Skip to main content

Contents

  1. Preface
  2. Chapter 1 Understanding an Overview of the SPARC M12/M10
    1.  1.1 Basics of the SPARC M12/M10
    2. Click 1.2 Basics of the XSCF Firmware
    3. Click 1.3 Network Configuration
    4.  1.4 Basics of Hypervisor
    5.  1.5 Basics of Oracle VM Server for SPARC
    6.  1.6 Basics of OpenBoot PROM
  3. Chapter 2 Logging In/Out of the XSCF
    1. Click 2.1 Connecting the System Management Terminal
    2. Click 2.2 Logging In to the XSCF Shell
    3.  2.3 Logging Out from the XSCF Shell
    4. Click 2.4 Logging In to XSCF Web
    5.  2.5 Logging Out From XSCF Web
    6.  2.6 Number of Connectable Users
  4. Chapter 3 Configuring the System
    1. Click 3.1 Preliminary Work for XSCF Setup
    2. Click 3.2 Understanding the Contents of the XSCF Firmware Settings
    3.  3.3 Setting Up From the XSCF Shell
    4.  3.4 Setting Up From XSCF Web
    5. Click 3.5 Creating/Managing XSCF Users
    6. Click 3.6 Setting the XSCF Time/Date
    7. Click 3.7 Configuring the SSH/Telnet Service for Login to the XSCF
    8. Click 3.8 Configuring the HTTPS Service for Login to the XSCF
    9. Click 3.9 Configuring the XSCF Network
    10. Click 3.10 Configuring Auditing to Strengthen XSCF Security
  5. Chapter 4 Configuring the System to Suit the Usage Type
    1. Click 4.1 Setting/Checking the System Altitude
    2. Click 4.2 Controlling System Start
    3. Click 4.3 Enabling/Disabling Dual Power Feed
    4. Click 4.4 Reducing Power Consumption
    5. Click 4.5 Connecting a DVD Drive
    6. Click 4.6 Using Remote Storage
  6. Chapter 5 CPU Activation
    1.  5.1 Basic Concepts of CPU Activation
    2.  5.2 CPU Activation Key
    3. Click 5.3 Adding CPU Core Resources
    4. Click 5.4 Deleting CPU Core Resources
    5. Click 5.5 Moving CPU Core Resources
    6. Click 5.6 Displaying CPU Activation Information
    7. Click 5.7 Saving/Restoring CPU Activation Keys
    8. Click 5.8 Troubleshooting CPU Activation Errors
    9.  5.9 Important Notes about CPU Activation
  7. Chapter 6 Starting/Stopping the System
    1. Click 6.1 Starting the System
    2. Click 6.2 Stopping the System
    3.  6.3 Rebooting the System
    4.  6.4 Suppressing Starting Oracle Solaris at Power-on
  8. Chapter 7 Controlling Physical Partitions
    1.  7.1 Configuring a Physical Partition
    2. Click 7.2 Setting the Physical Partition Operation Mode
    3.  7.3 Powering On a Physical Partition
    4.  7.4 Powering Off a Physical Partition
    5.  7.5 Changing the Configuration of a Physical Partition
  9. Chapter 8 Controlling Logical Domains
    1.  8.1 Configuring a Logical Domain
    2. Click 8.2 Configuring the Oracle Solaris Kernel Zone
    3. Click 8.3 Switching to the Control Domain Console From the XSCF Shell
    4. Click 8.4 Returning to the XSCF Shell From the Control Domain Console
    5.  8.5 Starting a Logical Domain
    6.  8.6 Shutting Down a Logical Domain
    7. Click 8.7 Ordered Shutdown of Logical Domains
    8.  8.8 Checking CPU Activation Information
    9. Click 8.9 Setting the OpenBoot PROM Environment Variables of the Control Domain
    10. Click 8.10 Domain Console Logging Function
    11.  8.11 Changing the Configuration of a Logical Domain
    12.  8.12 Setting the Logical Domain Time
    13. Click 8.13 Collecting a Hypervisor Dump File
    14. Click 8.14 Managing Logical Domain Resources Associated with CPU Sockets
    15. Click 8.15 Setting the Physical Partition Dynamic Reconfiguration Policy
    16. Click 8.16 Setting the Maximum Page Size of a Logical Domain
  10. Chapter 9 Managing the Systems Daily
  11. Chapter 10 Preparing/Taking Action for Failures
    1.  10.1 Learning about Troubleshooting and Related Functions
    2. Click 10.2 Receiving Notification by E-mail When a Failure Occurs
    3. Click 10.3 Monitoring/Managing the System Status With the SNMP Agent
