Storage Foundation and High Availability 8.0.2 Configuration and Upgrade Guide - Linux

To enable OpenLDAP authentication for clusters that run in secure mode

1. Run the LDAP configuration tool atldapconf using the -d option. The -d option discovers and retrieves an LDAP properties file which is a prioritized attribute list.

   # /opt/VRTSvcs/bin/vcsauth/vcsauthserver/bin/atldapconf \
   -d -s domain_controller_name_or_ipaddress -u domain_user

   Attribute list file name not provided, using AttributeList.txt

   Attribute file created.

   You can use the catatldapconf command to view the entries in the attributes file.

2. Run the LDAP configuration tool using the -c option. The -c option creates a CLI file to add the LDAP domain.

   # /opt/VRTSvcs/bin/vcsauth/vcsauthserver/bin/atldapconf \
   -c -d LDAP_domain_name

   Attribute list file not provided, using default AttributeList.txt

   CLI file name not provided, using default CLI.txt

   CLI for addldapdomain generated.

3. Run the LDAP configuration tool atldapconf using the -x option. The -x option reads the CLI file and executes the commands to add a domain to the AT.

   # /opt/VRTSvcs/bin/vcsauth/vcsauthserver/bin/atldapconf -x

   Using default broker port 14149

   CLI file not provided, using default CLI.txt

   Looking for AT installation...

   AT found installed at ./vssat

   Successfully added LDAP domain.

4. Check the AT version and list the LDAP domains to verify that the Windows Active Directory server integration is complete.

   # /opt/VRTSvcs/bin/vcsauth/vcsauthserver/bin/vssat showversion

   vssat version: 6.1.14.26

   # /opt/VRTSvcs/bin/vcsauth/vcsauthserver/bin/vssat listldapdomains

   Domain Name : mydomain.com

   Server URL : ldap://192.168.20.32:389

   SSL Enabled : No

   User Base DN : CN=people,DC=mydomain,DC=com

   User Object Class : account

   User Attribute : cn

   User GID Attribute : gidNumber

   Group Base DN : CN=group,DC=domain,DC=com

   Group Object Class : group

   Group Attribute : cn

   Group GID Attribute : cn

   Auth Type : FLAT

   Admin User :

   Admin User Password :

   Search Scope : SUB

5. Check the other domains in the cluster.

   # /opt/VRTSvcs/bin/vcsauth/vcsauthserver/bin/vssat showdomains -p vx

   The command output lists the number of domains that are found, with the domain names and domain types.

6. Generate credentials for the user.

   # unset EAT_LOG

   # /opt/VRTSvcs/bin/vcsauth/vcsauthserver/bin/vssat authenticate \
   -d ldap:LDAP_domain_name -p user_name -s user_password -b \
   localhost:14149

7. Add non-root users as applicable.

   # useradd user1

   # passwd pw1

   Changing password for "user1"

   user1's New password:

   Re-enter user1's new password:

   # su user1

   # bash

   # id

   uid=204(user1) gid=1(staff)

   # pwd

   # mkdir /home/user1

   # chown user1 /home/ user1

8. Add the non-root user to the VCS configuration.

   # haconf -makerw
   # hauser -add user1
   # haconf -dump -makero
   

9. Log in as non-root user and run VCS commands as LDAP user.

   # cd /home/user1

   # ls

   # cat .vcspwd

   101 localhost mpise LDAP_SERVER ldap

   # unset VCS_DOMAINTYPE

   # unset VCS_DOMAIN

   # /opt/VRTSvcs/bin/hasys -state

      #System        Attribute          Value

   cluster1:sysA     SysState           FAULTED

   cluster1:sysB     SysState           FAULTED

   cluster2:sysC     SysState           RUNNING

   cluster2:sysD     SysState           RUNNING