Authentication scenarios

Edit online

The following example scenarios are for authenticating node and user IDs with a Lightweight Directory Access Protocol (LDAP) server.

Scenario 1: Register a node to authenticate with an LDAP server

You want to authenticate a node that is named NODE1 with an LDAP server. Complete the following steps:

Obtain an existing URL for the LDAP server from the LDAP server administrator.
Specify the location of the LDAP server by setting the LDAPURL option in the dsmserv.opt file, for example:
```
ldapurl ldap://server.storage.us.example.com/dc=storage,dc=us,dc=example,dc=com
```
Restart the IBM Storage Protect server.
Configure the IBM Storage Protect server by completing the following steps:
1. Validate that the URL is correctly entered by issuing the QUERY OPTION command:
```
query option ldapurl
```
2. Specify the LDAP user by issuing the SET LDAPUSER command, for example:
```
set ldapuser JackSpratt@storage.us.example.com
```
3. Define the password by issuing the SET LDAPPASSWORD command, for example:
```
set ldappassword adsm4Data
```
  Wait for a message that indicates that the IBM Storage Protect server initialized a connection with the LDAP server.
4. Register the node by issuing the REGISTER NODE command, for example:
```
register node node1@storage.us.example.com authentication=ldap
```

Scenario 2: Update a node to authenticate with an LDAP server

A single node (UPDNODE1) that currently authenticates with the IBM Storage Protect server is now required to authenticate with an LDAP server. For UPDNODE1, specify the AUTHENTICATION parameter in the UPDATE NODE command, for example:

update node updnode1@storage.us.example.com authentication=ldap

Scenario 3: Update all nodes to authenticate with an LDAP server

To update all nodes to authenticate with an LDAP server, you can use a wildcard character (*). Issue the following command:

update node * authentication=ldap

Scenario 4: Determine the authentication method of a node

If you have nodes that authenticate with the IBM Storage Protect server and nodes that authenticate with an LDAP server, you can determine the authentication method. Determine which nodes authenticate with an LDAP server by issuing the following command:

query node authentication=ldap

Issue the following command to determine which nodes authenticate with the IBM Storage Protect server:

query node authentication=local

Scenario 5: Locking nodes that authenticate with the IBM Storage Protect server

You can issue a LOCK NODE command to lock all nodes that authenticate with the IBM Storage Protect server. These nodes might be rarely used, and you might not know which authentication method they use. When you lock the nodes, the node owners are likely to contact you. At that point, you can find out whether they want the nodes to authenticate with the LDAP server or the IBM Storage Protect server. You can issue the LOCK NODE or UNLOCK NODE command with a wildcard to lock or unlock all nodes in that group. To lock all nodes that authenticate with the IBM Storage Protect server, issue the following command:

lock node * authentication=local

Scenario 6: Setting up a default authentication method

You can specify that each newly defined administrative ID and node ID authenticates with an LDAP server. To set the default authentication method to LDAP, issue the following command:

set defaultauthentication ldap

After you set the default authentication method, you can still specify a different authentication method for an individual ID by specifying the AUTHENTICATION parameter, for example:

register node node17 authentication=local