Post

/activedirectory/

This endpoint creates an Active Directory configuration. An Active Directory configuration specifies an external Active Directory server domain and defines the configuration of a machine account name to be added to that domain if and when the cluster is joined to the domain.

Security

HTTP

Type basic

Basic authentication using VMS user name and password

API Key: ApiToken

Header parameter nameApiToken

Send current valid API token in an Authorization header with format Api-Token .

Body parameters

object

domain_name

string Required

The fully qualified domain name (FQDN) of the Active Directory domain to join.

machine_account_name

string Required

The name for the machine object representing the VAST Cluster to be created within the OU

organizational_unit

string

A non default organizational unit (OU) in the Active Directory domain in which to create the machine object. If left empty, the machine object will be created in the default Computers OU.

smb_allowed

boolean

Indicates if the Active Directory configuration is allowed to serve as a provider for SMB attributes.

Defaultfalse

url

string

LDAP server URI in the format ://

.

can be either a DNS name or an IP address. Example: ldap://ldap.company.com

urls

Array of string

Comma separated list of URIs of LDAP servers in the format ://

. The order of listing defines the priority order. The URI with highest priority that has a good health status is used.

string

port

integer

The port of the remote LDAP server. Typical values: 389, 636.

binddn

string

The bind DN for authenticating to the LDAP domain. You can specify any user account that has read access to the domain.

bindpw

string

The password used with the Bind DN to authenticate to the LDAP server.

searchbase

string

The entry in the LDAP directory tree to use as a starting point for user queries.

group_searchbase

string

Base DN for group queries within the joined domain only. When auto discovery is enabled, group queries outside the joined domain use auto-discovered Base DNs.

netgroup_searchbase

string

Base DN for netgroup queries.

ExampleOU=netgroups,OU=system,DC=umiacs,DC=umd,DC=edu

method

string

The authentication method configured on the LDAP server for authenticating clients.

Valid values[ "ANONYMOUS", "SIMPLE", "SASL", "KRBV4", "KRBV41", "KRBV42" ]

gid_number

string

Override 'gidNumber' as the attribute of a group entry that contains the group's GID number. When binding VAST Cluster to AD, you may need to set this to 'gidnumber' (case sensitive).

uid

string

Override 'uid' as the attribute of a user entry on the LDAP server that contains the user name. When binding VAST Cluster to AD, you may need to set this to 'sAMAccountname'.

uid_number

string

Override 'uidNumber' as the attribute of a user entry on the LDAP server that contains the UID number. Often when binding VAST Cluster to Active Directory this does not need to be set.

match_user

string

The attribute to use when querying a provider for a user that matches a user that was already retrieved from another provider. A user entry that contains a matching value in this attribute will be considered the same user as the user previously retrieved.

abac_read_only_value_name

string

The attribute to use when querying a provider for a read only attribute access check

abac_read_write_value_name

string

The attribute to use when querying a provider for a read-write attribute access check

uid_member

string

Override 'memberUid' as the attribute of a group entry on the LDAP server that contains names of group members. When binding VAST Cluster to AD, you may need to set this to 'memberUID'

posix_account

string

Override 'posixAccount'as the object class that defines a user entry on the LDAP server. When binding VAST Cluster to AD, set this parameter to 'user' in order for authorization to work properly.

posix_group

string

Override 'posixGroup' as the object class that defines a group entry on the LDAP server. When binding VAST Cluster to AD, set this parameter to 'group' in order for authorization to work properly.

tls_certificate

string

TLS certificate to use for verifying the remote LDAP server's TLS certificate.

use_tls

boolean

Set to true to enable use of TLS to secure communication between VAST Cluster and the LDAP server.

reverse_lookup

boolean

resolve netgroups into hostnames

use_posix

boolean

POSIX support

query_groups_mode

string

A mode setting for how groups are queried: Set to COMPATIBLE to look up user groups using the 'memberOf' and 'memberUid' attributes. Set to RFC2307BIS_ONLY to look up user groups using only the 'memberOf' attribute. Set to RFC2307_ONLY to look up user groups using only the 'memberUid' attribute. Set to NONE not to look up user groups other than by leading GID and primary group SID.

username_property_name

string

The attribute to use for querying users in VMS user-initated user queries. Default is 'name'. Sometimes set to 'cn'

user_login_name

string

The attribute used to query Active Directory for the user login name in NFS ID mapping. Applicable only with Active Directory and NFSv4.

