Dell Compellent Storage Center

Transcription

1 Dell Compellent Storage Center Active Directory Integration Best Practices Guide Dell Compellent Technical Solutions Group January, 2013

2 THIS BEST PRACTICES GUIDE IS FOR INFORMATIONAL PURPOSES ONLY, AND MAY CONTAIN TYPOGRAPHICAL ERRORS AND TECHNICAL INACCURACIES. THE CONTENT IS PROVIDED AS IS, WITHOUT EXPRESS OR IMPLIED WARRANTIES OF ANY KIND Dell Inc. All rights reserved. Reproduction of this material in any manner whatsoever without the express written permission of Dell Inc. is strictly forbidden. For more information, contact Dell. Dell, the DELL logo, and the DELL badge are trademarks of Dell Inc. Microsoft and Windows are either trademarks or registered trademarks of Microsoft Corporation in the United States and/or other countries. Other trademarks and trade names may be used in this document to refer to either the entities claiming the marks and names or their products. Dell disclaims any proprietary interest in the marks and names of others. ii

3 Table of Contents 1 Preface Audience Purpose Customer Support Introduction to Storage Center Active Directory Integration Overview Authentication Method Single Sign-On Active Directory Functional Levels Read-Only Domain Controllers (RODC) Trusts and Child Domains Prerequisites DNS Settings/Domain Settings Creating a Host (A) record Reverse Lookup Zones and Pointer (PTR) records Creating a Pointer (PTR) record Storage Center Network Settings Setup and Configuration Configure Directory Services Authentication Active Directory User and Group Access Storage Center Permissions Active Directory Account Maintenance Granting Access to User and Group Objects in a Child or Trusted Domain Account and Group Deletion Disabled/Locked Out Accounts Changing Domains Troubleshooting Additional Resources iii

4 Document Revisions Date Revision Author Comments 01/10/ Kris Piepho Initial Release iv

5 1 Preface 1.1 Audience The audience for this document is system administrators who are responsible for the setup and maintenance of Active Directory, Windows servers and associated storage. Readers should have a working knowledge of Active Directory, Windows and the Dell Compellent Storage Center. 1.2 Purpose This document provides an overview of Storage Center Active Directory integration, and introduces best practice guidelines for configuring Storage Center Active Directory integration for use with Windows Server Active Directory Domain Services. Active Directory integration is included as part of Storage Center release For installation procedures, please refer to the Storage Center 6.3 System Manager Administrator s Guide located on Dell Compellent Knowledge Center. 1.3 Customer Support Dell Compellent provides live support EZSTORE ( ), 24 hours a day, 7 days a week, 365 days a year. For additional support, Dell Compellent at [email protected]. Dell Compellent responds to s during normal business hours. January 2013 Storage Center Active Directory Integration Best Practices 1

6 2 Introduction to Storage Center Active Directory Integration 2.1 Overview Enterprises of all sizes consolidate user management and authentication into services such as Active Directory (AD). The Microsoft Active Directory service allows organizations to efficiently organize, manage, and control resources. Active Directory is implemented as a distributed, scalable database managed by Windows Server 2012, 2008 R2, 2003 R2, or 2003 SP1 domain controllers. It is now possible in these environments to manage administrator accounts in the Dell Compellent Storage Center SAN from Active Directory. Storage Center Active Directory integration provides a scalable solution for authentication that enables administrators to manage a potentially large number of accounts across many Storage Center systems from a central location. In addition, Storage Center Active Directory integration simplifies account management for administrators by enabling them to leverage their existing native Active Directory infrastructure Authentication Method Storage Center AD integration requires Kerberos v5 authentication. NTLMv2 authentication is not supported. Kerberos v5 authentication is available with Windows Server 2003 SP1 and later Single Sign-On As of the release of Storage Center, Single Sign-On (SSO) is not supported between Active Directory and Storage Center. Active Directory users will need to enter their credentials each time they access Storage Center. SSO will be supported in a future release of Storage Center Active Directory Functional Levels Storage Center AD integration supports Windows Server 2012, 2008 R2, 2008, and 2003 native Active Directory functional levels, and will function in environments with domain controllers running a combination of any of the aforementioned server operating systems. The functional level of a domain or forest controls which advanced features are available in the domain or forest. Note: The functional level of a domain or forest is limited (but not determined by) the domain controller running the oldest version of Windows Server in the domain or forest. For example, in an environment where the domain controllers were upgraded from Windows Server 2008 R2 to Server 2012, the functional level will remain at 2008 R2 until Active Directory is upgraded. January 2013 Storage Center Active Directory Integration Best Practices 2

