Brocade Communications Systems 53-1001763-02, Administrator'S Manual

Page: 152 / 586

112 Fabric OS Administrator’s Guide
53-1001763-02
The authentication model using RADIUS and LDAP
5
3. Create a group name that uses the switch’s role name so that the Active Directory group’s
name is the same as the switch’s role name.
or
Use the ldapCfg
-–
maprole ldap_role_name switch_role command to map an LDAP server role
to one of the default roles available on the switch.
4. Associate the user to the group by adding the user to the group.
For instructions on how to create a user refer to www.microsoft.com or Microsoft
documentation to create a user in your Active Directory.
5. Add the user’s Administrative Domains or Virtual Fabrics to the CN_list by editing the
adminDescription value.
This will map the Admin Domains or Virtual Fabrics to the user name. Multiple Admin Domains
can be added as a string value separated by the underscore character ( _ ). Virtual Fabrics are
added as a string value separate by a colon ( , ) and entered as a range.
6. Add the attribute brcdAdVfData to the existing Active Directory schema.
Creating a user
To create a user in Active Directory, refer to www.microsoft.com or Microsoft documentation. There
are no special attributes to set. You can use a fully qualified name for logging in, for example you
can log in as "user@domain.com".
Creating a group
To create a group in Active Directory, refer to www.microsoft.com or Microsoft documentation. You
will need to verify that the group has the following attributes:
•
The name of the group has to match the RBAC role.
•
The Group Type must be Security .
•
The Group Scope must be Global .
•
Any user you create must have domain users as their primary group.
•
If the user you created is not a member of the Users OU then the User Principal Name, in the
format of "user@domain", is required to login.
Assigning the group (role) to the user
To assign the user to a group in Active Directory, refer to www.microsoft.com or Microsoft
documentation. You will need to verify that the user has the following attributes:
•
Update the memberOf field with the login role (Root, Admin, SwitchAdmin, User, etc.) that the
user must use to log in to the switch.
or
If you have a user-defined group, then use the ldapCfg -–maprole ldap_role_name switch_role
command to map an LDAP server role to one of the default roles available on a switch.