    4. Click 10.4 Monitoring the System
    5.  10.5 Understanding the Failure Degradation Mechanism
    6. Click 10.6 Checking Failed Hardware Resources
    7. Click 10.7 Setting Automatic Replacement of Failed CPU Cores
    8.  10.8 Setting Recovery Mode
    9.  10.9 Setting Up a Redundant Component Configuration
    10. Click 10.10 Saving/Restoring XSCF Settings Information
    11. Click 10.11 Saving/Restoring Logical Domain Configuration Information in the XSCF
    12. Click 10.12 Saving/Restoring Logical Domain Configuration Information in an XML File
    13. Click 10.13 Saving/Restoring the OpenBoot PROM Environment Variables
    14.  10.14 Saving/Restoring the Contents of a Hard Disk
    15.  10.15 Resetting a Logical Domain
    16. Click 10.16 Causing a Panic in a Logical Domain
    17.  10.17 Resetting a Physical Partition
    18. Click 10.18 Returning the Server to the State at Factory Shipment
    19.  10.19 Collecting a Crash Dump File Using Deferred Dump
  12. Chapter 11 Checking the System Status
    1. Click 11.1 Checking the System Configuration/Status
    2. Click 11.2 Checking a Physical Partition
  13. Chapter 12 Checking Logs and Messages
    1. Click 12.1 Checking a Log Saved by the XSCF
    2. Click 12.2 Checking Warning and Notification Messages
  14. Chapter 13 Switching to Locked Mode/Service Mode
    1.  13.1 Understanding the Differences Between Locked Mode and Service Mode
    2.  13.2 Switching the Operating Mode
  15. Chapter 14 Configuring a Highly Reliable System
    1. Click 14.1 Configuring Memory Mirroring
    2. Click 14.2 Configuring Hardware RAID
    3.  14.3 Using the LDAP Service
    4.  14.4 Using SAN Boot
    5.  14.5 Using iSCSI
    6. Click 14.6 Remote Power Management for the SPARC M12/M10 and I/O Devices
    7.  14.7 Using an Uninterruptible Power Supply
    8. Click 14.8 Using Verified Boot
  16. Chapter 15 Expanding the System Configuration
    1.  15.1 Changing the Virtual CPU Configuration
    2.  15.2 Changing the Memory Configuration
    3. Click 15.3 Dynamic Reconfiguration Function for PCIe Endpoint Devices
    4. Click 15.4 Using the PCI Expansion Unit
    5.  15.5 Expanding the SPARC M12-2S/M10-4S
  17. Chapter 16 Updating the XCP Firmware
    1. Click 16.1 Basics of Firmware Update
    2. Click 16.2 Before Updating Firmware
    3.  16.3 Update Flow
    4.  16.4 Preparing an XCP Image File
    5. Click 16.5 Updating Firmware
    6.  16.6 Updating Firmware From XSCF Web
    7. Click 16.7 Firmware Version Matching with Parts Addition/Replacement
    8.  16.8 Trouble During Firmware Update
    9.  16.9 FAQ Relating to Firmware Update
  18. Chapter 17 Updating Oracle Solaris and Oracle VM Server for SPARC
  19. Chapter 18 Troubleshooting
    1.  18.1 Troubleshooting for the XSCF
    2.  18.2 Precautions Concerning Using the RESET Switch
    3.  18.3 Frequently Asked Questions / FAQ
    4.  18.4 System Troubleshooting With the XSCF
  20. Appendix A Lists of SPARC M12/M10 System Device Paths
    1.  A.1 SPARC M12-1 Device Paths
    2. Click A.2 SPARC M12-2 Device Paths
    3. Click A.3 SPARC M12-2S Device Paths
    4.  A.4 SPARC M10-1 Device Paths
    5. Click A.5 SPARC M10-4 Device Paths
    6. Click A.6 SPARC M10-4S Device Paths
  21. Appendix B Identifying an SAS2 Device Based on a WWN
    1.  B.1 World Wide Name (WWN) Syntax
    2.  B.2 Overview of probe-scsi-all Command Output
    3. Click B.3 Identifying a Disk Slot by Using the probe-scsi-all Command
    4. Click B.4 Identifying Disk Slot
  22. Appendix C List of the XSCF Web Pages
    1.  C.1 Overview of the Pages
    2.  C.2 Understanding the Menu Configuration
    3. Click C.3 Available Pages
  23. Appendix D XSCF MIB Information
    1.  D.1 MIB Object Identification
    2.  D.2 Standard MIB
    3. Click D.3 Extended MIB
    4.  D.4 Traps
  24. Appendix E SPARC M12/M10 System-specific Functions of Oracle VM Server for SPARC