group_login_name

string

The attribute used to query Active Directory for the group login name in NFS ID mapping. Applicable only with Active Directory and NFSv4.

mail_property_name

string

uid_member_value_property_name

string

use_auto_discovery

boolean

When enabled, Active Directory Domain Controllers (DCs) and Active Directory domains are auto discovered. Queries extend beyond the joined domain to all domains in the forest. When disabled, queries are restricted to the joined domain and DCs must be provided in the URLs field.

use_ldaps

boolean

Use LDAPS for Auto-Discovery

is_vms_auth_provider

boolean

Enables use of the LDAP for VMS authentication. Two LDAP configurations per cluster can be used for VMS authentication: one with Active Directory and one without.

posix_attributes_source

string

Defines which domains POSIX attributes will be supported from.

Valid values[ "JOINED_DOMAIN", "ALL_DOMAINS", "SPECIFIC_DOMAINS", "GC" ]

domains_with_posix_attributes

string

Allows to enumerate specific domains for POSIX attributes in case posix_attributes_source is set to SPECIFIC_DOMAINS.

use_multi_forest

boolean

Allow access for users from trusted domains on other forests.

ntlm_enabled

boolean

Manages support of NTLM authentication method for SMB protocol.

Defaulttrue

scheduled_ma_pwd_change_enabled

boolean

Enables scheduled Machine Account password change.

ma_pwd_change_frequency

string

Machine Account password change frequency.

ma_pwd_update_time

string

Machine Account password update time.

super_admin_groups

Array of string

List of groups on the Active Directory provider. Members of these groups can log into VMS as cluster admin users.

string

monitor_action

string

The type of periodic health check that VAST Cluster performs for the Active Directory provider. PING (default, less overhead and impact on the provider) = pings the provider. BIND = binds to the provider.

Valid values[ "PING", "BIND" ]

is_abac_provider

boolean

True if the Active Directory is used for ABAC

Responses

201

Expand All

object

id

integer

guid

string

GUID

name

string

url

string

title

string

machine_account_name

string

Name of the computer object/machine account to add. Recommended to be the name of the cluster.

organizational_unit

string

Organizational Unit within Active Directory where the Cluster Machine account will be created. If left empty, it will go into default Computers OU

preferred_dc_list

object

List of Domain Controllers to prefer for authentication. DCs listed here will be queried exclusively unless they fail or do not respond. In such a case, other DCs will be consulted. Specify as a comma-separated list. Each entry can be a fully-qualified hostname or an IP address.

domain_name

string

FQDN of the domain.

enabled

boolean

enabled/disabled

state

string

Active Directory state

Valid values[ "UNKNOWN", "NOT_A_MEMBER", "JOINED", "JOINING_IN_PROGRESS", "LEAVING_IN_PROGRESS", "JOINED_FAILED", "LEAVE_FAILED" ]

smb_allowed

boolean

Indicates if the Active Directory server can service IO from SMB protocol.

Defaultfalse

ntlm_enabled

boolean

Manages support of NTLM authentication method for SMB protocol.

Defaulttrue

tenant_id

integer

ldap_id

integer

ldap

object (Ldap)

id

integer

name

string

guid

string

url

string

Comma-separated list of URIs of LDAP servers (Domain Controllers (DCs) in Active Directory), in priority order. The URI with highest priority that has a good health status is used. Specify each URI in the format SCHEME://ADDRESS. ADDRESS can be either a DNS name or an IP address. e.g. ldap://ldap.company.com, ldaps://ldaps.company.com, ldap://192.0.2.2

title

string

urls

Array of string

Comma-separated list of URIs of LDAP servers (Domain Controllers (DCs) in Active Directory), in priority order. The URI with highest priority that has a good health status is used. Specify each URI in the format SCHEME://ADDRESS. ADDRESS can be either a DNS name or an IP address. e.g. ldap://ldap.company.com, ldaps://ldaps.company.com, ldap://192.0.2.2

string

port

integer

LDAP server port. 389 (LDAP) 636 (LDAPS)

binddn

string

Distinguished name of LDAP superuser

bindpw

string

Password for the LDAP superuser

searchbase

string

The Base DN is the starting point the LDAP provider uses when searching for users and groups. If the Group Base DN is configured it will be used instead of the Base DN, for groups only

group_searchbase

string

Base DN for group queries within the joined domain only. When auto discovery is enabled, group queries outside the joined domain use auto-discovered Base DNs.

netgroup_searchbase

string

Base DN for netgroup queries.

