Setting up user authentication

Authentication server protocols

Authentication servers support the following protocols:

LDAPv3 simple bind authentication
RFC 2865-compliant RADIUS with PAP and CHAP authentication
Kerberos v5

NoteThe authentication server needs to support TLS1.2 as a transfer protocol.

The following certificate file formats are available for LDAP server settings:

X509 DER format
X509 PEM format

One of the following encryption types must be used for the Kerberos server:

Windows
- AES128-CTS-HMAC-SHA1-96
- RC4-HMAC
- DES3-CBC-SHA1
- DES-CBC-CRC
- DES-CBC-MD5
Solaris or Linux
- DES-CBC-MD5

Authorization server requirements

The authorization server must satisfy the following requirements if it works together with the authentication server:

Prerequisite OS
- Windows Server 2003
- Windows Server 2003 R2
- Windows Server 2008
- Windows Server 2008 R2
- Windows Server 2012 R2

Prerequisite software
- Active Directory

Authentication protocol for user for searching
- LDAP v3 simple bind

Note

Acquire the root certificate for the authentication server from the authentication server administrator.
The certificates has an expiration date. If the certificate expires, you will not be able to connect to the authentication server. Make sure to set the expiration date carefully to prepare the certificate.
For more information about the certificate management, consult with the authentication server administrator and manage it appropriately.

Note

When using an LDAP server or a Kerberos server as an authentication server, and combining it with an authorization server, use the same host for the authentication and authorization servers.

When a RADIUS server is used as an authentication server, two authentication servers (one primary and one secondary) can be specified, but only one authorization server can be specified.

Connecting two authentication servers

Two authentication servers can be connected to a storage system. When the servers are connected, the server configurations must be the same, except for the IP address and the port.

If you search for a server using information registered in the SRV records in the DNS server, confirm that the following conditions are satisfied:

NoteFor RADIUS servers, you cannot use the SRV records.

LDAP server conditions:
- The environmental setting for the DNS server is completed at the LDAP server.
- The host name, the port number, and the domain name of the LDAP server are registered in the DNS server.

Kerberos server conditions:
- The host name, the port number, and the domain name of the Kerberos server are registered in the DNS server.

Because UDP/IP is used to access the RADIUS server, no encrypted communications are available, such as negotiations between processes. To access the RADIUS server in a secure environment, encryption in the packet level is required, such as IPsec.

Connecting authentication and authorization servers

To use an authentication server and an authorization server, you must create configuration files and configure your network. Detailed setting information is required for the authentication server and the authorization server, especially for creating a configuration file.

Before you begin

Contact your server administrator for information about the values to be written in the LDAP, RADIUS, or Kerberos configuration file. If you use LDAP servers, obtain certification for the LDAP server files.
Contact your network administrator for information about the network settings.

Procedure

Create a configuration file. The items to specify depend on the protocol you use.
Log in to the SVP and store the following files in an easily accessible location.
- Certificate (for secure communication)
- Configuration file
Open the Windows command prompt on the SVP.
In the folder where the .bat file is located, execute the following command specifying the configuration file path and the certificate file path:
```
C:\MAPP\wk\Supervisor\MappIniSet>MappSetExAuthConf "C:\auth\auth.properties" "C:\auth\auth.cer"
```
After you complete the settings and verify that you can use the authentication and authorization servers, back up the connection settings for the authentication server.
If the authentication server and the authorization server are unusable even after you make the settings, the network or the configuration file settings might have a problem. Contact the server administrator or the network administrator.
Delete the certificate file and the configuration file from the SVP.

Disabling external authentication

You can disable the external authentication server using the maintenance utility.

Log in to the maintenance utility.
Click Administration > External Authentication > Set Up Server > Disable.
When the confirmation window appears, click Apply.
When the completion message appears, click Close.

Naming a user group in Device Manager - Storage Navigator

When you create a user group in Device Manager - Storage Navigator, you name the group with the user's memberOf attribute value which is found in the Active Directory. Device Manager - Storage Navigator supports Active Directory nested groups.

After entering the user group name, verify that the user group name that you entered is registered in the authorization server.

NoteThe domain name (DN) of the user group to be set to Active Directory must be between 1 and 250 characters. The number of user groups that can be registered at one time is 20 at maximum.

CautionIf a user needs to use different user groups for different purposes, create local user accounts on Device Manager - Storage Navigator. Do not use the authorization server.

Creating configuration files

Authentication servers and authorization servers must be configured using configuration files.