    1.  E.1 Ordered Shutdown of Logical Domains
    2.  E.2 CPU Activation Support
    3. Click E.3 Checking Failed Resources
    4.  E.4 Automatic Replacement of Failed CPUs
    5.  E.5 Hypervisor Dump
    6.  E.6 Domain Console Logging Function
    7.  E.7 CPU Socket Restrictions
  25. Appendix F SAS2IRCU Utility Command Examples
    1.  F.1 Displaying a List of SAS Controllers Recognized by sas2ircu
    2.  F.2 Displaying the Information of a Hardware RAID Volume
    3.  F.3 Adding a Hardware RAID Volume
    4.  F.4 Displaying the Configuration Status of a Hardware RAID Volume
    5.  F.5 Creating a Hot Spare of a Hardware RAID Volume
    6.  F.6 Deleting a Hot Spare of a Hardware RAID Volume
    7.  F.7 Deleting a Hardware RAID Volume
    8.  F.8 Identifying the Faulty Disk Drive of a Hardware RAID Volume
  26. Appendix G SPARC M12-1/M10-1 XSCF Startup Mode Function
    1. Click G.1 Function Overview
    2. Click G.2 Restrictions and Notes
    3.  G.3 Configuration Procedure
  27. Appendix H OpenBoot PROM Environment Variables and Commands
    1.  H.1 SCSI Device Display
    2.  H.2 Unsupported OpenBoot PROM Environment Variables
    3.  H.3 Unsupported OpenBoot PROM Commands
    4.  H.4 Behavior With the Security Mode Enabled
  28. Appendix I How to Specify the Boot Device
    1.  I.1 Device Path of the Internal Storage
    2.  I.2 Method of Specification With a PHY Number
    3.  I.3 Method of Specification With a Target ID
    4.  I.4 Method of Specification With an SAS Address
    5.  I.5 Method of Specification With a Volume Device Name
    6.  I.6 Notes About the Device Alias net of the SPARC M12 Without On-Board LAN
  29. Appendix J Lists of DVD Drive Aliases
    1. Click J.1 External DVD Drive Aliases
    2. Click J.2 Remote Storage DVD Drive Aliases
  30. Appendix K CPU Activation Interim Permit
    1.  K.1 What is the CPU Activation Interim Permit?
    2.  K.2 Terms of Use of the CPU Activation Interim Permit and Precautions
    3. Click K.3 Related Commands
    4. Click K.4 Flows and Procedures for Using a CPU Activation Interim Permit
    5. Click K.5 Event Notification of the CPU Activation Interim Permit
    6. Click K.6 Other Important Notes

3.5.13 Managing XSCF User Accounts Using Active Directory


3.5.13 Managing XSCF User Accounts Using Active Directory
In the Active Directory settings, items related to an Active Directory client are set. The settings cover the Active Directory server, loading of a server certificate, group name, user privilege, user domain, log, DNS locator query, and so on. In the Active Directory server, the XSCF user information is managed.
The available characters for a user account name for XSCF login are lowercase alphabetic characters, numbers, the hyphen (-), the underscore (_), and the period (.). The name is a combination of up to 31 characters. Uppercase alphabetic characters cannot be used. The first character of the name must be a lowercase alphabetic character.
Even though you can log in using a user account name not fitting the above description, your commands may not work normally. For this reason, use the above-described user account name.
Note - This section does not describe the configuration and management of the Active Directory server. An administrator who is familiar with the Active Directory server should design the Active Directory server.
Note - For the XCP firmware version that supports Active Directory, see the latest Product Notes for your server.
Table 3-14 lists terms related to the Active Directory settings.
Table 3-14  Terms Related to Active Directory
Term Description
Active Directory Active Directory is a distributed directory service that was developed by Microsoft Corporation and is available in Windows operating systems. Like LDAP directory service, it is used for user authentication.
