Administrator Guide

About Active Directory Groups
In addition to local and RADIUS administration, administrator account sessions can be authenticated using Active Directory. Individual
Active Directory users, or entire Active Directory groups, can be given access to Group Manager using the same levels of access
permission available for local user accounts.
Using Active Directory authentication is useful in large SAN environments in which administrators require access to multiple groups.
By conguring each PS Series group to use the Active Directory server, you do not need to maintain parallel sets of local accounts
for each group.
You can congure the group to authenticate accounts using multiple Active Directory servers; if the primary Active Directory server
is unavailable due to a connection issue, outage, or disaster event, the extra servers will ensure continued Active Directory
authentication of administrator accounts.
You can also use Active Directory authentication as an alternative to RADIUS authentication.
To use Active Directory authentication, you must rst set the group’s authentication type to Active Directory, and add one or more
Active Directory servers. If you are using Active Directory for authentication, you cannot use RADIUS authentication for the group.
You can, however, still create and use locally authenticated user accounts.
Add Active Directory Groups
To add all accounts in an Active Directory group to the list of administrator accounts:
1. Click Group → Group Conguration.
2. Click the Administration tab.
3. In the Accounts and Groups panel, click Add. The Create administration account dialog box opens.
4. Complete the wizard steps to specify the settings for the new account and click Finish.
Add an Active Directory User to the Group
Before an Active Directory (AD) user can use single sign-on (SSO) to automatically log in to the PS Series group, an administrator
must grant that user permission. You perform the same procedure to grant access to AD groups.
1. Click Group → Group Conguration.
2. Click the Administration tab.
3. In the Accounts and Groups panel, click Add. The Create Administration Account wizard opens, showing step 1 – General
Settings.
4. Select Active Directory user. To add an AD group, select Active Directory group. (When using single sign-on, the group name
cannot contain more than 19 characters.)
5. In the General Settings section, specify the user name of the PS Series group for the AD user. Each user name must be unique.
Click the Check name button to make sure the name that you specied is not already in use.
6. Complete the required elds in each remaining step of the wizard until you reach the Summary page.
7. Conrm that the settings are correct and click Finish to create the AD user.
NOTE: If you log in to Windows using your Active Directory credentials, you will be logged in to the PS Series group
automatically without re-authenticating.
Change the Active Directory Group Name
Before you change the name of a PS Series group that has already been congured for single sign-on, Dell recommends that you
leave the current Active Directory (AD) domain, change the group name, and then join the AD domain again using the new name.
NOTE: When using single sign-on, the group name cannot contain more than 19 characters.
About Group-Level Security
67