Configuration files can be created for LDAP, RADIUS, and Kerberos authentication protocols.

Creating an LDAP configuration file

You can use an LDAP server for authentication on your storage system.

To use an LDAP server for authentication, create a configuration file in UTF-8 encoding. Include information about the authentication server as shown in the following example. Any file name and extension is allowed.

Caution If you save the configuration file when using the Windows standard Notepad application, specify ANSI for the letter code. If you use an editor other than the memo pad and have the YTF-8 BOM setting, specify No BOM then save.

auth.server.type=ldap 
auth.server.name=<server_name> 
auth.group.mapping=<value> 
auth.ldap.<server_name>.<attribute>=<value>

A full example is shown here:

auth.server.type=ldap 
auth.server.name=PrimaryServer 
auth.group.mapping=true 
auth.ldap.PrimaryServer.protocol=ldaps 
auth.ldap.PrimaryServer.host=ldaphost.domain.local 
auth.ldap.PrimaryServer.port=636
auth.ldap.PrimaryServer.timeout=3
auth.ldap.PrimaryServer.attr=sAMAccountName
auth.ldap.PrimaryServer.searchdn=CN=sample1,CN=Users,DC=domain,DC=local
auth.ldap.PrimaryServer.searchpw=passwordauth.ldap.PrimaryServer.basedn=CN=Users,DC=domain,DC=local
auth.ldap.PrimaryServer.retry.interval=1 
auth.ldap.PrimaryServer.retry.times=3
auth.ldap.PrimaryServer.domain.name=EXAMPLE.COM

The LDAP attributes are defined in the following table.

Attribute	Description	Required / Optional	Default value
auth.server.type	Type of an authentication server. Specify `ldap`.	Required	None
auth.server.name	The name of an authentication server. When registering a primary and a secondary server, use a comma to separate the names. The name of the server, including the primary name, secondary name, and the comma (1 byte) must be 64 bytes or less. The names can use all ASCII code characters except for the following: \ / : , ; * ? " < > \| $ % & ' ˜ In this manual, the value specified here is called <server_ name> hereafter.	Required	None
auth.group.mapping	Information about whether to work together with an authorization server: true: Works together false: Does not work together	Optional	False
auth.ldap.<server_name>.protocol	LDAP protocol to use. ldaps: Uses LDAP over SSL/TLS. starttls: Uses StartTLS. When you specify "true" to auth.ldap.<server_name>.dns_lookup, specify ldaps.	Required	None
auth.ldap.<server_name>.host	A host name, an IPv4 address or an IPv6 address of the LDAP server. An IPv6 address must be enclosed in square brackets. To use StartTLS as a protocol, specify a host name. If this value is specified, auth.ldap.<server_name>.dns_lookup will be ignored	Optional¹	None
auth.ldap.<server_name>.port	A port number of the LDAP server. Must be between 1 and 65,535.²	Optional	389
auth.ldap.<server_name>.timeout	The number of seconds before the connection to the LDAP server times out. It must be between 1 and 30.²	Required	10
auth.ldap.<server_name>.attr	Attribute name to identify a user (such as a user ID). Hierarchical model: An attribute name where the value that can identify a user is stored Flat model: An attribute name for a user entry's RDN sAMAccountName is used for Active Directory.	Required	None
auth.ldap.<server_name>.searchdn	DN of the user for searching. If omitted, [value_of_attr]=[Login_ID],[value_ of _basedn] is used for bind authentication.³	Otional	None
auth.ldap.<server_name>.searchpw	User password that is used for searching. Specify the same password that is registered in the LDAP server.	Required	None
auth.ldap.<server_name>.basedn	BaseDN for searching for users to authenticate.³ Hierarchical model: DN of hierarchy that includes all the targeted users for searching Flat model: DN of hierarchy that is one level up from the targeted user for searching	Required	None
auth.ldap.<server_name>.retry.interval	Retry interval in seconds when the connection to the LDAP server fails. Must be between 1 and 5.²	Optional	1
auth.ldap.<server_name>.retry.times	Retry times when the connection to the LDAP server fails. Must be between 0 and 3. Zero means no retry.²	Optional	3
auth.ldap.<server_name>.domain.name	A domain name that the LDAP server manages.	Required	None
auth.ldap.<server_name>.dns_lookup	Information about whether to search the LDAP server with the information registered in the SRV records in the DNS server. true: Searches with the information registered in the SRV records in the DNS server false: Searches with the host name and port number When "host" and "port" are specified, the LDAP server is not searched with the information registered in the SRV records by specifying "true".	Optional	False
Notes: The item can be omitted if true is specified for "auth.ldap.<server_name>.dns_lookup". If the specified value is not valid, the default value will be used. To use symbols such as + ; , < = and >, enter a backslash (\) before each symbol. When using multiple symbols, each symbol must have a backslash before it. For example, to enter abc++ in the searchdn field, use \+ instead of + as shown here: abc\+\+ To enter \ , /, or ", enter a backslash and then enter the ASCII code in hex for the following symbols: Enter \5c for \ Enter \2f for / Enter \22 for " For example, to enter abc\ in the searchdn field, enter abc\5c.