User domain User domain is the authentication domain used to authenticate a user.
DNS locator query The query is used to query a DNS server about the Active Directory server for user authentication.
The Active Directory provides both user certificate authentication and authorization of a user access level to network resources. The Active Directory uses the authentication to identify specific users before they access the system resources, and to grant specific access privileges to users in order to control their rights to access network resources.

User privileges are either configured on the XSCF or obtained from a server in a network domain based on each user's group membership. A user can belong to more than one group. User domain is the authentication domain used to authenticate a user. The Active Directory authenticates users in the order in which the user domains are configured.

Once authenticated, user privileges can be determined in the following ways:
  1. In the simplest case, user privileges are determined by the Active Directory settings on the XSCF. There is a defaultrole parameter for the Active Directory. If the defaultrole parameter is configured or set, all users that are authenticated via the Active Directory are assigned the user privileges set in the parameter. Users that are set on the Active Directory server require only a password regardless of their group membership.
  2. If the defaultrole parameter is not configured or set, a user privilege is obtained from the Active Directory server based on the user's group membership. On the XSCF, the group parameter must correspond to the group name of an Active Directory server. Each group has a user privilege that is configured on the XSCF and is associated with the group. Once a user is authenticated, the user's group membership is used to determine the user privilege.
Active directory setting items and shell commands to be used
Table 3-15 lists the setting items and the corresponding shell commands.
Table 3-15  Active Directory Related Setting Items and Commands to be Used
Setting Item Function Description Shell Command Remarks
Active Directory status display Displays the current status of the Active Directory, such as enable/disable of the Active Directory and DNS locator mode. showad  
Active Directory usage enable/disable Specifies whether to enable or disable the use of the Active Directory server for managing authentication and user privileges. setad It is disabled by default.
Active Directory server display Displays the configuration of the primary Active Directory server or up to five alternate Active Directory servers. showad A port number "0" indicates that the default port for the Active Directory is used.
Active Directory server/port Specifies IP addresses and port numbers of the primary and up to five alternate Active Directory servers.
Specifies IP addresses or host names for the addresses.
To specify host names for the Active Directory servers, the server names must be resolvable by the DNS server.		 setad When a port number is not specified, the default port is used.
Server certificate load/delete Loads or deletes the certificates of the primary and up to five alternate servers. setad The strictcertmode must be in the disabled state for a certificate to be removed.
DNS locator mode enable/disable Enables or disables the DNS locator mode. setad It is disabled by default.
DNS locator query display Displays the configuration of up to five DNS locator queries. showad  
DNS locator query Configures the DNS locator query.
The DNS locator query is used to query a DNS server to determine an Active Directory server to use for user authentication.		 setad DNS and DNS locator mode must be enabled for the DNS locator query to work.
Expanded search mode enable/disable Enables or disables the expanded search mode.
The expanded search mode is only enabled when addressing a specific environment where the user account is not in the UserPrincipalName (UPN) format.		 setad It is disabled by default.
strictcertmode enable/disable Enables or disables the strictcertmode.
If the strictcertmode is enabled, the certificate of a server must have already been uploaded to the server so that the certificate signatures can be validated when the server certificate is presented.		 setad It is disabled by default.
Server certificate display Displays the following:
- Certificate information for the primary and up to five alternate servers.

- Entire contents of the certificate
 showad  
User domain display Displays user domains. showad  
User domain Configures up to five specified user domains. Specify a user domain in the UPN format, where a user name and domain name are connected using the "@" symbol, or in the Distinguished Name (DN) format, which is defined as "uid = user name, ou = organization unit, and dc = domain name." setad If a user domain is directly specified using the UPN form at the login prompt, such as "login: ima.admin@dc01.example.com", the user domain is used only for this login.
defaultrole display Displays the defaultrole setting. showad  
defaultrole Specifies the user privileges assigned to all users that are authenticated via Active Directory. setad  
Group display Displays the configuration of administrator group, operator group, and custom group. showad  
Administrator group Assigns group names for up to five administrator groups. The administrator group has platadm, useradm, and auditadm privileges. These privileges cannot be changed. setad  
Operator group Assigns group names for up to five operator groups. The operator group has platop and auditop privileges. These privileges cannot be changed. setad  
Custom group Assigns group names and user privileges for up to five groups. setad  
Timeout Configures transaction timeout in seconds.