7 2.1.4 Read-Only Domain Controllers (RODC) Storage Center AD integration supports the use of a combination of traditional domain controllers and read-only domain controllers for authentication. Storage Center AD Integration will work when only a single read-only domain controller is functional. Note: A primary or backup domain controller must be online during intial setup and configuration of Storage Center AD integration. During setup an Active Directory object for Storage Center is created and joined to the domain. This process can only be completed on a writeable domain controller Trusts and Child Domains Storage Center AD integration allows the joining of Storage Center to one AD domain. When joined to the domain, Storage Center can authenticate users and groups in the local domain, as well as users and groups from child and trusted domains. A two-way transitive trust must exist between the local forest and any external forests in order for Storage Center to authenticate trusted users. For more information about Active Directory trusts, please refer to Microsoft TechNet. Detailed information about configuring Storage Center AD integration with child domains and forest trusts can be found in Chapter 4 of this document. 2.2 Prerequisites Storage Center AD Integration requires Active Directory Domain Services (ADDS) to be running and properly configured. As with any AD installation, the Domain Name Service (DNS) must be running in a healthy state, and properly configured DNS Settings/Domain Settings Storage Center AD integration is heavily dependent upon a properly configured DNS environment. Storage Center and the domain controller(s) must be able to communicate with each other using Fully Qualified Domain Names (FQDN). In order to facilitate communication via FQDN between Storage Center and the domain controller(s), a Host (A) record as well as a Pointer (PTR) record must exist for each Storage Center in DNS Creating a Host (A) record To create a Host (A) record for a Storage Center on Windows Server 2012, perform the following steps: 1. Open a RDP session to the primary DNS server and login as an administrator. 2. Open DNS Manager (Start Administrative Tools DNS) January 2013 Storage Center Active Directory Integration Best Practices 3

8 Figure 1: Administrative Tools 3. In DNS Manager, expand the domain controller, expand Forward Lookup Zones, right-click the domain, and select New Host (A or AAAA). Figure 2: Context Menu January 2013 Storage Center Active Directory Integration Best Practices 4

9 4. The New Host window appears: Figure 3: New Host window 5. Enter the name of the Storage Center in the Name field, and provide the IP address of the Storage Center. For a single-controller Storage Center system, enter the controller IP address. For a dual-controller Storage Center system, enter the management IP address. Leave the Create associate pointer (PTR) record box checked. Click Add Host. Figure 4: Host Information January 2013 Storage Center Active Directory Integration Best Practices 5

10 Note: Creating a pointer (PTR) record will fail if a Reverse Lookup Zone has not yet been configured for the subnet the Storage Center resides on. Click OK to close the error message. The Host (A) record will still be created. Figure 5: DNS warning message To create a Reverse lookup zone and pointer (PTR) record, refer to section of this document. 6. Once the Host (A) record has been created, it will reflect in the right hand screen of DNS Manager. Figure 6: New Host (A) Record Reverse Lookup Zones and Pointer (PTR) records A Reverse Lookup Zone enables clients to use a known IP address during a name query and look up a computer name based on its address. Pointer records map an IP to a hostname, whereas a Host record maps a hostname to an IP. Reverse Lookup Zones are not automatically created with the install of DNS and need to be manually created. Note: Without Host and Pointer records for Storage Center, the domain join operation performed while configuring Storage Center Directory Services will fail. To create a Reverse Lookup Zone: 1. Open a RDP session to the primary DNS server and login as an administrator. 2. Open DNS Manager (Start Administrative Tools DNS) January 2013 Storage Center Active Directory Integration Best Practices 6

11 Figure 7: Administrative Tools 3. In DNS Manager, expand the domain controller, right-click on Reverse Lookup Zones and select New Zone. Figure 8: Context menu January 2013 Storage Center Active Directory Integration Best Practices 7

