Hitachi Virtual Storage Platform F400, Руководство системного администратора

Страница: 161 / 368

RADIUS server, or it may authenticate the user through Active Directory. After
authorization, the SMU allows the user to perform actions allowed by the user's profile.
Active Directory users are assigned full access rights to the SMU functionality.
For local and RADIUS users the user profile details are specified when the user account is
created.
The user
profile:
■
Indicates if the user is to be authenticated locally,or through a RADIUS server.
■
Specifies the user's access (privilege) level, meaning it specifies if the user is a:
●
Global administrator.
●
Storage administrator.
●
Server administrator.
●
Storage administrator.
■
Specifies the servers the user is allowed to access.
■
Specifies if the user has CLI access (for RADIUS and Local Users).
Active Directory user authentication
Active Directory is an LDAP-compliant hierarchical database of objects. It is very popular
in enterprise environments and is becoming a de facto standard for user authentication.
After Active Directory connection settings and groups have been
configured for the SMU,
it will allow logins from enabled users who supply their Active Directory name and
password. This is typically the same name and password that the user would use to log
into Windows and other enterprise applications. Unlike SMU local and RADIUS user
names, Active Directory user names are case-insensitive. Active Directory passwords are
case-sensitive and cannot be changed from the SMU; they are maintained in the Active
Directory server.
There are a number of
benefits for SMU users. The administrator does not need to
maintain a separate set of user details, because the SMU can just make use of the Active
Directory enterprise user database. Users can login using their usual name and
password instead of having to remember a separate set of credentials for the SMU. And
instead of configuring access for individual users, the SMU administrator just has to
specify the Active Directory groups whose members have login rights.
It is possible to assign more restrictive user levels and managed severs to Active
Directory users according to their group membership. So it is possible to define a group
of users who have only server level access, for example, or access to a restricted set of
managed HNAS servers.
Although the SMU supports RADIUS and Active Directory for external authentication,
they are mutually exclusive; it is not possible to have them both configured for external
authentication at the same time.
When a login attempt is made, the SMU
first tries to authenticate the credentials as a
local user. If that fails, and Active Directory is configured, they are authenticated as an
Active Directory user.
Active Directory authentication requests are sent to servers in the
configured sequential
order. If a successful connection cannot be made to the first server, it attempts to
contact the second server and so on. When a connection is made and an authentication
Active Directory user authentication
Chapter 5: Setting up security
System Administrator Guide for VSP Gx00 models and VSP Fx00 models 161