You can specify a numeric value from 1 to 20.		 setad The default value is 4 seconds. If a specified timeout is too short for the configuration, the login process or retrieval of the user privilege setting could fail.
Log enable/disable Enables or disables the logging of Active Directory authentication and authorization diagnosis messages. setad This log is cleared when the XSCF is rebooted.
Log display Displays Active Directory authentication and authorization diagnosis messages. showad  
Log clear Clears the logs of Active Directory authentication and authorization diagnosis messages. setad  
Default Resets the Active Directory settings to their factory defaults. setad  
Before configuring the Active Directory settings
Note the following before configuring the Active Directory settings.
  1. Confirm that the XCP version that supports Active Directory is used. For the XCP that supports Active Directory, see the latest Product Notes.
  2. The useradm user privilege is required for the Active Directory settings.
  3. If the XSCF is configured to use LDAP, Active Directory, or LDAP over SSL for user account data, then the user account name and user identifier (if specified) must not already be in use in the XSCF, LDAP, Active Directory, or LDAP over SSL.
  4. To use a host name for an Active Directory server, DNS settings need to be configured properly before setting Active Directory.
  5. In Active Directory, the system account called proxyuser is used. Verify that no user account with that name already exists. If a user account with the name proxyuser exists, then delete the account with the deleteuser command. After deleting the account, reboot the XSCF before using Active Directory.
  6. If Active Directory is enabled and you try to login via telnet, inquiries to the second and subsequent alternate servers may time out, causing the login to fail.
  7. If the value set by the timeout operand is small, and you log in to the XSCF, user privilege may not be assigned to you. In this case, increase the timeout setting value and try again.
  8. If you are an Active Directory user, you cannot upload a user public key to the XSCF. The Active Directory users can login by connecting to the XSCF via SSH using password authentication.
Enabling or disabling the use of an Active Directory Server
  1. Execute the showad command to display the usage of the Active Directory server.
XSCF> showad
dnslocatormode: disabled
expsearchmode: disabled
state: disabled
strictcertmode: disabled
timeout: 4
logdetail: none
  1. Execute the setad command to enable/disable the use of the Active Directory server.
    In the following example, the use of the Active Directory server is enabled.
XSCF> setad enable
  1. In the following example, the use of the Active Directory server is disabled.
XSCF> setad disable
  1. Execute the showad command, and check whether Active Directory is enabled or disabled.
    In the following example, the Active Directory is enabled.
XSCF> showad
dnslocatormode: disabled
expsearchmode: disabled
state: enabled
strictcertmode: disabled
timeout: 4
logdetail: none
Setting Active Directory servers and port numbers
  1. Execute the showad command to display the Active Directory server settings.
XSCF> showad server
Primary Server
address: (none)
port: 0
XSCF> showad server -i
Alternate Server 1
address: (none)
port: 0
Alternate Server 2
address: (none)
port: 0
Alternate Server 3
address: (none)
port: 0
Alternate Server 4
address: (none)
port: 0
Alternate Server 5
address: (none)
port: 0
  1. Execute the setad command to set Active Directory servers.
    In the following example, the primary server and port number are specified.
XSCF> setad server 10.24.159.150:8080
  1. In the following example, alternate servers are specified.
XSCF> setad server -i 1 10.24.159.151
  1. Execute the showad command, and confirm the Active Directory server settings.
XSCF> showad server
Primary Server
address: 10.24.159.150
port: 8080
XSCF> showad server -i
Alternate Server 1
address: 10.24.159.151
port: 0
Alternate Server 2
address: (none)
port: 0
Alternate Server 3
address: (none)
port: 0
Alternate Server 4
address: (none)
port: 0
Alternate Server 5
address: (none)
port: 0
Loading/Deleting the Server Certificate
  1. Execute the showad command to display the server certificate information.
XSCF> showad cert
Primary Server:
certstatus = certificate not present
issuer = (none)
serial number = (none)
subject = (none)
valid from = (none)
valid until = (none)
version = (none)

XSCF> showad cert -i
Alternate Server 1:
certstatus = certificate not present
issuer = (none)
serial number = (none)
subject = (none)
valid from = (none)
valid until = (none)
version = (none)

Alternate Server 2:
... <snip>

Alternate Server 5:
certstatus = certificate not present
issuer = (none)
serial number = (none)
subject = (none)
valid from = (none)
valid until = (none)
version = (none)
  1. Execute the setad command to load the server certificate to the XSCF.
    In the following example, the server certificate of the primary server is loaded using the user name and password.