12 4. The New Zone Wizard window appears. Click Next. Figure 9: New Zone Wizard 5. Select Primary Zone. Click Next. Figure 10: Select zone type January 2013 Storage Center Active Directory Integration Best Practices 8

13 6. Select the Zone Replication Scope. Click Next. Figure 11: Zone Replication Scope 7. Select IPv4 Reverse Lookup Zone. Click Next. Figure 12: Zone name selection January 2013 Storage Center Active Directory Integration Best Practices 9

14 8. Enter the first three octets of the Storage Center s IP address. For example, if the Storage Center s IP address is , enter Click Next. Figure 13: Network ID 9. Select Dynamic Update Type. Click Next. Figure 14: Dynamic Update settings January 2013 Storage Center Active Directory Integration Best Practices 10

15 10. Click Finish to complete the New Zone Wizard. Figure 15: Complete the New Zone Wizard Creating a Pointer (PTR) record To create a Pointer (PTR) record: 1. Open a RDP session to the primary DNS server and login as an administrator. 2. Open DNS Manager (Start Administrative Tools DNS) Figure 16: Administrative Tools January 2013 Storage Center Active Directory Integration Best Practices 11

16 3. In DNS Manager, expand the domain controller, expand Reverse Lookup Zones, right-click the proper reverse lookup zone, and select New Pointer (PTR). Figure 17: Context menu 4. The New Resource Record window appears. Figure 18: New Resource Record window 5. Enter the IP address for the Storage Center that matches what was entered for the Host (A) record, and the Fully Qualified Domain Name of the Storage Center followed by a period. Leave the Allow any authenticated user to update box unchecked. January 2013 Storage Center Active Directory Integration Best Practices 12

17 Click OK. Figure 19: Host information 11. Once the Pointer (PTR) record has been created, it will be reflected in the right hand screen of DNS Manager. Figure 20: New Pointer (PTR) record Storage Center Network Settings On the Storage Center, each controller s primary DNS server must be set to a DNS server used by Active Directory. If a secondary DNS server also exists, each controller should be configured to point to it. Each controller must also reflect the domain name in which the Storage Center will exist and authenticate with. To modify a controller s DNS/Domain settings, perform the following steps: 1. Connect to the Storage Center using Compellent System Manager, or the web GUI. Login as a user with administrator rights. January 2013 Storage Center Active Directory Integration Best Practices 13

18 Figure 21: Storage Center System Manager 2. In the left navigation window, expand Controllers. Figure 22: Controllers January 2013 Storage Center Active Directory Integration Best Practices 14

19 3. Right-click on the first controller, and select Properties. Figure 23: Controller properties 4. Click the IP button at the top of the window. Figure 24: Controller IP settings January 2013 Storage Center Active Directory Integration Best Practices 15

20 5. Scroll down to the Primary DNS Server setting. Figure 25: Controller DNS settings 6. Enter the IP Address of the Primary DNS Server, the Secondary DNS Server (if applicable), and the Domain Name. Figure 26: Updated Controller DNS settings 7. Click OK to save settings 8. For a dual-controller Storage Center sytem, repeat this process on the other controller. January 2013 Storage Center Active Directory Integration Best Practices 16

21 3 Setup and Configuration Refer to chapter 9 of the Storage Center 6.3 System Manager Administator s Guide for more information about enabling Active Directory integration. Note: All existing Storage Center users and groups will remain after Directory Services Authentication is configured. Note: It is recommended that an Active Directory service account be created prior to configuring Storage Center directory services authentication. The service account will need to be assigned or delegated rights to query the directory. This account will be used by Storage Center to process all directory query requests. 3.1 Configure Directory Services Authentication 1. Connect to the Storage Center using Compellent System Manager, or the web GUI. Login as an administrator user. 2. Click Storage Management, select System, select Access, and choose Configure Authentication. Figure 27: Storage Center context menu 3. The Configure Authentication window will appear: January 2013 Storage Center Active Directory Integration Best Practices 17