Creating a RADIUS configuration file

You can use a RADIUS server for authentication on your storage system.

To use a RADIUS server for authentication, create a configuration file in UTF-8 encoding. Include information about the authentication server as shown in the following example. Any file name and extension is allowed. If an authorization server is not used, you do not need to define the items for it.

Caution If you save the configuration file when using the Windows standard Notepad application, specify ANSI for the letter code. If you use an editor other than the memo pad and have the YTF-8 BOM setting, specify No BOM then save.

auth.server.type=radius 
auth.server.name=server-name
auth.group.mapping=value
auth.radius.server-name.attribute=value
auth.group.domain-name.attribute=value

A full example is shown below:

auth.server.type=radius 
auth.server.name=PrimaryServer 
auth.group.mapping=true 
auth.radius.PrimaryServer.protocol=PAP 
auth.radius.PrimaryServer.host=xxx.xxx.xxx.xxx 
auth.radius.PrimaryServer.port=1812 
auth.radius.PrimaryServer.timeout=3 
auth.radius.PrimaryServer.secret=secretword 
auth.radius.PrimaryServer.retry.times=3 
auth.radius.PrimaryServer.attr.NAS-Identifier=xxxxxxxx 
auth.group.auth.radius.PrimaryServer.domain.name=radius.example.com
auth.group.auth.radius.PrimaryServer.domain.name.protocol=ldap
auth.group.auth.radius.PrimaryServer.domain.name.host=xxx.xxx.xxx.xxx
auth.radius.PrimaryServer.domain.name=radius.example.com
auth.group.radius.example.com.protocol=ldaps
auth.group.radius.example.com.host=xxx.xxx.xxx.xxx
auth.group.radius.example.com.port=389
auth.group.radius.example.com.searchdn=CN=sample1,CN=Users,DC=domain,DC=local
auth.group.radius.example.com.searchpw=password
auth.group.radius.example.com.basedn=CN=Users,DC=domain,DC=local

The attributes are defined in the following tables.

Table 1: RADIUS definition (for authentication server)
Attribute	Description	Required / Optional	Default value
auth.server.type	Type of an authentication server. Specify `radius`.	Required	None
auth.server.name	The name of a server. When registering a primary and secondary server, use a comma to separate the names. The name of the server, including the primary name, secondary name, and the comma (1 byte) must be 64 bytes or less. The names can use all ASCII code characters except for the following: \ / : , ; * ? " < > \| $ % & ' ˜ In this manual, the value specified here is called `server-name` hereafter.	Required	None
auth.group.mapping	Information about whether to work together with an authorization server true: Works together false: Does not work together	Optional	False
auth.radius.`server-name`.protocol	RADIUS protocol to use. PAP: Password authentication protocol that transmits plaintext user ID and password CHAP: Challenge-handshake authentication protocol that transmits encrypted password	Required	None
auth.radius.`server-name`.host	A host name, an IPv4 address or an IPv6 address of the RADIUS server. An IPv6 address must be enclosed in square brackets.	Required¹	None
auth.radius.`server-name`.port	A port number of the RADIUS server. Must be between 1 and 65,535.	Optional²	1,812
auth.radius.`server-name`.timeout	The number of seconds before the connection to the RADIUS server times out. Must be between 1 and 30.	Optional²	10
auth.radius.`server-name`.secret	RADIUS secret key used for PAP or CHAP authentication	Required	None
auth.radius.`server-name`.retry.times	Retry times when the connection to the RADIUS server fails. Must be between 0 and 3. 0 means no retry.	Optional²	3
auth.radius.`server-name`.attr.NASIdentifier	Identifier for the RADIUS server to find SVP. Specify this value if the attr.NAS-Identifier attribute is used in your RADIUS environment. ASCII codes up to 253 bytes long are accepted.	Optional	None
auth.radius.`server-name`.attr.NAS-IPv4-Address	IPv4 address of the SVP. Specify the value of the NAS-IP-Address attribute. This value is transmitted to the RADIUS server when the authentication is requested.	Optional	None
auth.radius.`server-name`.attr.NAS-IPv6-Address	IPv6 address of the SVP. Specify the value of the NAS-IPv6-Address attribute. This value is transmitted to the RADIUS server when the authentication is requested.	Optional	None
Notes: If you query DNS with external authorization, the settings are not required. If the specified value is not applicable, the default value will be used.

