Documentation Index

Fetch the complete documentation index at: https://kb.vastdata.com/llms.txt

Use this file to discover all available pages before exploring further.

Active Directory

  • Updated on Aug 7, 2026
  • Published on Aug 5, 2026
  • 19 minute(s) read
Prev Next

Active Directory Overview

VAST Cluster enables you to use Active Directory as an authentication provider and as an LDAP-based authorization provider.

To use Active Directory as an authentication provider, create an Active Directory configuration and then join the cluster to the configured Active Directory domain. Joining Active Directory is required for clients to access the cluster's storage using the SMB protocol and can be used to enable access to the cluster's storage using the NFSv4 protocol with Kerberos authentication and/or ID mapping.

To use Active Directory as an authorization provider, such as for NFSv3 access or for NFSv4 access without Kerberos authentication and without ID mapping, you can create an Active Directory configuration and you do not need to join the cluster to the Active Directory domain.

Note

You can create multiple Active Directory configurations. Note that VAST Cluster does not allow adding two different Active Directory configuration records that have:

  • The same domain name but different settings for multi-forest authentication.

  • The same domain name and the same machine account name.

Note

Views exposed as SMB shares work only if the cluster is joined to Active Directory. This includes both SMB-only and multiprotocol views.

Note

The Active Directory configuration procedure is also used where you intend to use Active Directory as an LDAP server without the need to join an Active Directory domain.

Prerequisites for Joining Active Directory

  • Active Directory running on Windows Server 2008R2 or newer.

  • A domain name served by Active Directory, and a DNS setup to resolve the domain name.

  • User credentials for an admin user with permission to create and modify machine accounts within the Organizational Unit (OU) in the Active Directory domain to which you want to add the new machine object for the cluster.

Active Directory Domain Auto-Discovery

VAST Cluster supports client user access from multiple automatically discovered Active Directory domains, with automatic discovery of domain controllers (DCs).

VAST Cluster automatically discovers all domains and domain controllers that reside in the Active Directory forest of the cluster's joined domain and are trusted by the joined domain. If multi-forest authentication is enabled, it also discovers domains in other forests that have a two-way transitive trust relationship with the cluster's forest. When the cluster queries Active Directory for users and groups, all discovered domains are queried. After initial discovery is complete, you can view discovered Active Directory objects, including Active Directory global catalog servers. The information is updated periodically, with indication of the time to the next refresh of the global catalog that is currently used by the cluster.

You can choose whether to use LDAPS for Active Directory domain auto-discovery. If set to use LDAPS, VAST Cluster connects to port 636 for the domain controller or port 3269 for the global catalog and initiates a TLS handshake immediately afterwards.

Active Directory Multi-Forest Authentication

VAST Cluster can authorize client access by querying users and groups from one or more trusted domains across multiple forests, in addition to the forest of the cluster's joined domain. When multi-forest authentication is enabled, VAST Cluster automatically discovers all domains in the forest of the cluster's joined domain, and also all domains in forests that have a two-way transitive trust relationship with the cluster's forest.

Note

If your environment includes one-way trust domains, consider using SMB native authentication for SMB users.

When multi-forest authentication is enabled, VAST Cluster uses a user account in the cluster's joined domain to establish an LDAP bind as follows:  

  • For the LDAP bind to domain controllers in the forest of the cluster's joined domain, the authentication method (Simple or SASL) is determined by the Authentication method option in VAST Cluster LDAP settings.

  • For the LDAP bind to domain controllers in other trusted forests, SASL authentication is used, regardless of the Authentication method option in VAST Cluster LDAP settings.

    SASL authentication requires that the bind DN is specified in username@domain or DOMAIN\username format.

The requirements for multi-forest authentication are as follows:

  • Active Directory and DNS configuration:

    • Each domain name is unique across all forests where VAST Cluster runs the discovery.

    • There are no duplicate UIDs or GIDs defined on the provider that is selected as the POSIX attribute source for the VAST cluster.

    • A user account is configured in the joined domain that will be used to establish LDAP binds across the forests, with the bind DN specified in username@domain or DOMAIN\username format.

    • There is a single DNS setup that can be used to reach all domains in all trusted forests.

To enable or disable multi-forest authentication for a new Active Directory configuration:

  • In VAST Web UI, when you create a new Active Directory configuration record (User Management -> VAST Providers -> click Add New Provider and select Active Directory), in the Advanced tab, toggle Enable trusted domains on other forests on or off.

