How to use a local user instead of a domain user for adding and monitoring clusters in AIQUM 9.12 and above?
- Views:
- 2,714
- Visibility:
- Public
- Votes:
- 0
- Category:
- active-iq-unified-manager
- Specialty:
- om
- Last Updated:
- 4/17/2025, 10:08:36 AM
Applies to
- ActiveIQ Unified Manager (AIQUM) 9.12+
- All OS platform
- ONTAP Domain users
Description
From AIQUM 9.12 onwards, only local users with admin roles can be used to add a cluster from GUI. Domain users cannot be configured for cluster acquisition through the GUI.
- Up through and including AIQUM 9.10, the requirements for the user configured for cluster acquisition were:
user must have theadmin
role with application access set toontapi,ssh and http
- From AIQUM 9.11 onwards, it changed to:
user must have theadmin
role with application access set toontapi,console and http
- Starting in AIQUM 9.12, mTLS was introduced as part of security compliance.
- mTLS management requires
console
access. - Domain users in ONTAP cannot be given console access.
- This prevents users that don't have
console
access from being used as the collection account for cluster acquisition, if configured through the UM GUI. - Using domain credentials for adding/reconfiguring clusters fails in the GUI with an error message:
"Failed to login to the cluster"
ocumserver.log
shows "wrong username and password
", despite the credentials being correct.
- mTLS management requires