Table 2: RADIUS definition (for authorization server)
Attribute	Description	Required / Optional	Default value
auth.radius.`server-name`.domain.name	A domain name that the LDAP server manages. In this manual, the value specified here is called `domain-name` hereafter.	Required	None
auth.radius.`server-name`.dns_lookup	Information about whether to search the LDAP server with the information registered in the SRV records in the DNS server. true: Searches with the information registered in the SRV records in the DNS server false: Searches with the host name and port number. When "host" and "port" are specified, the LDAP server is not searched with the information registered in the SRV records by specifying "true".	Optional	false
auth.radius.`domain-name`.protocol	LDAP protocol to use. ldaps: Uses LDAP over SSL/TLS. starttls: Uses StartTLS. When you choose ldap, specify "true" to "auth.radius.`domain-name`.dns_lookup"	Required	None
auth.radius.`domain-name`.host	A host name, an IPv4 address or an IPv6 address of the LDAP server. An IPv6 address must be enclosed in square brackets ([ ]).	Optional¹	None
auth.radius.`domain-name`.port	A port number of the LDAP server. Must be between 1 and 65535.	Optional²	389
auth.radius.`domain-name`.searchdn	DN of the user for searching.	Required	None
auth.radius.`domain-name`.searchpw	User password for searching. Specify the same password that is registered in the LDAP server.	Required	None
auth.radius.`domain-name`.basedn	Base DN for searching for users to authenticate. Specify DN of the hierarchy, including all the users for searching because the targeted users for searching are in lower hierarchy than the specified DN.	Optional³	abbr
auth.radius.`domain-name`.timeout	The number of seconds before the connection to the LDAP server times out. Must be between 1 and 30.	Optional²	10
auth.radius.`domain-name`.retry.interval	Retry interval in seconds when the connection to the LDAP server fails. Must be between 1 and 5.	Optional	1
auth.radius.`domain-name`.retry.times	Retry times when the connection to the LDAP server fails. Must be between 0 and 3. 0 means no retry.	Optional²	3
Notes: The item can be omitted if true is specified for "auth.ldap.`server-name`.dns_lookup". If the specified value is not valid, the default value will be used. To use symbols such as + ; , < = and >, enter a backslash (\) before each symbol. When using multiple symbols, each symbol must have a backslash before it. For example, to enter abc++ in the searchdn field, use \+ instead of + as shown here: abc\+\+ To enter \ , /, or ", enter a backslash and then the ASCII code in hex for these symbols. Enter \5c for \. Enter \2f for /. Enter \22 for " For example, to enter abc\ in the searchdn field, enter abc\5c.

Creating a Kerberos configuration file

You can use a Kerberos server for authentication on your storage system.

To use a Kerberos server for authentication, create a configuration file in UTF-8 encoding. Include information about the authentication server as shown in the following example. Any file name and extension are allowed. If an authorization server is not used, you do not need to define the items for it.

Caution If you save the configuration file when using the Windows standard Notepad application, specify ANSI for the letter code. If you use an editor other than the memo pad and have the YTF-8 BOM setting, specify No BOM then save.

auth.server.type=kerberos 
auth.group.mapping=<value> 
auth.kerberos.<attribute>=<value> 
auth.group.<realm name>.<attribute>=<value>

A full example is shown below:

auth.server.type=kerberos 
auth.group.mapping=true 
auth.kerberos.default_realm=example.com 
auth.kerberos.dns_lookup_kdc=true 
auth.kerberos.clockshow=300 
auth.kerberos.timeout=10
auth.group.example.com.protocol=ldaps
auth.group.example.com.port=389
auth.group.example.com.searchdn=CN=sample1,CN=Users,DC=domain,DC=local
auth.group.example.com.searchpw=password
auth.group.example.com.basedn=CN=Users,DC=domain,DC=local

The Kerberos attributes are defined in the following table.

