBackup Flex Scale infrastructure monitoring
- Resiliency in NetBackup Flex Scale
- EMS server configuration
- Site-based disaster recovery in NetBackup Flex Scale
- About site-based disaster recovery in NetBackup Flex Scale
- Configuring disaster recovery using GUI
- Clearing the host cache
- Managing disaster recovery using GUI
- Performing disaster recovery using RESTful APIs
- Active-Active disaster recovery configuration
- NetBackup optimized duplication using Storage Lifecycle Policies
- NetBackup Flex Scale security
- Troubleshooting
- Services management
- Collecting logs for cluster nodes
- Checking and repairing storage
- Troubleshooting NetBackup Flex Scale issues
- If cluster configuration fails (for example because an IP address that was already in use is specified) and you try to reconfigure the cluster, the UI displays an error but the configuration process continues to run
- Validation error while adding VMware credentials to NetBackup
- NetBackup Web UI incorrectly displays some NetBackup Flex Scale processes as failed
- Unable to create BMR Shared Resource Tree (SRT) on NetBackup Flex Scale Appliance
- NetBackup configuration files are not persistent across operations that require restarting the system
- Appendix A. Configuring NetBackup optimized duplication
- Appendix B. Disaster recovery terminologies
- Appendix C. Configuring Auto Image Replication
Directory services and certificate management
The Lightweight Directory Access Protocol (LDAP) is the protocol used to communicate with LDAP servers. LDAP can be used as a directory service for user management. The LDAP server that is present outside the NetBackup Flex Scale cluster is responsible for authentication of users. For sites that use an LDAP server for access or authentication, NetBackup Flex Scale provides a simple LDAP client configuration interface. The NetBackup Flex Scale cluster acts as an LDAP client talking to the LDAP server.
Active Directory (AD) is a technology created by Microsoft that provides a variety of network services including LDAP directory services, Kerberos-based authentication, Domain Name System (DNS) naming, secure access to resources, and more.
You can configure AD/LDAP using the NetBackup Flex Scale GUI.
You can configure or add only one AD/LDAP server at a time. But you can add multiple AD/LDAP servers to the NetBackup Flex Scalecluster.
You can delete an existing AD/LDAP configuration.
You cannot modify an existing AD/LDAP configuration. To modify any aspect of the AD/LDAP configuration, you have to delete the existing configuration and add it back with the updated parameters.
When you configure LDAP from the GUI, the domain ID is added as LDAP_Server_FQDN/IP. So, if you add LDAP user from the NetBackup GUI, you have to add the domain name as <user_name>@LDAP_Server_FQDN/IP.
If you have upgraded to NetBackup Flex Scale 3.0 from an earlier version in which the cluster was deployed with both primary server and media servers, the AD/LDAP servers which were already configured in the previous version will have the same name. For AD/LDAP servers which are newly configured on the upgraded cluster can have one of the following domain names:
<user name>@AD/LDAP server IP/FQDN
<user name>@10.221.xx.xx
<user name>@fqdn.domain
When an AD/LDAP domain is configured using an SSL connection, you must provide the SSL certificate while adding the domain. The server's name used while adding the domain must exactly match with the server CN used for generating the certificate. If you used an FQDN to generate the certificate in a non-DNS environment, then you have to add the IP to FQDN mapping using the option in the Appliance UI. See Considerations for configuring AD/LDAP.
To configure AD/LDAP
- Navigate to Settings > Directory Services and click Configure.
- Enter the inputs required.
LDAP server address
IP address or FQDN of the AD/LDAP server
Port
Port number on which the AD/LDAP server is listening.
If AD/LDAP is configured without SSL certificate, then port number should be 389.
If AD/LDAP is configured with SSL certificate, then port number should be 636.
Directory type
Specify the directory type. It can be Open LDAP or Active Directory (when using Microsoft Active Directory)
User Base DN
Base DN subtree that is used when searching for user entries on the AD/LDAP server.
Group Base DN
Base DN subtree that is used when searching for group entries on the AD/LDAP server.
Bind DN/LDAP administrator
Distinguished name of theAD/ LDAP user who can search the AD/LDAP directory. Typically, it is the user name of the AD/LDAP server administrator.
Bind DN/LDAP password
Password for the given AD/LDAP administrator user
Encryption type
Specify the encryption type as secure or non-secure.
In secure method, SSL/TLS is the encryption method.
If you choose the Encryption type to be SSL/TLS, you have to upload the certificate that you want to use to encrypt and secure the connection with the AD/LDAP server. Click Choose file and upload the certificate.
- Click Configure.
- You can test the connection after you configure it. Click Test connection. You receive notifications after the successful completion/failure of the test connection.
The AD/LDAP details appear in the tab.
You can perform a test connection to validate the AD/LDAP configuration. On the same page, there is an option to remove the AD configuration.