  • In VAST CLI, use the activedirectory create command with the --enable-multi-forest or --disable-multi-forest option specified. .

To enable or disable multi-forest authentication for an existing Active Directory configuration:

  • In VAST Web UI, go to User Management -> VAST Providers -> Active Directory, right-click the Active Directory configuration record, select Edit and in the Advanced tab, toggle Enable trusted domains on other forests on or off.

  • In VAST CLI, run the activedirectory modify command with the --enable-multi-forest or --disable-multi-forest option specified.

Creating Active Directory Configuration in VAST Web UI

VAST Cluster Active Directory configuration includes settings pertaining to Active Directory and settings for the underlying LDAP setup.

You can create multiple Active Directory configurations. Note that VAST Cluster does not allow adding two different Active Directory configuration records that have:

  • The same domain name but different settings for multi-forest authentication.

  • The same domain name and the same machine account name.

To create an Active Directory configuration on VAST Cluster:

  1. From the left navigation menu, select User Management and then VAST Providers.

  2. Click Add New Provider and then select Active Directory to create a new Active Directory configuration record.

  3. In the General tab, fill in the fields to create the machine account on the Active Directory domain:

    Domain name (required)

    The fully qualified domain name (FQDN) of the Active Directory domain to join.

    Example: company-ad.com

    Machine account name (required)

    Specify a name for the machine object that will be created for the cluster within Active Directory, inside the Organizational Unit (see next). It is recommended that you name the machine account name the same as the cluster name, for simplicity.

    Organizational unit (required)

    The organizational unit (OU) in the Active Directory domain in which to create the machine object.

    Specify as a Distinguished Name (DN).

    For example: OU=Computers,DC=company-ad,DC=com

    Port (required)

    The port to append to the URI.

    Recommended values: 389 for LDAP (with or without TLS), 636 for LDAPS.

    Note

    Setting non-recommended values may cause LDAP connectivity issues. 

    Bind DN (required if Authentication method is set to Simple or SASL)

    Enter the bind DN for authenticating to the LDAP domain. You can specify any user account that has read access to the domain.

    Format is as described for Search base beginning with a cn attribute component specifying the user object.

    For example, cn=admin,ou=users,dc=mydomain,dc=local specifies user 'admin' located in the 'users' container under the domain 'mydomain.local'.

    Bind password (required if Authentication method is set to Simple or SASL)

    This field appears if Simple is selected in the Authentication method field under Advanced Settings. This is the password used with the Bind DN to authenticate to the Active Directory domain controller.

  4. In the Attribute mapping tab, verify that the default attribute names match the actual names used by your Active Directory provider. If needed, select Customize and edit the names:

    Field

    Description

    Default (RFC2307BIS)

    GID Number

    The attribute of a group entry that contains the GID number of a group.

    gidNumber

    UID

    The attribute of a user entry that contains the user name.

    sAMAccountName (common, use unless you know otherwise). Also can be uid (rare) or cn (rare).

    Group login name

    The attribute used to query Active Directory for the group login name.

    sAMAccountName (common, use unless you know otherwise). Also can be uid (rare) or cn (rare).

    Mail

    The attribute to use for the user's email address.

    mail

    UID number

    The attribute of a user entry that contains the UID number.

    uidNumber

    Member UID

    The attribute of the group entry that contains names of group members.

    member

    POSIX account

    The object class that defines a user entry.

    user

    POSIX group

    The object class that defines a group entry.

    group

    Match user

    The attribute to use when querying a provider for a user that matches a user that was already retrieved from another provider. A user entry that contains a matching value in this attribute will be considered the same user as the user previously retrieved.

    sAMAccountName

    Username

    The attribute to use when querying a provider for a user when the query is initiated by a VMS user. 

    name

    User login name

    Applicable only with NFSv4 with client-enabled ID matching. This field specifies the attribute used to query Active Directory for the user login name for NFSv4 ID mapping. 

    On NDU, this value is set to sAMAccountname for Active Directory configurations. 

    sAMAccountName

    UID member value

    Specifies the attribute which represents the value of the group's member property.

    sAMAccountName

    ABAC read only

    Sets the ABAC attribute value that grants read-only access to a view tagged with this ABAC attribute.

    ro

    ABAC read-write

    Sets the ABAC attribute value that grants read/write access to a view tagged with this ABAC attribute.

    rw

  5. In the Encryption tab, set or modify the following settings as needed:

    None, StartTLS and LDAPS 

    Determines whether to use encryption to secure communication between VAST Clusterand the LDAP server. Choose between:

    • None. No encryption.

