Veritas NetBackup™ Security and Encryption Guide

To add an AD domain or an LDAP domain in NetBackup

1. Run the following command to add an AD domain or an LDAP domain in the NetBackup master server:

   vssat addldapdomain -d DomainName -s server_URL 
   -u user_base_DN -g group_base_DN [-f trusted_CA_file_name] [-t rfc2307 | msad | 
   {-c user_object_class -a user_attribute -q user_GID_attribute 
   -un user_display_name_attribute -ui user_ID_attribute[:value_type] 
   -ud user_description_attribute -x group_object_class -y group_attribute 
   -z group_GID_attribute -gn group_display_name_attribute 
   -gi group_ID_attribute[:value_type] -gd group_description_attribute 
   [-k DN | UID]]} [-b FLAT | BOB] -m admin_user_DN [-w admin_user_password] 
   [-p SUB | ONE | BASE]

   Note:

   Ensure that the user that is specified in the -m option has the required rights to query the AD or LDAP server.

   Use the -f to add the CA certificate in the Authentication Service (nbatd) trust store.

   In case of LDAPS, if the Authentication Service (nbatd) does not trust the certificate authority (CA) that has signed the server's certificate, use the -f option to add the CA certificate in the nbatd trust store.

   See Certificate authorities trusted by the NetBackup Authentication Service.

   For more information on the vssat command, see the NetBackup Commands Reference Guide.

   http://www.veritas.com/docs/DOC5332

   An example to add an LDAP domain:

   vssat addldapdomain -d nbudomain -s ldap://example.com -u "OU=Users,DC=example,DC=com" 
   -g "OU=Groups,DC=example,DC=com" -m "CN=TestUser,OU=Users,DC=example,DC=com" -t msad

2. Run the vssat validateprpl command to verify whether the specified AD or LDAP domain is successfully added or not.

   For more information on the command, see the NetBackup Commands Reference Guide.

   http://www.veritas.com/docs/DOC5332

   If the AD or LDAP domain is added and the vssat validateprpl or vssat validategroup command fails, you need to carry out certain troubleshooting steps to resolve the issue.

   See Troubleshooting AD or LDAP domain configuration issues .