activedirectory create

--machine-account-name MACHINE_NAME

Specifies a name for the machine object that will be created for the cluster within Active Directory, inside the Organizational Unit (see --organizational unit). It is recommended to name the machine name the same as the cluster name for simplicity.

--port PORT

Sets the port of the remote LDAP server. Recommended values: 389 for LDAP (with or without TLS), 636 for LDAPS.

--bindpw BIND_PASSWORD (required if --method simple or --method sasl is specified)

Sets the password used with the bind DN to authenticate to the LDAP server.

--method anonymous|simple|sasl

The authentication method the LDAP server uses to authenticate VAST Cluster as a client querying the LDAP database.

When multi-forest authentication is enabled, VAST Cluster uses SASL for the LDAP bind to domain controllers in other trusted forests, and this setting is only honored for the LDAP bind to domain controllers in the forest of the cluster's joined domain. Active Directory Overview

Set the method according to how the LDAP server is configured to authenticate clients:

--organizational-unit OU

The organizational unit (OU) in the Active Directory domain in which to create the machine object. The name of an organizational unit (OU) in the Active Directory domain.

If unspecified, the machine object is created in the Computers OU.

Specify as a Distinguished Name (DN).

For example: OU=Computers,DC=company-ad,DC=com

--allow-smb

When this option is specified, VAST Cluster can use this Active Directory provider to authenticate and authorize clients accessing the cluster via the SMB storage protocol. (Enabled by default).

--disallow-smb

Disables use of this Active Directory provider for SMB client access.

--enable-ntlm

When this option is specified, SMB clients accessing the cluster are allowed to use NTLM authentication to get authenticated via this Active Directory provider. This is the default behavior.

Note

NTLM authentication is not FIPS-compliant.

--disable-ntlm

Prohibits use of NTLM authentication on this Active Directory provider. SMB clients are expected to use Kerberos authentication, which requires an SPN to be configured for each virtual IP pool. Workflow for Enabling Client Protocol Access

--urls URI_LIST

Use this option only if you choose to disable auto discovery (see --disable-auto-discovery). Enter URIs of LDAP servers (domain controllers in the Active Directory joined domain). The order of listing defines the priority order. The URI with highest priority that has a good health status is used.

Specify URI_LIST as a comma-separated list of URIs in the format <scheme>://<address>.

The domain controllers should all be in the same Active Directory domain which  VAST Cluster joins.

Examples:

--enable-auto-discovery

Enables Active Directory domain auto-discovery. (Enabled by default).

When auto-discovery is enabled, VAST Cluster automatically discovers and queries all domains and domain controllers in the forest of the cluster's joined domain and, if  multi-forest authentication is enabled by the --enable-multi-forest flag, in other trusted forests.Active Directory Overview

--disable-auto-discovery

Disables Active Directory domain auto-discovery.

When auto-discovery is disabled, the LDAP URI (--urls) and search base DN (--basedn) must be specified manually. VAST Cluster contacts only the domain controller configured using the --urls option and does not process requests from users in other domains, neither in the forest of the cluster's joined domain nor in other trusted forests.

--enable-use-ldaps

Enables use of LDAPS for Active Directory domain auto-discovery.

When enabled, VAST Cluster connects to an alternative port (port 636 for the domain controller, port 3269 for the Global Catalog) and initiates a TLS handshake immediately afterwards.

--disable-use-ldaps

Disables use of LDAPS for Active Directory domain auto-discovery.

--binddn BIND_DN (required if --method simple or --method sasl is specified)

Sets the bind DN for authenticating to the LDAP server. The bind DN specifies the user with which VAST Cluster authenticates to the LDAP directory.

Enter the bind DN for authenticating to the LDAP domain. The bind DN specifies the user with which VAST Cluster authenticates to the LDAP directory. You can specify any user account that has read access to the domain.

The format is a comma separated list of components. Each component is an attribute=value pair defining an object in the directory tree. The first component is a cn attribute component specifying the user object, the next component is its container and so on up the tree, with the last component representing the top level domain.

The following attributes can be specified:

For example, cn=admin,ou=users,dc=mydomain,dc=local specifies user 'admin' located in the 'users' container under the domain 'mydomain.local'.

If  multi-forest authentication  is enabled and/or SASL authentication method is used, specify the bind DN in one of the following formats:Active Directory Overview

--basedn BASE_DN

Use this option only if you choose to disable auto discovery (see --disable-auto-discovery).

Specifies the entry in the LDAP directory tree to use as a starting point for user queries. By default, this is also used as the starting point for group queries. Optionally, you can specify a different entry as the group base DN on --group-searchbase.

To maximize the speed of authentication queries, start the search in the lowest branch of the tree under which all users can be found. For example, if the entire directory must be queried, the search base must specify the root of the tree. However, if the search can be restricted to a specific organizational unit (OU), queries may be faster.

