Introduction

You can configure IBM Spectrum Symphony to use Active Directory (AD) server as the primary directory service for user authentication. The document outlines step-by-step procedures for installing and configuring Active Directory and DNS Server on Windows Server 2019 using PowerShell. Also, it covers the process of connecting RHEL 8.4 OS-based Symphony Cluster node directly to AD by using Samba Winbind to ensure encryption compatibility, and joining it to an Active Directory domain.

The purpose of this documentation is to enable system administrators to seamlessly configure IBM Spectrum Symphony with Active Directory for user authentication, allowing for efficient user management and access control.

General prerequisites

Before you proceed with the configuration process, ensure that the prerequisites are met:

1. For Installing and Configuring Active Directory and DNS Server:
   • A Windows Server 2019 system with administrative privileges.
   • Basic familiarity with PowerShell commands and Windows Server management.
2. For Connecting RHEL Systems Directly to AD using Samba Winbind:
   • An RHEL system capable of running Samba Winbind.
   • Familiarity with RHEL command-line interface and system configuration.
   • Access to the Active Directory domain and appropriate permissions to join the domain.

Network prerequisites

Before you proceed with the configuration of IBM Storage Scale to use Active Directory and connecting RHEL systems to AD, ensure that the following network prerequisites are met:

1. Network connectivity: You need stable and reliable network connectivity between the Windows Server 2019 system (where Active Directory and DNS are installed) and the RHEL systems that are joined to the domain. Verify that no network communication issues or firewalls are set up that block essential ports.

2. Firewall rules: Review and update firewall rules to allow the necessary communication between the Windows Server 2019 system, RHEL systems, and the domain controllers. Key ports that are used for AD communication include TCP/UDP 53 (DNS), TCP/UDP 88 (Kerberos), TCP 135 (RPC), TCP/UDP 389 (LDAP), TCP/UDP 445 (SMB), and TCP/UDP 636 (LDAPS).

3. Domain controller reachability: Confirm that the RHEL systems can reach the Active Directory domain controllers without any connectivity issues. Use tools like "ping" or "nslookup" to verify the ability to resolve the domain controller's hostname and IP address from the RHEL systems.

4. Time synchronization: Ensure that all systems that are participating in the Active Directory domain, including the Windows Server 2019 system and RHEL systems, have their clocks that are synchronized with a reliable time source. Time synchronization is critical for proper authentication and Kerberos ticket validation.

5. Domain DNS configuration: The Active Directory domain must be properly configured DNS settings. The domain controller's IP address must be set as the primary DNS server on all systems (including the Windows Server 2019 system and RHEL systems) that are part of the AD domain.

6. DNS resolution: Verify that both forward and reverse DNS resolutions are functioning correctly. The domain controller's hostname must be resolvable from the Windows Server 2019 system and RHEL systems, and the Windows Server 2019 system hostname must be resolvable from the RHEL systems.

7. DNS domain name: Ensure that the DNS domain name of the Active Directory matches the domain name that is used during the configuration process. In this case, the domain name "POCDOMAIN.LOCAL" used for the Active Directory must be consistent throughout the configuration.

8. Active Directory user account with administrative privileges: Ensure that an Active Directory user account with administrative privileges is available to be used during the configuration process. This account is used to promote the Windows Server 2019 system as a domain controller and to join the RHEL systems to the AD domain.

Step 1 - Installing and Configuring Active Directory and DNS Server on Windows Server 2019 using PowerShell

1. Open PowerShell with Administrative Privileges:

   a. Press the "Windows + X" keys on your keyboard to access the Power User menu.

   b. From the list, choose "Windows PowerShell (Admin)" to start an elevated PowerShell session with administrative privileges.