XSCF> setad loadcert -u yoshi http://domain_2/UID_2333/testcert
Warning: About to load certificate for Primary Server.
Continue? [y|n]: y
Password:
  1. In the following example, the content of the certificate is copied and pasted on the screen, and then the certificate for the alternate server 1 is loaded from a console. After pressing the [Enter] key, press the [Ctrl] and [D] keys to complete loading.
XSCF> setad loadcert console
Warning: About to load certificate for Alternate Server 1:
Continue? [y|n]: y
Please enter the certificate:
-----BEGIN CERTIFICATE-----

MIIETjCCAzagAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJVUzET
MBEGA1UECBMKQ2FsaWZvcm5pYTESMBAGA1UEBxMJU2FuIERpZWdvMRkwFwYDVQQK
ExBTdW4gTWljcm9zeXN0ZW1zMRUwEwYDVQQLEwxTeXN0ZW0gR3JvdXAxEjAQBgNV
...
-----END CERTIFICATE-----

[Enter]
[Ctrl]+[D]
  1. Execute the showad command, and confirm that the server certificate has been loaded.
XSCF> showad cert
Primary Server:
certstatus = certificate present
issuer = DC = local, DC = xscf, CN = apl
serial number = 55:1f:ff:c4:73:f7:5a:b9:4e:16:3c:fc:e5:66:5e:5a
subject = DC = local, DC = xscf, CN = apl
valid from = Mar 9 11:46:21 2010 GMT
valid until = Mar 9 11:46:21 2015 GMT
version = 3 (0x02)

XSCF> showad cert -i 1
Alternate Server 1:
certstatus = certificate present
issuer = DC = local, DC = aplle, CN = aplle.local
serial number = 0b:1d:43:39:ee:4b:38:ab:46:47:de:0a:b4:a9:ea:04
subject = DC = local, DC = aplle, CN = aplle.local
valid from = Aug 25 02:38:15 2009 GMT
valid until = Aug 25 02:44:48 2014 GMT
version = 3 (0x02)
  1. Execute the setad command to delete the primary server certificate.
XSCF> setad rmcert
Warning: About to delete certificate for Primary Server.
Continue? [y|n]: y
  1. Execute the showad command, and confirm that the server certificate has been deleted.
XSCF> showad cert
Primary Server:
certstatus = certificate not present
issuer = (none)
serial number = (none)
subject = (none)
valid from = (none)
valid until = (none)
version = (none)
  1. The strictcertmode must be in the disabled state for a certificate to be removed.
Enabling/disabling the DNS locator mode
  1. Execute the showad command to display whether the DNS locator mode is enabled or disabled.
XSCF> showad
dnslocatormode: disabled
expsearchmode: disabled
state: enabled
strictcertmode: disabled
timeout: 4
logdetail: none
  1. Execute the setad command to enable/disable the DNS locator mode.
    In the following example, the DNS locator mode is enabled.
XSCF> setad dnslocatormode enable
  1. In the following example, the DNS locator mode is disabled.
XSCF> setad dnslocatormode disable
  1. Execute the showad command, and confirm that the DNS locator mode is enabled/disabled.
    In the following example, the DNS locator mode is enabled.
XSCF> showad
dnslocatormode: enabled
expsearchmode: disabled
state: enabled
strictcertmode: disabled
timeout: 4
logdetail: none
Configuring the DNS locator query
Note - Before setting DNS locator query, enable DNS locator mode.
  1. Execute the showad command to display the configuration of the DNS locator query.
XSCF> showad dnslocatorquery -i 1
service 1: (none)
XSCF> showad dnslocatorquery -i 2
service 2: (none)
  1. Execute the setad command to configure the DNS locator query.
XSCF> setad dnslocatorquery -i 1 '_ldap._tcp.gc._msdcs..'
  1. Execute the showad command, and confirm the DNS locator query.
XSCF> showad dnslocatorquery -i 1
service 1: _ldap._tcp.gc._msdcs..
  1. DNS and DNS locator mode must be enabled for the DNS locator query to work.
Enabling/disabling the expanded search mode
  1. Execute the showad command to display whether the expanded search mode is enabled or disabled.
XSCF> showad
dnslocatormode: enabled
expsearchmode: disabled
state: enabled
strictcertmode: disabled
timeout: 4
logdetail: none
  1. Execute the setad command to enable/disable the expanded search mode.
    In the following example, the expanded search mode is enabled.
