Dell PowerConnect Brocade 300 Fabric OS Administrator's Guide v7.1.0 - Page 164

5 Remote authentication 4. Associate the user to the group by adding the user to the group. For instructions on how to create a user refer to www.microsoft.com or Microsoft documentation to create a user in your Active Directory. 5. Add the user's Administrative Domains or Virtual Fabrics to the CN_list by either editing the adminDescription value or adding the brcdAdVfData attribute to the existing Active Directory schema. This action maps the Admin Domains or Virtual Fabrics to the user name. Multiple Admin Domains can be added as a string value separated by the underscore character ( _ ). Virtual Fabrics are added as a string value separate by a comma ( , ) and entered as a range. Creating a user To create a user in Active Directory, refer to www.microsoft.com or Microsoft documentation. There are no special attributes to set. You can use a fully qualified name for logging in, for example you can log in as "[email protected]". Creating a group To create a group in Active Directory, refer to www.microsoft.com or Microsoft documentation. You will need to verify that the group has the following attributes: • The name of the group has to match the RBAC role. • The Group Type must be Security. • The Group Scope must be Global. • The primary group in the AD server should not be set to the group corresponding to the switch role. You can choose any other group. • If the user you created is not a member of the Users OU then the User Principal Name, in the format of "user@domain", is required to login. Assigning the group (role) to the user To assign the user to a group in Active Directory, refer to www.microsoft.com or Microsoft documentation. You will need to verify that the user has the following attributes: • Update the memberOf field with the login permissions (root, admin, switchAdmin, user, and so on) that the user must use to log in to the switch. or If you have a user-defined group, then use the ldapCfg --maprole ldap_role_name switch_role command to map an LDAP server permissions to one of the default roles available on a switch. Adding an Admin Domain or Virtual Fabric list 1. From the Windows Start menu, select Programs> Administrative Tools> ADSI.msc ADSI is a Microsoft Windows Resource Utility. This utility must be installed to proceed with the rest of the setup. For Windows 2003, this utility comes with Service Pack 1 or you can download this utility from the Microsoft website. 2. Go to CN=Users. 164 Fabric OS Administrator's Guide 53-1002745-02