NS0-157 · Question #59
A customer has two SVMs joined to separate Active Directory domains. SVM1 is joined to domain AD1 and SVM2 is joined to domain AD2. The administrator enables Active Directory access to allow certain…
The correct answer is A. The user account belongs to the domain that is not used for cluster access authentication. D. The Active Directory user account is not added to the cluster as a user. E. The user is not a member of an Active Directory group that is allowed access to the cluster. ONTAP cluster AD authentication requires users to belong to the configured authentication domain, be explicitly added as cluster login accounts or members of an allowed AD group - missing any of these conditions blocks access.
Question
A customer has two SVMs joined to separate Active Directory domains. SVM1 is joined to domain AD1 and SVM2 is joined to domain AD2. The administrator enables Active Directory access to allow certain domain users access to the cluster using their Active Directory credentials. After enabling, some users report the inability to log into the cluster using their Active Directory credentials. What are three reasons this happened? (Choose three.)
Options
- AThe user account belongs to the domain that is not used for cluster access authentication.
- BThe cluster time is off by two minutes from the Active Directory time server.
- CThe authentication tunnel was deleted and access sessions were disconnected.
- DThe Active Directory user account is not added to the cluster as a user.
- EThe user is not a member of an Active Directory group that is allowed access to the cluster.
How the community answered
(35 responses)- A54% (19)
- B11% (4)
- C34% (12)
Why each option
ONTAP cluster AD authentication requires users to belong to the configured authentication domain, be explicitly added as cluster login accounts or members of an allowed AD group - missing any of these conditions blocks access.
ONTAP cluster AD authentication is bound to a single configured domain tunnel; a user whose account belongs to a different domain (e.g., AD2 when only AD1 is configured for cluster access) will be rejected because ONTAP cannot validate credentials against an unconfigured domain.
Kerberos (used by AD authentication) tolerates a maximum clock skew of 5 minutes by default; a 2-minute difference between the cluster and the AD time server is within tolerance and would not cause authentication failures.
An authentication tunnel deletion affects SVM-level AD authentication routing, but cluster-level AD login failures are governed by the security login configuration and domain membership, not the tunnel state.
AD users are not automatically granted cluster access upon enabling AD authentication - each user must be explicitly provisioned via 'security login create' with the application and authentication method, so any AD user without a matching cluster login entry will fail.
When cluster access is granted to an AD group, only members of that specific group inherit the access role; holding a valid AD account in the domain or belonging to a different AD group does not implicitly grant cluster login rights.
Concept tested: ONTAP cluster Active Directory user and group login configuration
Source: https://docs.netapp.com/us-en/ontap/authentication/grant-access-active-directory-users-groups-task.html
Topics
Community Discussion
No community discussion yet for this question.