XSCF> setad expsearchmode enable
  1. In the following example, the expanded search mode is disabled.
XSCF> setad expsearchmode disable
  1. Execute the showad command, and confirm that the expanded search mode is enabled/disabled.
    In the following example, the expanded search mode is enabled.
XSCF> showad
dnslocatormode: enabled
expsearchmode: enabled
state: enabled
strictcertmode: disabled
timeout: 4
logdetail: none
Enabling/Disabling the strictcertmode
  1. Execute the showad command to display whether the strictcertmode is enabled or disabled.
XSCF> showad
dnslocatormode: enabled
expsearchmode: enabled
state: enabled
strictcertmode: disabled
timeout: 4
logdetail: none
  1. Execute the setad command to enable/disable the strictcertmode.
    In the following example, the strictcertmode is enabled.
XSCF> setad strictcertmode enable
  1. In the following example, the strictcertmode is disabled.
XSCF> setad strictcertmode disable
  1. Execute the showad command, and confirm that the strictcertmode is enabled/disabled.
    In the following example, the strictcertmode is enabled.
XSCF> showad
dnslocatormode: enabled
expsearchmode: enabled
state: enabled
strictcertmode: enabled
timeout: 4
logdetail: none
  1. To enable the strictcertmode, the server certificate must have already been loaded to the XSCF.
Setting a User Domain
  1. Execute the showad command to display user domains.
XSCF> showad userdomain
domain 1: (none)
domain 2: (none)
domain 3: (none)
domain 4: (none)
domain 5: (none)
  1. Execute the setad command to set user domains.
    In the following example, user domain 1 is set.
XSCF> setad userdomain -i 1 '@davidc.example.aCompany.com'
  1. In the following example, user domain 2 is set.
XSCF> setad userdomain -i 2 'CN=<USERNAME>,CN=Users,DC=davidc,DC=example,DC=aCompany,DC=com'
  1. Execute the showad command, and confirm the user domains.
XSCF> showad userdomain
domain 1: <USERNAME>@davidc.example.aCompany.com
domain 2: CN=<USERNAME>,CN=Users,DC=davidc,DC=example,DC=aCompany,DC=com
domain 3: (none)
domain 4: (none)
domain 5: (none)
  1. If a user domain is directly specified at the login prompt, such as "login: ima.admin@dc01.example.com", the user domain is used only for this login.
Setting the Default Privilege
  1. Execute the showad command to display the default privilege.
XSCF> showad defaultrole
Default role: (none)
  1. Execute the setad command to set a default privilege.
XSCF> setad defaultrole platadm platop
  1. Execute the showad command, and confirm the default privilege.
XSCF> showad defaultrole
Default role: platadm platop
Setting Group Names and Privileges
  1. Execute the showad command to display group names.
    The following example shows administrator groups.
XSCF> showad group administrator
Administrator Group 1
name: (none)
Administrator Group 2
name: (none)
Administrator Group 3
name: (none)
Administrator Group 4
name: (none)
Administrator Group 5
name: (none)
  1. The following example shows operator groups.
XSCF> showad group operator
Operator Group 1
name: (none)
Operator Group 2
name: (none)
Operator Group 3
name: (none)
Operator Group 4
name: (none)
Operator Group 5
name: (none)
  1. The following example shows custom groups.
XSCF> showad group custom
Custom Group 1
name: (none)
roles: (none)
Custom Group 2
name: (none)
roles: (none)
Custom Group 3
name: (none)
roles: (none)
Custom Group 4
name: (none)
roles: (none)
Custom Group 5
name: (none)
roles: (none)
  1. Execute the setad command to set the group names and privileges.
    In the following example, administrator group 1 is set.
XSCF> setad group administrator -i 1 name CN=SpSuperAdmin,OU=Groups,DC=davidc,DC=example,DC=aCompany,DC=com
  1. In the following example, operator group 1 is set.
XSCF> setad group operator -i 1 name CN=OpGroup1,OU=SCFTEST,DC=aplle,DC=local
  1. In the following example, custom group 1 is set.
XSCF> setad group custom -i 1 name CN=CtmGroup1,OU=SCFTEST,DC=aplle,DC=local
  1. In the following example, the privilege of the custom group 1 is set.
XSCF> setad group custom -i 1 roles platadm,platop
  1. Execute the showad command, and confirm the group names and privileges.
    In the following example, the administrator groups are confirmed.