    • StartTLS. VAST Cluster connects to the standard port (port 389 for the domain controller, port 3268 for the Global Catalog) and performs a StartTLS operation as defined in RFC 4513.

    • LDAPS. VAST Cluster connects to port 636 for the domain controller or port 3269 for the global catalog and initiates a TLS handshake immediately afterwards.

    Upload TLS certificate

    If you selected StartTLS, use this field to upload a certificate if you want the cluster to verify the LDAP server's TLS certificate. The remote LDAP server's TLS certificate will be verified against the certificate you provide. If the certificate you provide does not list the certificate authority (CA) of the server's certificate, the cluster will fail to establish a connection with the LDAP server.

    If you choose to leave this field blank, the VAST Cluster's TLS client will not request the LDAP server's TLS certificate and will ignore any certificate received.

    Important

    Regardless of this field's value, ensure that the LDAP server is not configured to request client certificates (TLSVerifyClient should be set to never). Otherwise, connections will fail.

  6. In the Password Renewal tab, optionally toggle Enable password renewal on to have the cluster's machine account's password renewed at a certain interval.

    If you enable password renewal, complete the following fields:

    Number of days for password renewal

    Enter the interval for password renewal as a number of days.

    Define when the password update should happen

    Enter the time of day, per UTC time zone, at which the password should be renewed in the format HH:mm where HH is a number of hours and mm is a number of minutes.

  7. In the Advanced tab, complete the fields:

    Enable trusted domains on other forests

    Allows access for principals from trusted domains on other forests. 

    When enabled, VAST Cluster automatically discovers all domains in other trusted forests, in addition to domains in the forest of the cluster's joined domain. For more information, see Multi-Forest Authentication.

    Enable Allow-list of DCs for LDAP Queries

    If enabled, LDAP queries are directed to DCs in a specified list, and not to any other DCs.

    If enabled, create an allow list by entering these settings for each DC:

    • Domain Controller type. Select DC or GC.

    • Domain name. The name of the domain.

    • Host name/IP address (IPv6). The DNS host name, or IP address of the DC.

    Click Add to List to add each entry to the list, up to 10 entries.

    Cluster admin groups

    Specify names of groups on the provider to grant cluster admin manager access to VMS to group members. Users in these groups can log into VMS. To grant permissions to these users, add the group name to roles. By default, they are assigned a read-only role.

    NTLM enabled

    If enabled (default), SMB clients accessing the cluster are allowed to use NTLM authentication to get authenticated via this Active Directory provider. 

    If disabled, NTLM authentication is prohibited, and SMB clients are expected to use Kerberos authentication, which requires an SPN to be configured for each virtual IP pool.

    Note

    NTLM authentication is not FIPS-compliant.

    You cannot alter this setting while the cluster is joined to the Active Directory domain. To alter it for an existing Active Directory configuration, first leave the domain, then enable or disable the setting as appropriate, and then rejoin the domain.

    VMS authentication provider

    When enabled, this LDAP configuration is the one that can be used for authentication of VMS users. Only one LDAP server can be used for VMS authentication. 

    Netgroup DNS operation mode

    Determines whether DNS reverse lookup is used for the translation of a client IP address to a host name:

    • Normal (default): The server queries DNS for each host name found in the netgroup entries.

    • Reverse lookup: The server compares the host name to host names in netgroup entries.

    Authentication method (required)

    The LDAP authentication method that the Active Directory domain controller uses to authenticate clients:

    • Anonymous. The Active Directory domain controller accepts queries without any authentication.

    • Simple. The Active Directory domain controller attempts to bind a specified user name to a matching Active Directory user. If the LDAP bind succeeds, VAST Cluster is allowed access to perform the query. Set also Bind DN and Bind password.

    • SASL. The LDAP server performs the Simple Authentication and Security Layer (SASL) authentication process. If the SASL bind succeeds, VAST Cluster is allowed to perform the query. If this method is specified, you have to set Bind DN and Bind password. 

    Query group mode

    Sets the mode for querying a users' auxiliary group memberships, where applicable:

    Note

    Group memberships may or may not be queried during access checks depending on the Group Membership Source setting in the View Policy.

    • Compatible (default). Groups are queried using an aggregate of the RFC2307BIS and RFC2307 compliant group membership queries (see the other options). You can use this default option unless you are using an authentication provider which is incompatible with this aggregated query mode. 