22 Figure 28: Configure Authentication window 4. Make sure the Enable External Directory Services box is checked, and enter the name(s) of the AD Domain Controller(s), separated by spaces. Click Start. Figure 29: Enable External Directory Services January 2013 Storage Center Active Directory Integration Best Practices 18

23 5. The following screen appears: Figure 30: Configure Authentication Note: fields in this screen are case sensitive. a. In the Directory Type dropdown, choose Active Directory. b. In the URI field, make sure the FQDN name of the AD Domain Server(s) are entered. Each FQDN should be prefaced by ldap:// and names should be separated by spaces. i.e.: ldap://js24.exlab.local ldap://js25.exlab.local Note: Storage Center AD Integration is not site aware, meaning it cannot automatically detect a domain and associated domain controllers To use a specific domain controller it must be defined in the URI field. Storage Center will try to authenticate to domain controllers in the order they are defined in this field. If a domain controller becomes inaccessible, Storage Center will try the next domain controller in the list. Note: Storage Center AD Integration supports authentication against a Read- Only Domain Controller (RODC). c. In the Server Connection Timeout field enter 30. d. In the Base DN field enter the canonical name of the domain. For example, if your domain is EXLab.local, the canonical name is dc=exlab,dc=local. e. (Optional) In the Relative Base field enter the canonical location of where the Storage Center Active Directory object should be created. Default is CN=Computers. f. In the Storage Center Hostname field enter the Storage Center name followed by the domain name. This will be the FQDN of the Storage Center (i.e. SC22.EXLab.local). January 2013 Storage Center Active Directory Integration Best Practices 19

24 g. In the LDAP Domain field enter the name of the domain (i.e. EXLab.local). h. In the Auth Bind Username field enter the AD service account with rights to search the directory created prior to setup. The format of this field is (i.e. i. In the Auth Bind Password field enter service account password. Figure 31: Configure Authentication settings 6. To verify Storage Center connectivity to the domain controller(s), click the Test Servers button. Figure 32: Verify connectivity January 2013 Storage Center Active Directory Integration Best Practices 20

25 Note: If the test fails, review DNS settings for the Storage Center and domain controllers. 7. Click Return. Figure 33: Configure Authentication 8. Click Continue. 9. The following screen is for configuring Kerberos Authentication. The values displayedwill be the default values, and in most cases, can be left as is. If the defaults are modified, all values should be entered in UPPERCASE. January 2013 Storage Center Active Directory Integration Best Practices 21

26 Figure 34: Kerberos information a. In the Domain Realms field enter the domain name (i.e. EXLAB.LOCAL). b. In the KDC Hostname field specify a Kerberos server (this is usually a domain controller). c. In the Password Renew Rate (Days) field leave the value at 15. d. Click Continue. 10. Storage Center will attempt to save values and configure authentication. Figure 35: Successful configuration January 2013 Storage Center Active Directory Integration Best Practices 22

27 11. Click Join. Figure 36: Join domain 12. Enter credentials for a domain user that has rights to join objects to the domain. This one-time operation does not require a service account. Figure 37: Domain user info January 2013 Storage Center Active Directory Integration Best Practices 23

28 13. Click Join Now. Figure 38: Successful domain join 14. Click Finish Now to close the window and complete setup. 4 Active Directory User and Group Access Detailed information on how to grant access to directory users and groups can be found in the Storage Center 6.3 System Manager Administrator s Guide. There are a few things to keep in mind when granting access to a Directory user: In cases where a directory user has been given access to the Storage Center directly and also belongs to a directory group that has been granted access, the local user permissions will override the mapped group permissions. A directory group mapped to the Storage Center with Volume Manager or Reporter privileges must be mapped to a local Storage Center group. The local Storage Center group determines what folders the users in the mapped directory group have access to. A directory group mapped to the Storage Center with Administrator priveleges does not require mapping to a local group as Administrators have access to all folders in Storage Center. January 2013 Storage Center Active Directory Integration Best Practices 24

