Skip to main content
AI Data Engine

Configure Active Directory identity mapping for NFS in AI Data Engine

Contributors netapp-dbagwell
PDFs

Identify the owners of your NFS files by name instead of by numeric ID. AI Data Engine (AIDE) can map the numeric user IDs (UIDs) and group IDs (GIDs) in NFS files to Active Directory identities, and it uses resolved user identities to display file-owner names.

This mapping doesn't authenticate AI Data Engine to NFS storage. It converts the IDs that AI Data Engine finds during scanning to Active Directory names.

Before you begin

Permissions and access

  • You have AI Data Engine administrator privileges.

AI Data Engine configuration
Active Directory

  • You have an Active Directory account that AI Data Engine can use to query user and group attributes. You enter its user name and password in AI Data Engine.

  • You have your Active Directory domain name and either the IP address of your DNS server or the IP address and port of your LDAP server.

  • You know whether your directory requires a secure LDAP connection.

  • If AI Data Engine queries the Global Catalog and the attributes aren't yet replicated to it, you or your Active Directory administrator has the Schema Admins role to make the schema change.

Prepare Active Directory

Match the UID and GID attributes in Active Directory to the numeric IDs used on your NFS storage so AI Data Engine can resolve file owners.

AI Data Engine reads the following Active Directory attributes:

Attribute Purpose Required

uidNumber

The numeric UID of a user. It must match the UID that the user has on your NFS storage.

Yes

gidNumber

The numeric GID of a group. It must match the GID that the group has on your NFS storage.

Yes

mail

The email address of the file owner. If this attribute isn't set, the owner's email address appears as Not Available.

No

Populate uidNumber on the users and gidNumber on the groups that you want AI Data Engine to resolve.

Note Set gidNumber on the group object. The gidNumber on a user object identifies that user's primary group. It isn't the group attribute that AI Data Engine uses for this lookup.
Steps

  1. Verify that every user that you want to resolve has a uidNumber value and every group has a gidNumber value. Each UID must be unique among users, and each GID must be unique among groups. A user and a group can have the same numeric value.

  2. If AI Data Engine queries the Global Catalog and the attributes aren't already replicated to it, replicate the uidNumber and gidNumber attributes to it. The replication is a one-time change for the entire forest. You must be a member of the Schema Admins group.

    1. On a domain controller, open the Active Directory Schema snap-in.

    2. Open the properties of the uidNumber attribute.

    3. Select Replicate this attribute to the Global Catalog.

    4. Repeat for the gidNumber attribute.

Caution If AI Data Engine queries the Global Catalog, attributes that aren't replicated to it aren't returned by identity lookups. The corresponding IDs remain unresolved.

Enable Active Directory for NFS

Connect AI Data Engine to the Active Directory domain that contains the matching UID and GID attributes, then enable identity mapping so scanned NFS files can show resolved owner names.

Steps

  1. From the AI Data Engine UI, select Configuration.

  2. Select General settings.

  3. On the page, find Active Directory and select Enabled.

  4. Enter the connection details for your Active Directory domain. Select either the DNS Server IP address option or the LDAP Server IP address option.

    Note The credentials you enter here are for the directory integration. They are separate from the credentials you provide for an SMB archive destination. Refer to Take action on your data.
    Field Description

    Username

    The Active Directory account that AI Data Engine uses to query user and group attributes. Enter the name in the format domain\user or user@domain.

    Password

    The password of the account.

    DNS Server IP address

    The IP address of the DNS server that resolves your Active Directory domain. For example, 10.0.1.50. Select this option instead of LDAP Server IP address.

    Domain name

    The fully qualified name of your Active Directory domain. For example, corp.example.com. This field is required for both the DNS and LDAP options.

    LDAP Server IP address

    The IP address of the LDAP server, which is a domain controller. For example, 10.0.1.50. Select this option instead of DNS Server IP address.

    LDAP Server Port

    The port of the LDAP server. The default is 389.

    LDAP secure connection

    Select this option to connect to the LDAP server over a secure connection. It is available with both the DNS and LDAP options.

  5. Optionally, turn on Enable NFS identity mapping.

    Enabling NFS identity mapping allows AIDE to resolve numeric NFS file-owner IDs to Active Directory owner names. Enable this option only if Active Directory contains the Unix UID/GID attributes used by your NFS environment.

    1. Enter the UID number attribute and the GID number attribute, such as uidNumber and gidNumber. Both fields are required when NFS identity mapping is enabled. Owner information is resolved in the background.

  6. Save your changes.

Result

AI Data Engine uses Active Directory to resolve the owners of NFS files that it scans.

AI Data Engine resolves identities asynchronously. Owner names might not appear immediately after you enable mapping or update attributes in Active Directory.

To check the result, open the file details in the Investigation view and verify that the file owner shows an Active Directory user name.