Specify BASE_DN as a comma separated list of components. Each component is an attribute=value pair defining an object in the directory tree. The first component defines the object at the lowest part of the tree that you want to use as the starting point of the search, the next component is its container and so on up the tree, with the last component representing the top level domain.

The following attributes can be specified:

--group-basedn GROUP_BASE_DN

Sets the entry in the LDAP directory tree to use as a starting point for group queries. If not specified, the base DN is used.

--gid-number ATTRIBUTE_NAME

The attribute of a group entry that contains the GID number of a group.

Default: gidNumber

--uid ATTRIBUTE_NAME

The attribute of a user entry that contains the user name.

Default: uid

--uid-number ATTRIBUTE_NAME

The attribute of a user entry that contains the UID number.

Default: uidNumber

--member-uid ATTRIBUTE_NAME

The attribute of the group entry that contains names of group members.

Default: member

--posix-account ATTRIBUTE_NAME

The object class that defines a user entry.

Default: user

--posix-group ATTRIBUTE_NAME

The object class that defines a group entry.

Default: group

--match-user ATTRIBUTE_NAME

Use this option to specify which attribute to use for matching users across providers during user refresh and user authentication. When querying a provider for a user that matches a user that was already retrieved from another provider, a user entry that contains a matching value in this attribute will be considered the same user as the user previously retrieved.

Default: sAMAccountName

--uid-member-value-property-name ATTRIBUTE_NAME

Specifies the attribute which represents the value of the LDAP group's member property.

Default: sAMAccountName

--query-groups-mode COMPATIBLE|RFC2307BIS_ONLY|RFC2307_ONLY|NONE

The mode for querying a user's auxiliary group memberships, when the auth provider is set as the source for group membership in the view policy:

--username-property-name ATTRIBUTE_NAME

Overrides 'name' as the attribute to use for querying users in VMS user-initiated user queries.

Default: name

--use-tls

Enables TLS (StartTLS) to secure communication between VAST Cluster and the LDAP server.

When enabled,  VAST Cluster connects to the standard port (port 389 for the domain controller, port 3268 for the Global Catalog) and performs a StartTLS operation as defined in RFC 4513.

Important

Use VAST Web UI to provide a TLS certificate.

--no-tls

Disables TLS (STARTTLS) secure communication between VAST Cluster and the LDAP server.

--domain-name DOMAIN_NAME

Sets the fully qualified domain name (FQDN) of the domain to join.

For example: --domain-name company-ad.com

--user-login-name ATTRIBUTE_NAME

Specifies the attribute used to query Active Directory for the user login name in NFS ID mapping. Applicable only with Active Directory and NFSv4.1.

Default: sAMAccountName

--group-login-name ATTRIBUTE_NAME

Specifies the attribute used to query Active Directory for the group login name in NFS ID mapping. Applicable only with Active Directory and NFSv4.1.

Default: sAMAccountName

--mail-property-name ATTRIBUTE_NAME

Specifies the attribute to use for the user's email address.

Default: mail

--vms-auth

If this option is specified, the LDAP configuration being created will be the one used for VMS authentication.

--no-vms-auth

If this option is specified, the LDAP configuration being created will not be used for VMS authentication. This is the default setting.

--posix-attributes-source JOINED_DOMAIN|ALL_DOMAINS| SPECIFIC_DOMAINS|GC

Determines domains from which VAST Cluster queries POSIX attributes. Options include:

--domains-with-posix-attributes DOMAINS

Provides a comma-separated list of the specific domains when --posix-attributes-source SPECIFIC_DOMAINS is specified. The domains can be in the forest of the cluster's joined domain, or in other trusted forests.

For example: ad.example.com,domain.com

--abac-read-only-value-name KEYWORD

Sets the ABAC attribute value that grants read-only access to a view tagged with this ABAC attribute.

The default is ro.

--abac-read-write-value-name KEYWORD

Sets the ABAC attribute value that grants read/write access to a view tagged with this ABAC attribute.

The default is rw.

--reverse-lookup

Enables use of DNS reverse lookup for the translation of a client IP address to a host name. When this option is specified, the server compares the host name to host names in netgroup entries. If not specified, the server queries DNS for each host name found in the netgroup entries.

--no-reverse-lookup

Disables use of reverse DNS lookup. This is the default setting.

--enable-multi-forest

When this option is specified, VAST Cluster automatically discovers all domains in other trusted forests, in addition to domains in the forest of the cluster's joined domain. For more information, see Active Directory Overview.Active Directory Overview

This option can only be specified when  Active Directory domain auto-discovery. is enabled (--enable-auto-discovery.

--disable-multi-forest

Disables multi-forest authentication on the cluster.