I’m surprised that I haven’t done an article on configuring Active Directory (AD) authentication on the VNX. It’s pretty easy to do, and a good idea. Big thanks to Sean Thulin for documenting this in a clear and concise fashion, and to EMC Support‘s website for filling in some of the blanks I had (via Primus emc308583).

DNS

Firstly, you should have DNS configured on your array. This is just a basic thing that you should do. Stop making excuses.

Dsquery

For AD authentication, you need the following information:

• Domain Controller (DC) hostname;
• A basic account on AD with read permission on AD on Users and Group containers – this account is called the Bind DN; and
• Full path information for the Bind DN, the User container, and the Group container.

To obtain this, log in to a Windows computer with dsquery installed. You don’t need Domain Admin rights to get this information.

To determine the DC hostname, run set | findstr “LOGONSERVER” to return the hostname.

If there isn’t a Bind DN account created, you’ll need one. This can be a normal user account with the password preferably set to “Not Expired” to avoid issues down the track. Once the user is created anywhere in AD, use Dsquery thusly:

C:\Users\dan>dsquery user -name ldap_account

You’ll get this:

"CN=ldap_account,OU=Service Accounts,DC=domain,DC=com"

The above is fully qualified path name for the account “ldap_account,” which will be used as the Bind DN. You’ll need access to the password of this service account.

The User container is where the VNX will look for the user login be used for authentication. In this example the user name is “Storage User”.

C:\Users\dan>dsquery user -name "Storage User"
"CN=Storage User,OU=Storage Admins,OU=Administrators,DC=domain,DC=com"

The User Container path here that you need to note is: OU=Storage Admins,OU=Administrators,DC=domain,DC=com

For the group, you can do the same thing. In a number of environments, this will be the same location as the Users.

C:\Users\dan>dsquery group -name "Storage Admins"
"CN=Storage Admins,OU=Storage Admin Groups,OU=Administrators,DC=domain,DC=com"

The path name for group container is : OU=Storage Admin Groups,OU=Administrators,DC=domain,DC=com

Manage LDAP

Now you’re ready to set things up. Go to Domain -> Manage LDAP  and configure using the above collected information.

You can configure two service connections. These would usually be DCs that are at discrete data centres.

Click on Add or Modify.

Here’s what you need to fill in:

• Host Name or IP Address – Use the FQDN, it’s 2015 and DNS should work in your environment;
• Port 389 for LDAP, 636 for LDAPS – This will change depending on whether you select LDAP or LDAPS as the protocol;
• Server Type – Choose “Active Directory”;
• Domain Name – Specify the domain name;
• BindDN – This is where you put the distinguished name of the LDAP service account;
• Bind Password – The password for the LDAP service account;
• Confirm Bind Password – Confirmed;
• User Search Path – This is the info we got earlier;
• Group Search Path – Ditto; and
• Add certificate – If you’re using LDAPS, you’ll need this.

Role Mapping

Note that it is recommended to use group names with no special characters and with fewer than 32 characters. The main roles include:

• Operator – Read-only privilege for storage and domain operations; no privilege for security operations.
• Network Administrator – All operator privileges and privileges to configure DNS, IP settings, and SNMP.
• NAS Administrator – Full privileges for file operations. Operator privileges for block and security operations.
• SAN Administrator – Full privileges for block operations. Operator privileges for file and security operations.
• Storage Administrator – Full privileges for file and block operations. Operator privileges for security operations.
• Security Administrator – Full privileges for security operations including domains. Operator privileges for file and block operations.
• Administrator – Full privileges for file, block, and security operations. This role is the most privileged role.
• VM Administrator – Enables you to view and monitor basic storage components of your VNX system through vCenter by using VMware’s vSphere Storage APIs for Storage Awareness (VASA).

Note that some of these roles apply to “Unified” configs (NAS), rather than block-only.

Conclusion

Don’t forget to synchronise the information once you’ve created the connections. And that’s it. you should now be able to log in to your VNX with your AD credentials. Just make sure “Use LDAP” is ticked.