How to use a local user instead of a domain user for adding and monitoring clusters in AIQUM 9.12 and above?
Applies to
- ActiveIQ Unified Manager (AIQUM) 9.12+
- All OS platform
- ONTAP Domain users
Description
From AIQUM 9.12 onwards, only local users with admin roles can be used to add a cluster from GUI. Domain users cannot be configured for cluster acquisition through the GUI.
- Up through and including AIQUM 9.10, the requirements for the user configured for cluster acquisition were:
user must have theadmin
role with application access set toontapi,ssh and http
- From AIQUM 9.11 onwards, it changed to:
user must have theadmin
role with application access set toontapi,console and http
- Starting in AIQUM 9.12, mTLS was introduced as part of security compliance.
- mTLS management requires
console
access. - Domain users in ONTAP cannot be given console access.
- This prevents users that don't have
console
access from being used as the collection account for cluster acquisition, if configured through the UM GUI. - Using domain credentials for adding/reconfiguring clusters fails in the GUI with an error message:
"Failed to login to the cluster"
ocumserver.log
shows "wrong username and password
", despite the credentials being correct.
- mTLS management requires