Set up LDAP

When you create user accounts, you can select whether to use external authentication and authorization servers. Use the following procedure to set up LDAP for external authentication.

Note:

If no user accounts are registered on the storage system, the user group assignment (authorization) is applied to the settings on the external authentication server.
Configure the user group for each user account on the external authentication server. During configuration, define a group on the external authentication server with the same name as the user group defined on the storage system.
If one or more user accounts are registered on the storage system, external authentication can be selected as the authentication method, but the user group assignment (authorization) is subject to the settings in the maintenance utility. It does not apply even if the user group assignment (authorization) is set on the external authentication server.

CAUTION:

If you specify the IP address of the LDAP directory server in IPv6 address format, do not use the following IP addresses:

Invalid value: [::]
Loopback address: [::1]
Multicast address: [FF00:: - FDFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF]
IPv4-mapped IPv6 address: [::FFFF:(IPv4)]
Link-local address: [FE80::xxxx:xxxx:xxxx:xxxx] (xxxx: Any value)
Global unicast address: [2001:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx] (xxxx: Any value)
Global unicast address: [2002:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx] (xxxx: Any value)

Verify that the LDAP server is connected to the management LAN.
If you have a firewall between the storage system and the LDAP server, open the port used for communication.
Make sure the LDAP server meets the following requirements:
- Authentication server protocol: LDAPv3 simple bind authentication
- Communication protocol: TLS1.2 and TLS1.3
- Certificate file type: CA (Certification Authority) root certificate
- Certificate file format: X509 DER format, X509 PEM format
- Conditions for locating a server using information registered in the SRV record of the DNS server: On the LDAP server, the DNS server configuration must be completed. LDAP directory server hostname, port number, and domain name must be registered.
Have a certificate file for the root certificate ready.
The root certificate must be configured on the storage system. For certificates, contact the administrator of the LDAP directory server.

For details and requirements of the certificate, see SSL/TLS requirements.
Gather the information required for the external authentication settings.
When you use DKCMAIN firmware version earlier than A3-04-01 and perform revocation verification using CRLs, set the CRLDP issued by the CA of the root certificate or the CRLDP issued by the intermediate CA, for the server certificate and intermediate certificate that are to be set on the LDAP server. If you set the CRLDP issued by the intermediate CA, set the intermediate CA in the root certificate file.

Note: When External User Group Mapping is disabled, even if the server configuration test is successful, user accounts cannot access the storage system unless they are registered in the storage system. To allow user accounts that are not registered in the storage system to access the storage system, enable External User Group Mapping. For details, see External User Group Mapping in the maintenance utility online help. For details about testing a server configuration, see Server Configuration Test in the maintenance utility online help.

Log in to the maintenance utility.
Select Administration > External Authentication > Set Up Server > LDAP.

In the Set Up Server (LDAP) window, enter the LDAP server settings.

If you use only the authentication server (External User Group Linkage is disabled), user accounts that are not registered in the storage system will not be able to access the server configuration even if the server configuration test succeeds.

Item	Description
Certificate File Name	To specify the certificate file for the root certificate, click Choose file and then select the certificate file.
DNS Lookup	Select the method for specifying the external authentication and authorization server: Enable: Specify an external authentication and authorization server in the SRV record of the DNS server. Disable: Specify an external authentication or authorization server by host name or IP address.
Authentication Protocol	Select the authentication protocol: STARTTLS or LDAP over SSL/TLS. If you selected Disable for DNS Lookup, select the LDAP protocol.
External User Group Mapping	To also use the LDAP directory server as an authorization server, select Enable.
Primary Server:
Host Name	If you selected Disable for DNS Lookup, enter the host name or IP address of the LDAP directory server.
Port Number	If you selected Disable for DNS Lookup, enter the port number of the LDAP directory server.
Domain Name	Enter the domain name of the LDAP directory tree.
User Name Attribute	Enter the attribute name that defines the user ID value to be used for authentication. Allowed characters: Half-width alphanumeric characters Symbols: ! # $ % & ' ( ) * + , - . / : ; < = > ? @ [\] ^ _ ' { \| } ~ For hierarchical models: Set the attribute name that contains the user-identifiable value. For flat models: Sets the attribute name of the RDN for the user entry.
Timeout	Enter the amount of time (in seconds) after which a connection timeout with the LDAP directory server is detected.
Retry Interval	Enter the retry interval (in seconds) if communication with the LDAP directory server fails.
Number of Retries	Enter the number of retries if communication with the LDAP directory server fails.
Base DN	Enter the DN from which to search for users to authenticate. Allowed characters: half-width alphanumeric characters and all symbols. For hierarchical models: Enter the DN of the hierarchy that contains all the users you want to search. For flat models: Enter the DN one level higher than the user you are searching for. To enter these symbols (`+ ; , < = >`), type a backslash (`\`) immediately before the symbol. For these symbols (`\ / "`), type a backslash (`\`) followed by the ASCII code: For `\`, type `\ 5c`. For `/`, type `\ 2f`. For `"`, type `\ 22`.
Search User's DN	Enter the DN of the search user. For the primary server, this input is required only if `sAMAccountName` is specified in User Name Attribute, or if Enable is selected for External User Group Mapping. Allowed characters: alphanumeric characters and all symbols. To enter these symbols (`+ ; , < = >`), type a backslash (`\`) immediately before the symbol. For these symbols (`\ / "`), type a backslash (`\`) followed by the ASCII code: For `\`, type `\ 5c`. For `/`, type `\ 2f`. For `"`, type `\ 22`.
Password	Enter the password for the search user. Enter the same password as the password registered with the LDAP directory server. For the primary server, this input is required only if `sAMAccountName` is specified in User Name Attribute, or if Enable is selected for External User Group Mapping. Allowed characters: Half-width alphanumeric characters Symbols: ! # $ % & ' ( ) * + - . = @ \ ^ _ \| / : ; < > ? [ ] ' { } ~ , and space
Re-enter Password	Re-enter the password.
Secondary Server	Enable: Use a secondary server. Disable: Do not use a secondary server.
Host Name	Enter the same settings as on the primary server.
Port Number	Enter the port number of the secondary server for the LDAP directory server.
Test User Name	Enter the user name to be used to test the server configuration. Allowed characters: Half-width alphanumeric characters Symbols: ! # $ % & ' ( ) * + , - . / : ; < = > ? @ [\] ^ _ ' { \| } ~
Password	Enter the password for the test user. Allowed characters: Half-width alphanumeric characters Symbols: ! # $ % & ' ( ) * + , - . / : ; < = > ? @ [\] ^ _ ' { \| } ~
Server Configuration Test	Click Check to perform a server configuration test.
Result	Displays the result of the server configuration test.

Confirm the settings, and then click Check for Server Configuration Test (last item at the bottom).
If the management port of AMC-0 and the management port of AMC-1 are connected to different network segments, you might not be able to reach the external authentication server or DNS server. In this case, log in to the maintenance utility from the other AMC, and then perform steps 2 and 3.
Confirm the test result, and then click Apply.
On the External Authentication screen, confirm that the settings are reflected.
Confirm that you can log in to VSP One Block Administrator with the username and password of the user account registered on the LDAP server.
If you have multiple user accounts for external authentication, make sure that you can log in with all user accounts that perform external authentication.
If you cannot access the storage system by using an authentication or authorization server (enable External User Group Integration), review the LDAP server settings.