XSCF> showad group administrator
Administrator Group 1
name: CN=<USERNAME>,CN=SpSuperAdmin,OU=Groups,DC=davidc,DC=example,DC=aCompany,DC=com
Administrator Group 2
name: (none)
Administrator Group 3
name: (none)
Administrator Group 4
name: (none)
Administrator Group 5
name: (none)
  1. In the following example, the operator groups are confirmed.
XSCF> showad group operator
Operator Group 1
name: CN=OpGroup1,OU=SCFTEST,DC=aplle,DC=local
Operator Group 2
name: (none)
Operator Group 3
name: (none)
Operator Group 4
name: (none)
Operator Group 5
name: (none)
  1. In the following example, the custom groups are confirmed.
XSCF> showad group custom
Custom Group 1
name: CN=CtmGroup1,OU=SCFTEST,DC=aplle,DC=local
roles: platadm platop
Custom Group 2
name: (none)
roles: (none)
Custom Group 3
name: (none)
roles: (none)
Custom Group 4
name: (none)
roles: (none)
Custom Group 5
name: (none)
roles: (none)
  1. The administrator group has platadm, useradm, and auditadm privileges. These privileges cannot be changed. The operator group also has platop and auditop privileges. These privileges cannot be changed.
Setting a Timeout
  1. Execute the showad command to display the timeout time.
XSCF> showad
dnslocatormode: enabled
expsearchmode: enabled
state: enabled
strictcertmode: enabled
timeout: 4
logdetail: none
  1. Execute the setad command to set the timeout.
    In the following example, 10 seconds are set as the timeout time.
XSCF> setad timeout 10
  1. Execute the showad command, and confirm the timeout time.
XSCF> showad
dnslocatormode: enabled
expsearchmode: enabled
state: enabled
strictcertmode: enabled
timeout: 10
logdetail: none
Enabling/disabling the logs of Active Directory authentication and authorization diagnosis messages
  1. Execute the showad command to display the log detail level.
XSCF> showad
dnslocatormode: enabled
expsearchmode: enabled
state: enabled
strictcertmode: enabled
timeout: 10
logdetail: none
  1. Execute the setad command to set the log detail level.
    In the following example, the log is enabled and the log detail level is set to trace.
XSCF> setad logdetail trace
  1. In the following example, the log is disabled.
XSCF> setad logdetail none
  1. Execute the showad command, and confirm the log detail level.
    In the following example, the log detail level is set to trace.
XSCF> showad
dnslocatormode: enabled
expsearchmode: enabled
state: enabled
strictcertmode: enabled
timeout: 10
logdetail: trace
Displaying the Log of Diagnosis Messages and Clearing the Log File
  1. Execute the showad command to display the log detail level.
XSCF> showad
dnslocatormode: enabled
expsearchmode: enabled
state: enabled
strictcertmode: enabled
timeout: 10
logdetail: trace
  1. Execute the showad command to display the diagnosis messages.
    In the following example, diagnosis messages are displayed in real time.
XSCF> showad log -f
Mon Nov 16 14:47:53 2009 (ActDir): module loaded, OPL
Mon Nov 16 14:47:53 2009 (ActDir): --error-- authentication status:
auth-ERROR
Mon Nov 16 14:48:18 2009 (ActDir): module loaded, OPL
:
  1. Execute the setad command to clear the log file of diagnosis messages.
XSCF> setad log clear
Warning: About to clear log file.
Continue? [y|n]: y
Resetting the Active Directory Settings to Their Defaults
  1. Execute the showad command to display the setting status of the Active Directory.
XSCF> showad
dnslocatormode: enabled
expsearchmode: enabled
state: enabled
strictcertmode: enabled
timeout: 10
logdetail: trace
  1. Execute the setad command to reset the Active Directory settings to their defaults.
XSCF> setad default -y
Warning: About to reset settings to default.
Continue? [y|n]: y
  1. Execute the showad command, and confirm that the Active Directory settings are reset to their defaults.
XSCF> showad
dnslocatormode: disabled
expsearchmode: disabled
state: disabled
strictcertmode: disabled
timeout: 4
logdetail: none
Logging In With the Active Directory User Account
After completing each setting, confirm whether login with the user account of Active Directory is possible.

Top of Page