Table 1: Kerberos definition (for authentication server)
Attribute	Description	Required / Optional	Default value
auth.server.type	Type of an authentication server. Specify `kerberos`.	Required	None
auth.group.mapping	Information about whether to work together with an authorization server true: Works together false: Does not work together	Optional	false
auth.kerberos.default_realm	Default realm name	Required	None
auth.kerberos.dns_lookup.kdc	This is a switch that determines which information registered in the SRV records in the DNS server to use when searching the Kerberos server. true: Searches with the information registered in the SRV records in the DNS server false: Searches with the host name and port number When "realm name" and "<value specified to the realm name>.kdc" are specified, the Kerberos server is not searched with the information registered in the SRV records by specifying "true".	Optional	false
auth.kerberos.clockskew	The acceptable range of the difference in time between the SVP and the Kerberos server where the SVP is operating. Must be between 0 and 300 seconds.	Optional¹	300
auth.kerberos.timeout	The number of seconds before the connection to the RADIUS server times out. Must be between 1 and 30. When 0 is specified, the connection does not time out until a communication error occurs.	Optonal¹	10
auth.kerberos.realm_name	Realm identifier name Any name to distinguish the information of Kerberos server in each realm. Duplicate names cannot be used. If you register multiple names, use a comma to separate the names. The value specified here is called <realm_name> hereafter.	Optional²	None
auth.kerberos.<realm _name>.realm	The realm name set to the Kerberos server.	Optional²	None
auth.kerberos.<realm_name>.kdc	The host name, the IPv4 address, and the port number of the Kerberos server. Specify these in the format of "<Host name or IP address>[:Port number]".	Optional²	None
Notes: If the specified value is not valid, the default value will be used. The item can be omitted if true is specified for auth.kerberos.dns_lookup_kdc.

Table 2: Kerberos definition (for authorization server)
Attribute	Description	Required / Optional	Default value
auth.group.<realm_na me>.protocol	LDAP protocol to use. ldaps: Uses LDAP over SSL/TLS. starttls: Uses StartTLS.	Required	None
auth.group.<realm_name>.port	A port number of the LDAP server. Must be between 1 and 65535.	Optional¹	389
auth.group.<realm_name>.searchdn	DN of the user for searching.	Required²	None
auth.group.<realm_name>.searchpw	Password of the user for searching. Specify the same password that is registered in the LDAP server.	Required	None
auth.group.<realm_name>.basedn	BaseDN when the search for users begins. When searching, specify the hierarchy DN, including all the users, because the targeted user for the search is in a lower hierarchy than the specified DN.	Optional²	abbr
auth.group.<realm_name>.timeout	Number of seconds before the connection to the LDAP server times out. Must be between 1 and 30 seconds. When 0 is specified, the connection does not time out until a communication error occurs.	Optional¹	10
auth.group.<realm_name>.retry.interval	Retry interval in seconds when the connection to the LDAP server fails. Must be between 1 and 5.	Optional¹	1
auth.group.<realm_name>.retry.times	Retry times when the connection to the LDAP server fails. Must be between 0 and 3. 0 means no retry.	Optional¹	3
Notes: If the specified value is not valid, the default value will be used. To use symbols such as + ; , < = and >, enter a backslash (\) before each symbol. When using multiple symbols, each symbol must have a backslash before it. For example, to enter abc++ in the searchdn field, use \+ instead of + as shown here: abc\+\+ To enter \ , /, or ", enter a backslash and then the ASCII code in hex for these symbols. Enter \5c for \ Enter \2f for / Enter \22 for " For example, to enter abc\ in the searchdn field, enter abc\5c.

We've Moved!

Product Documentation has moved to docs.hitachivantara.com

Setting up authentication and authorization with Device Manager - Storage Navigator

Authentication server protocols

Authorization server requirements

Connecting two authentication servers

Connecting authentication and authorization servers

Disabling external authentication

Naming a user group in Device Manager - Storage Navigator

Creating configuration files

Creating an LDAP configuration file

Creating a RADIUS configuration file

Creating a Kerberos configuration file

Still Looking?

Quick Links

Setting up authentication and authorization with Device Manager - Storage Navigator

Authentication server protocols

Authorization server requirements

Connecting two authentication servers

Connecting authentication and authorization servers

Disabling external authentication

Naming a user group in Device Manager - Storage Navigator

Creating configuration files

Creating an LDAP configuration file

Creating a RADIUS configuration file

Creating a Kerberos configuration file