Search <book_title>...

Veritas Access Appliance Administrator's Guide

Last Published: 2023-10-29

Product(s): Appliances (8.0)

Platform: Access Appliance OS,Veritas 3340,Veritas 3350

About user management

Access Appliance enables you to add users for administering your appliance. Your privileges within Access Appliance are based on what user role you have been assigned.

The following table provides an overview of the user roles within Access Appliance.

Table: User roles within Access Appliance

User role	Description
Primary	Primary user has all of the permissions including adding and deleting users, displaying users, and managing passwords. Only the primary user can add or delete other administrators.
Vxdefault	A vxdefault user role does not have any privilege. If the user role is not specified while creating the user, then the user is created without any privileges and is termed as a vxdefault user.

You can add local users as well as users from an Active Directory (AD) server and a Lightweight Directory Access Protocol (LDAP) server. The LDAP server should be an OpenLDAP Linux/UNIX server. Access Appliance does not support LDAP users from the AD server. Registering remote users lets you leverage your existing directory service for user management and authentication.

Each user account must authenticate itself with a user name and password to access the appliance. For a local user, the user name and password are managed on the appliance. For a registered remote user, the user name and password are managed by the remote directory service.

To add the different administrator roles, you must have primary privilege. After you assign the primary role to AD and LDAP users, they can also perform cluster management using the GUI, Access CLISH, Appliance CLISH and Restful APIs.

When you add a new user role, remember that:

Any user who has been assigned the primary role can assign the primary role to an AD/LDAP user and groups for managing the configuration.
You can remove the primary role for a given AD/LDAP user and groups.
AD/LDAP users without a primary role can generate S3 keys.
AD/LDAP users can login even after a console failover or HA scenarios.
Domain is an optional argument with the default value as local.
For the local user, only the username is required.
You can assign only the primary role to the LDAP and AD user.
The LDAP username should not be the same as a local username.
For AD, enter domain\\username.
For LDAP, enter username.
Veritas recommends that LDAP, AD, and NIS UIDs start from 10000. Otherwise, when you assign a role to the AD/LDAP user, the UID of the local user may conflict with the UID of a user from the directory server.
Nested LDAP group for role assignment is not supported.

The Support account is reserved for Technical Support use only, and it cannot be created by administrators.

To perform user role management using GUI, see See Adding and removing user roles using GUI.

To perform user management using CLISH, see See Performing user management using CLISH.