Adding The Adlist - HP A7533A - Brocade 4Gb SAN Switch Base Administrator's Manual

To set up LDAP:
Install a Certificate Authority (CA) certificate on the Windows Active Directory server for LDAP.
1.
Follow Microsoft's instructions for generating and installing CA certificates on a Windows server.
2. Create a user in Microsoft Active Directory server.
For instructions on how to create a user, refer to Microsoft documentation to create a user in your Active
Directory.
3. Create a group name that uses the switch's role name so that the Active Directory group's name is the
same as the switch's role name.
or
Use the ldapCfg -–maprole <ldap_role_name> <switch_role> command to to map an
LDAP server role to one of the default roles available on the switch.
4. Associate the user to the group by adding the user to the group.
For instructions on how to create a user refer to Microsoft documentation to create a user in your Active
Directory.
5. Add the user's Administrative Domains to the CN_list by editing the adminDescription value.
This will map the admin domains to the user name. Multiple admin domains can be added as a string
value separated by the underscore character ( _ ).
To create a user:
To create a user in Active Directory, refer to
special attributes.
To create a group:
To create a group in Active Directory, refer to
need to verify that the group uses the following attributes:
• The name of the group has to match the RBAC role.
• The Group Type must be Security.
• The Group Scope must be Global.
To assign the group (role) to the user:
To assign the user to a group in the Active Directory, refer to
documentation. You will need to verify that the user has the following attributes:
• Update the memberOf field with the login role (Root, Admin, SwitchAdmin, User, etc.) that the user
must use to log in to the switch, or
• If you have a user-defined group, then use the ldapCfg -–maprole <ldap_role_name>
<switch_role> to map an LDAP server role to one of the default roles available on a switch.

Adding the adlist

From the Windows Start menu, select Programs> Administrative Tools> ADSI.msc
1.
ADSI is a Microsoft Windows Resource Utility. This will need to be installed to proceed with the rest of
the setup. For Windows 2003, this utility comes with Service Pack 1 or you can download this utility
from the Microsoft website.
Go to CN=Users
2.
Right click on Properties. Click the Attribute Editor tab.
3.
4. Double-click the adminDescription attribute.
This opens the String Attribute Editor dialog box.
Enter the value for the admin domains separated by an underscore ( _ ) into the Value field.
5.
Example
adlist_0_10_200_endAd
Home Admin Domain (homeAD) for the user will be the first value in the adlist (Admin Domain list). If a
user has no values assigned in the adlist attribute, then the homeAD '0' will be the default
administrative domain for the user.
www.microsoft.com or Microsoft documentation. There are no
www.microsoft.com or Microsoft documentation. You will
www.microsoft.com
Fabric OS 6.1.x administrator guide
or Microsoft
77