NetVault 13.3.2 - Administration Guide

Integrating Active Directory with NetVault

NetVault installed on a Windows or Linux machine can communicate with Microsoft Active Directory (AD). Additionally, NetVault installed on a Linux machine can communicate with OpenLDAP Directory Services and Samba Active Directory. Integrating AD with NetVault enables role-based access control in NetVault. It lets users log in to NetVault using their AD credentials. It also lets AD users manage NetVault users.


	NOTE: NetVault Server supports Secure Light Directory Access Protocol (LDAPS) protocol for both Microsoft Active Directory (AD) and OpenLDAP Directory.


	IMPORTANT: During Active Directory integration with NetVault, the Active Directory service must always be available. Additionally, the NetVault Server should be a member of the domain.

Adding an AD group to NetVault and specifying privileges, levels of access, and notifications for the group ensures that members of the group have the corresponding access from the first time that they log on.

•

Considerations for Linux-based NetVault

•

Managing AD users

•

Managing AD groups

Considerations for Linux-based NetVault

Before you integrate Active Directory (AD) with a Linux-based installation of NetVault, consider the following conditions and prerequisites:

•

To let the Linux server communicate with AD, integrate NetVault with the domain controller using Samba Winbind or System Security Services Daemon (SSSD).

•

Host name of the Linux machine should be set to its FQDN. (For example, mymachine.mydomain.com)

•

Enable the use of fully qualified domain names on the Linux machine on which NetVault is installed. Short names are not permitted.

•

Samba Winbind: Under the [global] section, smb.conf must have the following entry:

winbind use default domain = no

•

SSSD: under the [domain/<domain name>] section, sssd.conf must have the following entry:

use_fully_qualified_names = True

•

On the Linux machine where NetVault is installed, to retrieve all domain controller groups, enable enumeration of group databases.

•

Samba Winbind: Under the [global] section, smb.conf must have the following entry:

winbind enum groups = yes

•

SSSD: Under the [domain/<domain name>], to retrieve domain controller groups and to fetch groups from child and trusted domains, respectively, the sssd.conf must have the following entries:

enumerate = True

subdomain_enumerate = all

•

While logging in or adding a domain user, using the DNS suffix with the domain name is recommended; for example, domain.local\user or username@dns.local.

•

When logging in using an Active Directory (AD) user on RHEL 8.x, add the following parameters, and then restart the SSSD service:

•

In the /etc/pam.d/passwd file, add:

auth include system-auth

account include system-auth

•

In the /etc/sssd/sssd.conf file, add:

auth_provider = ad

ad_gpo_access_control = permissive

Managing AD users

The following list identifies what various users can and cannot do within NetVault as it pertains to Active Directory (AD):

•

When an AD user logs in using an AD login, such as a domain name followed by the user name or a name that contains the @ symbol, NetVault authenticates the login against Active Directory. This behavior lets an AD user log in to NetVault even without a local NetVault account.

•

If authentication succeeds and this is the first time that the user is logging in, NetVault takes one of the following actions:

•

If a corresponding AD group exists in NetVault, NetVault adds the user and assigns the user the privileges, access levels, and notification settings that are defined for the corresponding AD group.

•

If the user does not have a NetVault account, NetVault adds the user but excludes all privileges, access levels, and notification settings. When the local NetVault Administrator logs in, the administrator can view the AD user entry and assign the applicable privileges.

•

NetVault automatically fetches the respective user details from the domain controller and stores it locally in the NetVault database. In case of secure mode, the details are fetched from domain controller and overwritten in the NetVault database on every successful login.

•

If authentication fails, NetVault displays an error message and prevents the user from logging in.

•

All NetVault administrators can view all local and AD NetVault users.

•

An AD NetVault user with administrative privileges can add authenticated AD users; a local NetVault Administrator cannot.

•

An AD NetVault user with administrative privileges can rename an existing NetVault user to an authenticated AD NetVault user; a local NetVault Administrator cannot. You must ensure that the password fields remains empty to maintain the integrity of the user’s AD password.

•

Once the AD user is added in NetVault, it cannot be renamed to any other user name.

•

No one can change an AD user’s password or set the password to use the Password never expires option.

•

A local NetVault Administrator or an AD NetVault user with administrative privileges can change user-based information that is accessed by using the Modify Details option as this information is stored in the NetVault Database. However, if the secure mode is enabled, the NetVault administrator and other users are allowed to edit or change only E-mail 2 and E-mail 3 of an AD NetVault user.


	NOTE: On Windows based NetVault Server, if the Workstation attribute is set for a user in the AD database, then NetVault fetches that information and stores it against the Workstation in the user details. If the user has multiple workstations, they display as separated by commas. If you want the AD user with the Workstation attribute set in AD to log in to the NetVault Server, then the user must specify the NetVault Server in the AD Workstations list. On Linux-based NetVault Server, the workstation field cannot be fetched, hence the user is unable to login. We recommended that workstation should not be set in AD for Linux Server.

An administrator can perform the following tasks in NetVault:

•

Adding an AD user

•

Deleting an AD user

Adding an AD user

The preferred method of adding an AD user is for the applicable user to log in and let NetVault complete the authentication process. However, if you have the applicable privileges, at a minimum, you must have the Users — Administer user accounts privilege, you can manually add the user, where it will also consider the privileges defined to selected user before renaming to AD user.

When you add an AD user to the NetVault Server, NetVault automatically fetches the respective user information from AD and populates it in the NetVault user details. However, on Linux-based NetVault Server, user details are fetched only after the first login and not if the AD user is added manually. On windows based NetVault Server, when you add users manually, the privileges defined for the AD group to which the user belongs are automatically assigned. If the user has an existing local NetVault account, the privileges defined for that account are taken into consideration by NetVault before redefining the local user as an AD user. For more information on adding, updating, and deleting user accounts, see Creating a user account, Modifying a user account, and Deleting a user account.

In the Navigation pane, click Users and Groups.

On the Manage User Accounts and User Groups page, click Add User.

Select the user on Manage User Accounts and User Groups page and click Modify Details.

Enter the AD user name in the <domain>\<name> (For example, domain\username) or <name>@<domain> (For example, username@domain.com) format, and click Apply.

请选择您的产品：

为向您提供更好的服务，请填写'Purpose of your Chat'（联系目的）：

针对您的问题建议的解决方案

NetVault 13.3.2 - Administration Guide

Integrating Active Directory with NetVault

Considerations for Linux-based NetVault

Managing AD users

Adding an AD user