    • RFC2307BIS only. Auxiliary group memberships are queried according to the RFC2307BIS standard, in which the group has a member attribute that contains the Distinguished Name (DN) of the member user and the user has a memberOf attribute which contains the DNs of the groups to which the user belongs. This standard is used by Active Directory and may be used with other LDAP-based authorization providers with LDAP schema extensions. 

    • RFC2307 only. Auxiliary group memberships are queried according to the RFC2307 standard, in which the group object has a memberUid attribute for each user object that is a member of the group, specifying the name of the user object. This standard may be used by openLDAP, freeIPA and other LDAP-based authorization providers.

    • None. If this option is selected, auxiliary group memberships are not queried at all. In the event that the relevant view's view policy cites the authorization provider as the group membership source and the user tries to access a file or directory within that view to which the user only has permission as a member of a the owning user's group, permission will not be granted.

    Filters

    Optionally, specify a search filter string to be to be appended to the search base DN in all user queries that VAST Cluster makes to this provider. Entries that do not match the filter string are filtered out from the query results.

    POSIX attributes source

    Determines domains from which VAST Cluster queries POSIX attributes. Options include:

    • Joined domain. The domain which the cluster has joined.

    • All domains in the joined forest. All domains in the Active Directory forest of the joined domain and, if multi-forest authentication is enabled, from other trusted forests.

    • Specific domains. One or more domains specified in Domains with posix attributes.

    • Global catalog. All domains included in the Active Directory global catalog of the cluster's joined domain forest. When this option is chosen, the global catalog must be configured with POSIX attributes.

    Domains with POSIX attributes

    If you set POSIX attributes source to Specific domains, use this option to list the specific domains. The listed domains can be in the forest of the cluster's joined domain, and also in other trusted forests which have a two-way trust with the cluster's forest.

    Periodic health check type

    Determine the type of periodic health check that VAST Cluster performs for an Active Directory provider configured for the cluster:

    • Ping check (default): Ping the provider. This option creates less overhead and reduces impact on the provider.

    • Bind check: Bind to the provider.

  8. Click Create.

    The record is created and you can see it displayed. The Joined State shows Not a member because the cluster has not yet joined the Active Directory domain.

Joining Active Directory from the VAST Web UI

  1. From the left navigation menu, choose User Management -> Active Directory.

  2. Right-click the Active Directory configuration that specifies the domain you want to join, and choose Join.

  3. Enter a user name and password for an admin user with permission to join the Active Directory domain. (These credentials are used only for a one time connection and not stored on the cluster.).

  4. Click Join. This may take a few moments. When the cluster has joined the Active Directory domain, the status displayed in the Joined State column changes to Joined.

Creating Active Directory Configuration and Joining Active Directory in VAST CLI

Creating the Active Directory Configuration

To create the Active Directory configuration, use the activedirectory create command. For example:

vcli: admin> activedirectory create --machine-account-name co-vcluster --port 389 --binddn cn=admin,ou=users,dc=mycompanyad,dc=com --bindpw **** --method simple --use-tls --domain-name co-ad.com

An Active Directory configuration record is created.

When this step is completed well, no computer account is created in Active Directory. The next step (join operation) creates a new computer account in the Active Directory.

Joining Active Directory

  1. After creating the Active Directory configuration, run activedirectory list to get the ID of the Active Directory configuration record. In this example, the ID is 3.

  2. Run activedirectory modify with the Active Directory configuration record ID specified on the --id parameter. Add the --join option to join the Active Directory domain. Specify --admin-username and provide a user name of an Active Directory admin user with permission to join the Active Directory domain:

    vcli admin> activedirectory modify --id 3 --join --admin-username USER

  3. Confirm that you wish to proceed:

    Are you sure you want to modify the Active directory? [y/N] y

  4. Enter the password for the Active Directory admin user when prompted:

    Enter admin password:
Password:

Waiting ...

[2022-03-31 10:18:39] waiting for active directory My_AD enabled state to change to True ... /

Completed
vcli: admin>

  5. Run  activedirectory list again and verify that the Active Directory configuration state is now JOINED.

Managing Active Directory Configuration in VAST Web UI

To manage an existing Active Directory configuration in VAST Web UI:

  1. From the left navigation menu, select User Management and then Active Directory.

  2. In the Active Directory page, right-click an existing Active Directory configuration and choose one of the following actions:

    Action

    Description

    SMB allow

    Allows VAST Cluster to use this Active Directory provider to authenticate and authorize clients accessing the cluster via the SMB storage protocol.

