Administrator Guide

Table 14. Dierences Between Authentication Methods
Type Advantages Disadvantages
Active Directory groups
• Good scalability for large environments with
many users; you can quickly add many
administrator accounts to the group. For
example, if a company hires new IT sta, and
the “IT Users” group has access to the group,
no extra action is required on the part of the
group administrator.
• Useful in environments with many PS Series
groups; you can congure all groups to use the
same LDAP authentication server, thus
eliminating the need for maintenance of parallel
sets of local accounts.
• If users are removed from the Active Directory
group, you do not need to update the array’s
list of administrator accounts to revoke access
to the group.
• Active Directory administrator, not PS Series
group administrator, controls which user
accounts are in the group.
• If the Active Directory/LDAP server is
inaccessible, Active Directory accounts cannot
be authenticated and logins will fail.
Active Directory or
RADIUS users
• Good for smaller environments in which only a
few Active Directory or RADIUS accounts are
added.
• PS Series group administrator controls which
user accounts are in the group.
• If users are removed from the Active Directory
group, the accounts remain in the PS Series
group, counting against the maximum number
of user accounts.
• The group administrator must manually remove
unused Active Directory and LDAP accounts.
Local accounts
• Good for environments with a small IT sta, or
in cases where a small number of ad-hoc
accounts are needed.
• PS Series group administrator controls which
accounts are in the group.
• Using Active Directory and RADIUS provides
superior scalability to using local accounts.
• Frequent changes to the roster of
administrator accounts require the group
administrator to make frequent updates.
• If many PS Series groups are in the
environment, parallel sets of administrator
accounts must be created to grant
administrator access to all groups.
Administration Account Attributes
Table 15. Administration Account Attributes describes the elds used in creating or modifying an administration account. You might
nd it benecial to gather the information for the elds before creating an account.
The default administration account (grpadmin) is the only account capable of performing all group operations, and it is also the
account you must use to perform rmware updates.
Table 15. Administration Account Attributes
Attribute Description
Account Name Name of the account, up to 16 alphanumeric characters. These characters are also allowed: period (.),
hyphen (-), and underscore (_). The rst character must be a letter or number. The last character cannot
be a period.
Active Directory account names can be up to 511 ASCII characters.
If you enter user names containing pound signs (#) in the Group Manager CLI, the group only processes
the characters preceding the pound sign; the pound sign, and all characters following it, are treated as a
comment. For example, if you try to create an account named AdminUser#Account, the resulting
account is named AdminUser. The Group Manager GUI does not allow you to input pound signs when
creating user names.
56
About Group-Level Security