Smarts SAM/IP: Using System Authentication <SYS> for Smarts Domain against Active Directory

Products

• VMware

Issue/Introduction

Provide some information on how to work with LDAP in Smarts

Please note LDAP is not supported by VMware.  This is not part of the GA release of Smarts.
Contact your VMware Account team to engage Professional Services

Symptoms:


Using System Authentication <SYS> for Smarts Domain against Active Directory

Unable to log into Smarts with NT username and password using Active Domain authentication.

Environment

VMware Smart Assurance - SMARTS

Resolution

User is required to use the format <username>@<ActiveDirectoryDomain> when providing credentials if system authentication <SYS> is configured in serverConnect.conf for the Smarts Domain.  Please note that this value is case sensitive.  Using the incorrect case will cause authentication to fail.

If it is uncertain what the exact syntax of either the username or the domain name is, the Active Directory Users and Computers tool will allow this information to be validated.

The format will not necessarily look like an email address and may not match the format used by email addresses in the organization.  For example, if the Username appears as JSmith and the domain appears as CORP, the proper syntax would be JSmith@CORP.  Please validate this syntax if there is any problem logging in.

Additional Information

Smarts authentication is configured in the file <BASEDIR>/smarts/local/conf/serverConnect.conf.
By default Smarts allows system authentication with the following entry.

# This line allows anyone with a valid account on this system to connect a
# console.  Comment it out if you don't want to provide such access.
*:*:<SYS>:Monitor

This entry will give all local accounts on the Smarts server as well as all users in the save Active Directory domain access to login to the Smarts domain in Monitor mode.  This mode has very limited rights.

If there are specific users that need to be granted additional rights, an entry such as the following can be added to serverConnect.conf as well:

*.user1@CORP:<SYS>:All

This example would grant additional rights to a user called 'user1@CORP'.  Be aware that this entry does not grant rights explicitly, but rather allows the user to be granted rights via profiles in the console.