    SMB disallow

    Prohibits use of this Active Directory provider for SMB client access.

    NTLM enable

    Allows use of NTLM authentication for SMB clients to get authenticated via this Active Directory provider.

    Tip

    Before enabling NTLM, leave the cluster's joined Active Directory domain. After NTLM is enabled, rejoin the domain.

    NTLM disable

    Prohibits use of NTLM authentication for SMB clients to get authenticated via this Active Directory provider.

    Tip

    Before disabling NTLM, leave the cluster's joined Active Directory domain. After NTLM is disabled, rejoin the domain.

    Join

    Click to let VAST Cluster join the Active Directory domain specified in the configuration record.

    Leave

    Click to let VAST Cluster leave the Active Directory domain to which it has joined.

    Show -> Domains

    Displays each of the discovered Active Directory domains with indication of the domain's fully qualified domain name (FQDN), search base DN, and security identifier (SID). For more information, see Viewing Discovered Domains.

    Show -> Joined Domain DCs

    Displays all DCs from all domains in the discovered forest of the cluster's joined domain. For each DC, it shows its URI, status (such as HEALTHY or FAILED), and whether it is on the same Active Directory site as the cluster. For more information, see Viewing Discovered DCs of the Joined Domain.

    Show -> Global Catalog

    The display shows the URI of the Active Directory global catalog (GC) server that is currently used by the cluster and the time to the next global catalog refresh (in seconds). Following is a list of other discovered GC servers. For more information, see Viewing Discovered Global Catalog Servers.

    View

    Displays the Active Directory configuration.

    Edit

    Opens the Active Directory configuration for editing.

    Delete

    Deletes the Active Directory configuration from the VAST cluster.

Viewing Discovered Active Directory Topology

When Active Directory domain auto-discovery is enabled, you can view the discovered Active Directory topology as follows:

Viewing Discovered Domains

To view automatically discovered Active Directory domains:

  • In VAST Web UI: In the Active Directory page, right-click the Active Directory configuration and select Show -> Domains.

  • In VAST CLI: Run the activedirectory show_ad_domains command.

The display lists each of the discovered Active Directory domains in the cluster's joined domain forest with indication of the domain's fully qualified domain name (FQDN), search base DN, and security identifier (SID).

If multi-forest authentication is enabled, the display also includes domains from other trusted forests.

Note

When Active Directory domain auto-discovery is disabled or Active Directory information is not available, a No data to show or similar error message is displayed.

Viewing Discovered DCs of the Joined Domain

To view automatically discovered domain controllers (DC) of the Active Directory domain that the cluster has joined:

  • In VAST Web UI: In the Active Directory page, right-click the Active Directory configuration and select Show -> Joined Domain DCs.

  • In VAST CLI: Run the activedirectory show_joined_domain_dcs  command.

The display lists all DCs from all domains in the discovered forest of the cluster's joined domain. For each DC, it shows its URI, status (such as HEALTHY or FAILED), and whether it is on the same Active Directory site as the cluster.

Note

When Active Directory domain auto-discovery is disabled or Active Directory information is not available, a No data to show or similar error message is displayed.

Viewing Discovered Global Catalog Servers

To view automatically discovered Active Directory global catalog (GC) servers:

  • In VAST Web UI: In the Active Directory page, right-click the Active Directory configuration and select Show -> Global Catalog.

  • In VAST CLI: Run the activedirectory show_ad_gcs command.

The display shows the URI of the Active Directory global catalog (GC) server that is currently used by the cluster and the time to the next global catalog refresh (in seconds). Following is a list of other discovered GC servers, each with indication of its URI, status (such as HEALTHY or FAILED), and whether it is on the same Active Directory site as the cluster.

The display does not include GC servers from other trusted forests (even when multi-forest authentication is enabled).

Note

When Active Directory domain auto-discovery is disabled or Active Directory information is not available, a No data to show or similar error message is displayed.

Leaving Active Directory

When you leave an Active Directory domain, the cluster's machine account is deleted from the Active Directory domain controller.

If the Active Directory domain controller is not accessible to the cluster when you try to leave the Active Directory domain, the leave will fail. In this case, you can effectively force the cluster to leave the Active Directory domain by removing the Active Directory configuration from the cluster. The machine account will remain on the Active Directory domain controller, where it can be manually deleted.

To leave an Active Directory:

  • In VAST Web UI, in the Active Directory tab, right-click the Active Directory configuration and select Leave.

  • In VAST CLI, run the activedirectory modify command with the --disabled option.

Related articles