ExampleOU=netgroups,OU=system,DC=umiacs,DC=umd,DC=edu

method

string

Bind Authentication Method

abac_read_only_value_name

string

The attribute to use when querying a provider for a read only attribute access check

abac_read_write_value_name

string

The attribute to use when querying a provider for a read write attribute access check

state

string

Valid values[ "CONNECTED", "DEGRADED", "DISCONNECTED", "FAILED", "UNKNOWN", "CONNECTING", "IN_DISCOVERY" ]

tenant_id

integer

Tenant ID

gid_number

string

uid

string

uid_number

string

match_user

string

uid_member

string

posix_account

string

posix_group

string

use_tls

boolean

configure LDAP with TLS

use_posix

boolean

POSIX support

posix_primary_provider

boolean

POSIX primary provider

reverse_lookup

boolean

Resolve LDAP netgroups into hostnames

tls_certificate

string

active_directory

string

active_directory_id

integer

query_groups_mode

string

Query group mode

username_property_name

string

Username property name

domain_name

string

FQDN of the domain.

user_login_name

string

The attribute used to query Active Directory for the user login name in NFS ID mapping. Applicable only with Active Directory and NFSv4.

group_login_name

string

The attribute used to query Active Directory for the group login name in NFS ID mapping. Applicable only with Active Directory and NFSv4.

mail_property_name

string

The attribute to use for the user's email address.

uid_member_value_property_name

string

The attribute which represents the value of the LDAP group's member property.

use_auto_discovery

boolean

When enabled, Active Directory Domain Controllers (DCs) and Active Directory domains are auto discovered. Queries extend beyond the joined domain to all domains in the forest. When disabled, queries are restricted to the joined domain and DCs must be provided in the URLs field.

use_ldaps

boolean

Use LDAPS for auto-Discovery. To activate, set use-auto-discovery to true also.

is_vms_auth_provider

boolean

Enables use of the LDAP for VMS authentication. Two LDAP configurations per cluster can be used for VMS authentication: one with Active Directory and one without.

posix_attributes_source

string

Defines which domains POSIX attributes will be supported from.

Valid values[ "JOINED_DOMAIN", "ALL_DOMAINS", "SPECIFIC_DOMAINS", "GC" ]

domains_with_posix_attributes

Array of string

Allows to enumerate specific domains for POSIX attributes in case posix_attributes_source is set to SPECIFIC_DOMAINS.

string

use_multi_forest

boolean

Allow access for users from trusted domains on other forests.

advanced_filter

string

Manual filters for the BaseDN. This is useful when accounts are distributed across OUs and the baseDN needs to be wide to include all accounts, while there are also accounts that you would like to exclude from user queries.

super_admin_groups

Array of string

List of groups on the LDAP provider. Members of these groups can log into VMS as cluster admin users.

string

monitor_action

string

The type of periodic health check that VAST Cluster performs for the LDAP provider. PING (default, less overhead and impact on the provider) = pings the provider. BIND = binds to the provider.

Valid values[ "PING", "BIND" ]

is_abac_provider

boolean

True if the LDAP provider is used for ABAC

scheduled_ma_pwd_change_enabled

boolean

Enables scheduled password change for the VAST Cluster Active Directory machine account password.

ma_pwd_change_frequency

string

Frequency for scheduled password change for the VAST Cluster Active Directory machine account password.

ma_pwd_update_time

string

Machine Account password update time.

last_ma_pwd_renewal_status

object (LastMaPwdRenewalStatus)

Last Active Directory machine account password renewal status

last_successful_change

string

Last successful change time

last_change_attempt

string

Last change time

message

string

Message

next_scheduled_change

string

Next scheduled change time

is_during_change

boolean

True if password change is in progress

monitor_action

string

The type of periodic health check that VAST Cluster performs for the Active Directory provider. PING (default, less overhead and impact on the provider) = pings the provider. BIND = binds to the provider.

Valid values[ "PING", "BIND" ]

Create Active Directory Configuration