2. Install the Active Directory Domain Services Role and DNS Server Role by running these PowerShell commands:

   powershell code
   # Install the Active Directory Domain Services Role and DNS Server Role
    Install-WindowsFeature -Name AD-Domain-Services, DNS -IncludeManagementTools
   

3. Promote the Server to a Domain Controller with Integrated DNS by running these PowerShell commands:

   powershell code
   # Set the required parameters
   $DomainName = "POCDOMAIN.LOCAL"
   $SafeModePassword = ConvertTo-SecureString -AsPlainText "MySecureDSRMpwd2023!" -Force
   
   # Configure and promote the server as a domain controller with integrated DNS
   Install-ADDSForest -DomainName $DomainName -SafeModeAdministratorPassword  $SafeModePassword -DomainMode Win2019 -ForestMode Win2019 -InstallDNS
   

   Example values:

   • Domain Name: POCDOMAIN.LOCAL
   • DSRM Password: MySecureDSRMpwd2023!

   When you run the PowerShell commands, the Active Directory Domain Services and DNS Server roles are installed and configured on the server.

   The server automatically restarts to complete the domain controller promotion process.

4. After the server restarts, log in using the domain administrator account that you created during the promotion process to verify Active Directory and DNS Configuration.

Step 2 - Creating a user group and users in Active Directory for users that access the Symphony cluster

Create a user group named "Symphony-group" and a user named "Symphonyuser01" in the Active Directory domain "pocdomain.local" using the Active Directory Users and Computers (ADUC) management tool on a Windows Server:

Creating user groups and users in the "pocdomain.local" Active Directory domain requires administrative privileges within that domain. Ensure that you have the necessary permissions to create groups and users. Also, always set strong passwords and follow security best practices when you create user accounts and groups in Active Directory to maintain a secure network environment.

1. Open Active Directory Users and Computers:

   a. Log in to the Windows Server with administrative privileges.

   b. Click Start and search for "Active Directory Users and Computers."

   c. Start the "Active Directory Users and Computers" management console.

2. Create a User Group Symphony-group:

   a. In the ADUC console, navigate to the Organizational Unit (OU) within the "pocdomain.local" domain where you want to create the user group.

   b. Right-click on the OU and select New and then Group.

   c. In the New Object - Group dialog box, enter Symphony-group as the Group name.

   d. Choose the Group scope (for example, Global) and Group type (for example, Security).

   e. Click OK to create the Symphony-group user group.

3. Create a User Symphonyuser01:

   a. In the ADUC console, navigate to the same or a different Organizational Unit (OU) within the "pocdomain.local" domain where you want to create the user "Symphonyuser01."

   b. Right-click on the OU and select New and then User.

   c. In the New Object - User dialog box, enter the required information for the new user *symphonyuser01:

   • Full name: Enter the user's full name (for example, LSF User 01).

   • User logon name: Enter the user's logon name (for example, Symphonyser01).

   • User Principal Name (UPN): The UPN is automatically generated based on the user logon name and the domain name (for example, Symphonyuser01@pocdomain.local).

   • Password: Set a secure password for the user account and choose whether the user must change the password on the first logon.

   • User cannot change the password: Check this option if you want to prevent the user from changing their password.

   • Password never expires: Check this option if you want the user's password to never expire.

   • Account is disabled: By default, the account is enabled. If you want to create the user account in a disabled state, clear this option.

   d. Click Next to continue through any additional wizard steps.

   e. Review the information entered, and click Finish to create the new user "Symphonyuser01."

4. Add "Symphonyuser01" to "Symphony-group" User Group:

   a. In the ADUC console, locate the Symphony-group user group that you created earlier.

   b. Right-click on the Symphony-group user group and select Properties**. c. In the Properties dialog box, go to the Members tab.

   d. Click Add and then enter Symphonyuser01 in the Enter the object names to select field.

   e. Click Check Names to validate the username.

   f. Click OK to add "Symphonyuser01" to the "Symphony-group" user group.

   g. Click Apply and then OK to save the changes.

Step 3 - Integrating Symphony Cluster running on RHEL 8.4 based Systems Directly to AD using Samba Winbind

Step 4 - Configuring setup on the Symphony cluster side

Following are the steps to configure Kerberos Authentication on Linux Hosts for IBM Spectrum Symphony Integration with Active Directory:

1. Shutdown the Cluster

   Log in to any management host in the cluster by using the cluster administrator credentials.

