Creating A User; Creating A Group; Assigning The Group (Role) To The User; Adding An Admin Domain List - HP A7533A - Brocade 4Gb SAN Switch Base Administrator's Manual

1. Install a Certificate Authority (CA) certificate on the Windows Active Directory server for LDAP.
Follow Microsoft instructions for generating and installing CA certificates on a Windows server.
2. Create a user in Microsoft Active Directory server.
For instructions on how to create a user, see
user in your Active Directory.
3. Create a group name that uses the switch's role name so that the Active Directory group's name is the
same as the switch's role name.
or
Use the ldapCfg -–maprole ldap_role_name switch_role command to map an LDAP
server role to one of the default roles available on the switch.
4. Associate the user to the group by adding the user to the group.
For instructions on how to create a user see
5. Add the user's Administrative Domains to the CN_list by editing the adminDescription value.
This will map the Admin Domains to the user name. Multiple Admin Domains can be added as a string
value separated by the underscore character ( _ ).

Creating a user

To create a user in Active Directory, see
special attributes to set. You can use a fully qualified name for logging in, for example you can log in as
user@domain.com.

Creating a group

To create a group in Active Directory, see
verify that the group has the following attributes:
• The name of the group has to match the RBAC role.
• The Group Type must be Security.
• The Group Scope must be Global.

Assigning the group (role) to the user

To assign the user to a group in Active Directory, see
will need to verify that the user has the following attributes:
• Update the memberOf field with the login role (Root, Admin, SwitchAdmin, User, etc.) that the user must
use to log in to the switch.
• If you have a user-defined group, use the ldapCfg -–maprole ldap_role_name switch_role
command to map an LDAP server role to one of the default roles available on a switch.

Adding an Admin Domain list

1. From the Windows Start menu, select Programs > Administrative Tools > ADSI.msc
ADSI is a Microsoft Windows Resource Utility. This will need to be installed to proceed with the rest of
the setup. For Windows 2003, this utility comes with Service Pack 1 or you can download this utility
from the Microsoft web site.
Go to CN=Users.
2.
3. Right click on select Properties. Click the Attribute Editor tab.
4. Double-click the adminDescription attribute.
This opens the String Attribute Editor dialog box.
5. Perform the appropriate action based on whether you are using Administrative Domains or Virtual
Fabrics:
• If you are using Administrative Domains, enter the value of the Admin Domain separated by an
underscore ( _ ) into the Value field.
94 Managing user accounts
www.microsoft.com
www.microsoft.com
www.microsoft.com or Microsoft documentation. There are no
www.microsoft.com or Microsoft documentation. You will need to
www.microsoft.com
or Microsoft documentation to create a
or Microsoft documentation.
or Microsoft documentation. You