I had a bit of trouble initially forcing Active Directory to work together with 3PAR Domains, since HP's documentation is somewhat lacking (and, at times, erroneous).
Here's how I managed to work around it:
Create your groups, one for each pairing of role and domain. I named them in the format of "
3PAR-<domain>-<role>". In the case of global roles, use "all" in place of the domain name, since "all" is a reserved domain for global roles.
Set the
description attribute for each group to "InServDomain=
<domain>", where
<domain> is either the name of the domain, or "all" in groups for global roles. Groups without this field set will not function.
Here are my groups:
Code: Select all
dn: CN=3PAR-all-super,OU=Groups,DC=example,DC=com
description: InServDomain=all
dn: CN=3PAR-all-edit,OU=Groups,DC=example,DC=com
description: InServDomain=all
dn: CN=3PAR-all-browse,OU=Groups,DC=example,DC=com
description: InServDomain=all
dn: CN=3PAR-domainname-edit,OU=Groups,DC=example,DC=com
description: InServDomain=domainname
dn: CN=3PAR-domainname-browse,OU=Groups,DC=example,DC=com
description: InServDomain=domainname
These are the sanitized CLI commands that I used for my configuration (change the obvious to fit your environment):
Code: Select all
setauthparam ldap-server 10.1.1.2
setauthparam ldap-server-hn ads.example.com
setauthparam kerberos-realm EXAMPLE.COM
setauthparam binding sasl
setauthparam sasl-mechanism GSSAPI
setauthparam accounts-dn ou=users,dc=example,dc=com
setauthparam account-obj user
setauthparam memberof-attr memberOf
setauthparam account-name-attr sAMAccountName
setauthparam group-obj group
setauthparam domain-name-attr description
setauthparam domain-name-prefix !InServDomain=
setauthparam super-map CN=3PAR-all-super,OU=Groups,DC=example,DC=com
setauthparam edit-map CN=3PAR-all-edit,OU=Groups,DC=example,DC=com CN=3PAR-domainname-edit,OU=Groups,DC=example,DC=com
setauthparam browse-map CN=3PAR-all-browse,OU=Groups,DC=example,DC=com CN=3PAR-domainname-browse,OU=Groups,DC=example,DC=com
Note that for each of the <role>-map commands, you need to put all of the related group DNs on the same line, not in sequential commands. If there are spaces in your DNs, be sure to escape them with a backslash.
Once you get it all set up and ready, verification should look like this:
Code: Select all
inserv cli% showauthparam
Param ------------------------Value-------------------------
kerberos-realm EXAMPLE.COM
binding sasl
sasl-mechanism GSSAPI
accounts-dn ou=users,dc=example,dc=com
account-obj user
memberof-attr memberOf
ldap-server 10.1.1.2
ldap-server-hn ads.example.com
account-name-attr sAMAccountName
group-obj group
domain-name-attr description
super-map CN=3PAR-all-super,OU=Groups,DC=example,DC=com
edit-map CN=3PAR-all-edit,OU=Groups,DC=example,DC=com
edit-map CN=3PAR-domainname-edit,OU=Groups,DC=example,DC=com
browse-map CN=3PAR-all-browse,OU=Groups,DC=example,DC=com
browse-map CN=3PAR-domainname-browse,OU=Groups,DC=example,DC=com
domain-name-prefix !InServDomain=
inserv cli% checkpassword reactor
password:
+ attempting authentication and authorization using system-local data
+ authentication denied: unknown username
+ attempting authentication and authorization using LDAP
+ using Kerberos configuration file:
[domain_realm]
ads.example.com = EXAMPLE.COM
[realms]
EXAMPLE.COM = {
kdc = ads.example.com
}
+ temporarily setting name-to-address mapping: ads.example.com -> 10.1.1.2
+ attempting to obtain credentials for "reactor@EXAMPLE.COM"
+ connecting to LDAP server using URI: ldap://ads.example.com
+ binding to user "reactor" with SASL mechanism GSSAPI
+ searching LDAP using:
search base: ou=users,dc=example,dc=com
scope: sub
filter: (&(objectClass=user)(sAMAccountName=reactor))
for attributes: memberOf
+ search result DN: CN=Reactor,OU=Users,DC=example,DC=com
+ search result: memberOf: CN=3PAR-all-super,OU=Groups,DC=example,DC=com
+ mapping rule: super mapped to by "CN=3PAR-all-super,OU=Groups,DC=example,DC=com"
+ rule match: super mapped to by "CN=3PAR-all-super,OU=Groups,DC=example,DC=com"
+ mapping rule: edit mapped to by "CN=3PAR-all-edit,OU=Groups,DC=example,DC=com"
+ mapping rule: edit mapped to by "CN=3PAR-domainname-edit,OU=Groups,DC=example,DC=com"
+ mapping rule: browse mapped to by "CN=3PAR-all-browse,OU=Groups,DC=example,DC=com"
+ mapping rule: browse mapped to by "CN=3PAR-domainname-browse,OU=Groups,DC=example,DC=com"
+ searching LDAP using:
search base: CN=3PAR-all-super,OU=Groups,DC=example,DC=com
scope: base
filter: (objectClass=group)
for attributes: description
+ search result DN: CN=3PAR-all-super,OU=Groups,DC=example,DC=com
+ search result: description: InServDomain=all
+ group "CN=3PAR-all-super,OU=Groups,DC=example,DC=com" has potential domain "all" (transformed from "InServDomain=all")
+ domain match: "all" mapped to super
user reactor is authenticated and authorized
Regards,
Aaron
)