   #Example
   egosh user logon –u Admin –x Admin
   

   Run the following commands to gracefully shut down the cluster:

   #Example
   soamcontrol app disable all
   egosh service stop all
   egosh ego shutdown all
   

2. Modify Security Configuration on Management Hosts: On each management host, edit the $EGO_CONFDIR/ego.conf file.

   Set EGO_SEC_PLUGIN to "sec_ego_gsskrb."

   #Example
   EGO_SEC_PLUGIN=sec_ego_gsskrb
   

   Set EGO_SEC_CONF to specify the plug-in's configuration:

   #Example
   EGO_SEC_CONF="/EGOShare/kernel/conf,600,ERROR,/opt/EGO/kernel/log"
   

   Set EGO_SEC_KRB_SERVICENAME to the Kerberos principal for the authentication server:

   #Example
   EGO_SEC_KRB_SERVICENAME=symphonyuser03
   

   Create or modify the $EGO_CONFDIR/sec_ego_gsskrb.conf file with the provided parameters:

   #Example
   REALM=POCDomain.local
   KRB5_KTNAME=/etc/krb5.keytab
   KERBEROS_ADMIN=egoadmin
   

   KRB5_KTNAME=/etc/krb5.keytab The KRB5_KTNAME parameter designates the absolute path to the keytab file. This file contains keys for the service principal that is used in Kerberos authentication. Here, the path is set to "/etc/krb5.keytab," ensuring that the necessary keys are retrieved for authentication.

   KERBEROS_ADMIN=egoadmin The KERBEROS_ADMIN parameter specifies the Kerberos principal that maps to the user name of the built-in cluster administrator (Admin). In this configuration, it is set to "hpcegoadmin." This principal is significant for administrative tasks within the IBM Spectrum Symphony cluster and is used for authenticating as the cluster administrator.

3. Apply Configuration to Compute and Client Hosts.

   Repeat the modification steps on compute and client hosts, adjusting configurations in their respective $EGO_CONFDIR/ego.conf and $EGO_CONFDIR/sec_ego_gsskrb.conf files.

4. Start the Cluster and Enable Applications.

   Once configurations are applied across hosts, start the cluster and enable applications by using the following commands:

   #Example
   egosh ego start
   soamcontrol app enable appName
   

5. Log on to Cluster Management Host.

   From a management host in the POCDomain.local realm, log in as the Admin user by using the egosh command-line. Enter the password of the Kerberos principal defined in the KERBEROS_ADMIN parameter.

   #Example
   egosh user logon –u Admin –x passwordegoadmin
   

6. Add AD Users (If Required)

   If the ENABLE_AD_USERS_MANAGE parameter in the $EGO_CONFDIR/sec_ego_gsskrb.conf file on Linux management hosts was set to 'N,' use the egosh user add command to add AD users to IBM Spectrum Symphony. Provide any random string as the password; it will not be used for user logon.

   #Example egosh user add –u ad1tester –x 111
   

7. Assign Roles to Users

   Assign roles to the user accounts by using the egosh user assignrole command. For example, to assign the consumer admin role to ad1tester and ad2tester:

   #Example
   egosh user assignrole –u ad1tester –r CONSUMER_ADMIN –p /SymTesting/Symping73.2
   

8. Login as an AD user

   Log in as an AD user by using the egosh command line. For example, to log in as ad1tester:

   #Example
   egosh user logon –u ad1tester –x passwordad1tester
   

Conclusion

This guide serves as a vital resource for system administrators looking to seamlessly integrate IBM Spectrum Symphony with Active Directory within the IBM Cloud environment. Addressing prerequisites and delivering step-by-step instructions, it ensures readiness for both Active Directory and RHEL systems that are deployed on IBM Virtual Servers. From installing Active Directory on Windows Server 2019 to configuring Kerberos authentication, the guide provides administrators with a reliable reference to achieve efficient user management and access control for IBM Spectrum Symphony within the IBM Cloud infrastructure.