Veritas NetBackup™ Appliance Commands Reference Guide
- Overview
- Appendix A. Main > Appliance commands
- Appendix B. Main > Manage > FibreChannel commands
- Appendix C. Main > Manage > HighAvailability commands
- Appendix D. Main > Manage > Libraries commands
- Appendix E. Main > Manage > Libraries > Advanced > ACS commands
- Appendix F. Main > Manage > License commands
- Appendix G. Main > Manage > MountPoints commands
- Appendix H. Main > Manage > NetBackup CLI commands
- Appendix I. Main > Manage > OpenStorage commands
- Appendix J. Main > Manage > Software commands
- Appendix K. Main > Manage > Storage commands
- Appendix L. Main > Manage > Tapes commands
- Appendix M. Main > Monitor commands
- Appendix N. Main > Network commands
- Appendix O. Main > Network > Security commands (DeviceCert)
- Appendix P. Main > Reports commands
- Appendix Q. Main > Settings commands
- Appendix R. Main > Settings > Alerts commands
- Appendix S. Main > Settings > Notifications view commands
- Appendix T. Main > Settings > Security commands
- Appendix U. Main > Support commands
Name
Main > Settings > Security > Authentication > SmartCard — - Configure and manage authentication in the NetBackup Appliance Web Console with smart cards.
SYNOPSIS
Configure
Disable
Enable
Show
DESCRIPTION
You can use the SmartCard command to perform the following tasks:
Configure the mapping between the identities in the client digital certificates stores on smart cards and the identities on the appliance. Optionally, you can override the Online Certificate Status Protocol (OCSP) responder that is stored in the client certificates.
Disable smart card authentication. This command allows you to turn off the feature but does not change any other settings in DNS, Certificate Authority (CA) certificates, LDAP, or SmartCard. You can use the enable command to re-enable the smart card authentication immediately.
Enable the smart card authentication. If DNS, CA, LDAP, and the SmartCard Configure MappingAttribute and OCSP URI have been set, authentication with smart cards is enabled.
Show the options for the mapping attribute and OCSP URI. It also displays the status of the feature as Enabled or Disabled.
Note:
These commands are specific to smart card authentication but are not sufficient to enable smart card authentication.
See the NetBackup Appliance Security Guide for complete details.
For instructions on logging in to the appliance web console with a smart card, see the topic "Logging into the NetBackup Appliance Web Console" in the NetBackup Appliance Administrator's Guide.
OPTIONS
The following commands and options are available under Authentication > SmartCard:
- Configure MappingAttr CN/UPN
If Common Name (CN) is chosen, the CN in the certificate must match the CN field of a user record in the remote database. For OpenLDAP, the UID in that record is retrieved as the username on the appliance. If ActiveDirectory is the remote database, the SAM account name is retrieved. If the username that is retrieved matches an authorized user on the appliance, the login of that user is successful.
If User Principal Name (UPN) is chosen, the Subject Alternative Name or the Principal Name of the certificate is used. For ActiveDirectory, if the UPN field of a user record matches, the SAM account name is retrieved as the username on the appliance. For OpenLDAP, the username of the UPN (the portion to the left of the "@" symbol) should match the UID of a user record in the database. and the UID is the username on the appliance. If the username that is retrieved matches an authorized user on the appliance, login of that user is successful.
- Configure OCSPURI Set
Enter the URI of the OCSP responder. If entered, it overrides the OCSP responder URI in the client certificate. The OCSP URI parameter determines if the certificate on the smart card has been revoked. It is an optional parameter. The URI is an FQDN or IPv4 address. An IPv6 address is not supported for the OCSP URI. The HTTPS protocol is not supported. The URI must begin with http://.
Note:
If authentication with smart card fails even after all the necessary steps have been performed, use the SmartCard > Show command and verify that the parameters, including the OCSP URI (if present) are correct. Verify that a name server which can resolve the OCSP URI is configured in the Network menu by navigating to Network > DNS Show.
- Disable
Disables smart card authentication if it is enabled.
- Enable
Enables smart card authentication. If all the prerequisites for DNS, CA, LDAP, and SmartCard menu Configure commands have been correctly performed, authentication with smart cards is enabled.
- Show
Shows the values of the mapping attribute, OCSP URI, and status of the smart card authentication.
EXAMPLE
The following shows an example of the output for the Show command.
nbapp2b1.SmartCard> Show Smart Card Configuration Status +-------------------------------+---------------------------------+ | Smart Card Authentication | Disabled | +-------------------------------+---------------------------------+ | Certificate Mapping Attribute | UPN | +-------------------------------+---------------------------------+ | OCSP URI | http://ocsp.host.com | +-------------------------------+---------------------------------+