29 Storage Center supports authentication of a user in up to 16 nested groups. 64 Active Directory groups can be mapped to a single Storage Center group. 4.1 Storage Center Permissions If a directory user has been given Administrator privileges to Storage Center, that user s privilege level cannot be changed to Volume Manager or Reporter. However, user privileges can be changed from Volume Manager to Reporter and vice versa. Like directory users, directory groups that have been given Administrator privileges to Storage Center cannot be changed to Volume Manager or Reporter. Privileges can be changed on a directly mapped directory user, but cannot be changed on a user that is allowed access through a group. When a directory user is a member of more than one directory group that has been granted access to Storage Center, that user will receive the least restrictive permissions of the group he/she belongs to. For example, a user is a member of the Accounting directory group which has been granted Reporter access in Storage Center. The user is also a member of the Storage directory group which has been granted Volume Manager access in Storage Center. When the directory user logs into Storage Center, their effective permissions will be Volume Manager. 4.2 Active Directory Account Maintenance Granting Access to User and Group Objects in a Child or Trusted Domain To allow access to users and groups from child or trusted domains, it is important to understand the three types of groups (Universal, Global and Domain Local) within Active Directory. A Universal Group can contain users and groups (global and universal) from any domain in the forest. Universal groups do not care about trust. Universal groups can be a member of domain local groups but not global groups. Because Storage Center requires a two-way trust in order to grant access to non-local users, using universal groups for Storage Center access is not recommended. A Global Group can contain users, computers and groups from the same domain, but not universal groups. A global group can be a member of global groups of the same domain, domain local groups or universal groups of any domain in the forest or trusted domains. January 2013 Storage Center Active Directory Integration Best Practices 25

30 A Domain Local Group can contain users, computers, global groups and universal groups from any domain in the forest and any trusted domain, and domain local groups from the same domain. Domain local groups can be a member of any domain local group in the same domain. A user in a child domain can gain access to Storage Center by being a member of a parent domain group that has access, or by being a member of a local child domain group that is a member of a parent domain group that has access. In this configuration, the parent domain group should be set to domain local because a global group cannot contain domain local or global groups from a child domain. A user in a trusted domain can gain access to Storage Center by being a member of a local domain group that has access, or by being a member of group on the trusted domain that is a member of the local domain group that has access. In this configuration, the local domain group should be set to domain local. The local domain group cannot be a global group because global groups cannot contain cross-domain members. Groups on the trusted domain should be created as global Account and Group Deletion When an Active Directory user account that has been granted access to Storage Center either directly or via group membership is deleted, that user no longer has access to Storage Center. The corresponding Storage Center user account must be manually deleted. When an Active Directory Group that has been granted access to Storage Center is deleted from AD, all members of that group will no longer have access to Storage Center (unless they were directly granted access). The group mapping and all user accounts that were part of that group must be manually deleted from Storage Center Disabled/Locked Out Accounts Active Directory user accounts that have been granted access to Storage Center either directly or via group membership will be unable to login to Storage Center if the user account is disabled or locked out in Active Directory. Access to Storage Center is regained when the account is enabled. 5 Changing Domains At any time Storage Center AD integration can be configured to point to a different domain and domain controllers. DNS settings and Storage Center networking settings must be updated to reflect the new domain information. The Authentication Configuration wizard will need to be re-run to enter new settings and join the Storage Center to the new domain. January 2013 Storage Center Active Directory Integration Best Practices 26

31 All previous user and group mappings from Active Directory will no longer be functional and can be removed. Please note that if the Storage Center is returned to the original domain, any user mappings that were deleted that are to be used again must be restored by a Storage Center administrative user. Note: Domain changes require a restart of Storage Center. Refer to chapter 8 of the Storage Center 6.3 System Manager Administrator s Guide for instructions on how to restart Storage Center. 6 Troubleshooting As mentioned earlier in this document, Storage Center AD integration is heavily dependant upon DNS properly configured and running in a healthy state. Verifying DNS settings and connectivity is a good place to start when troubleshooting problems with Storage Center AD integration. At least one domain controller listed in Directory Services Configuration must be online in order for Storage Center to authenticate directory users and groups. If all domain controllers are offline, access to Storage Center is restricted to local users only. 7 Additional Resources In addition to the hyperlinks in this document, please refer to the following sites for more information: Dell Compellent Home Page: Dell Compellent Knowledge Center: Microsoft DNS Overview: Microsoft Active Directory Domain Services Overview: January 2013 Storage Center Active Directory Integration Best Practices 27