4.2 Upgrading to OES 2018 SP2 and Deploying NSS AD (Non-Clustered Environment)

NOTE:Beginning with OES 24.4, OES User Rights Map (NURM) is deprecated and removed from OES.

Figure 4-2 Upgrading to OES 2018 SP2 and Deploying NSS AD in a Non-Clustered Environment

IMPORTANT:Before proceeding, ensure that you have met all the prerequisites specified in Section 3.2, Meeting NSS AD Infrastructure Requirements.

Table 4-2 Upgrading to OES 2018 SP2 and Deploying NSS AD

Process	Information and Links
	Using the instructions in the installation guide, upgrade only one server in your tree at a time. IMPORTANT:When upgrading the OES server, if NSS AD pattern is selected, then any misconfiguration in joining the domain can result in upgrade failure. Hence, it is recommended not to install NSS AD Support as part of the upgrade process. For detailed instructions, see Upgrading OES in the Installation Guide.
	On the OES server, run YaST and when you reach the Software Selections screen, select the OES Storage Service AD Support pattern. When you reach the YaST OES Patterns screen, select the OES Storage Service AD Support pattern. Specify the required details: AD Domain Name: Is the domain that the OES server is joining. AD Supervisor Group: Is the AD supervisor group name. The AD users belonging to this group will have supervisory rights for all the volumes associated with that OES server. AD User Name: Specify an AD administrator or user with the following privileges required to join the domain: Reset password Create computer objects Delete computer objects Read and write the msDs-supportedEncryptionTypes attribute. Password: Is the password of the AD user who is used for the domain join operation. Container to Create Computer Object: The container where the OES 2018 computer object will live. If you have already created a computer object in Active Directory for the OES server, select Use pre-created computer object and include the object name in the specification. Novell Identity Translator (NIT) Configuration: NIT manages UIDs as required for data access on a Linux server. For more information, see Section 7.2, NIT (Novell Identity Translator). When you click Next, you should receive a message that The domain join is in progress.
	Ensure that the OES computer object is created in the AD domain you specified. Verify that the default keytab entries for the OES server are created by entering the following command at the server’s terminal prompt: klist -k For example: tstsrv:~/Desktop #klist -k Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- ---------------------------------- 2 tstsrv$@ACME.COM 2 tstsrv$@ACME.COM 2 tstsrv$@ACME.COM 2 cifs/tstsrv.acme.com@ACME.COM 2 cifs/tstsrv.acme.com@ACME.COM 2 cifs/tstsrv.acme.com@ACME.COM 2 cifs/tstsrv@ACME.COM 2 cifs/tstsrv@ACME.COM 2 cifs/tstsrv@ACME.COM 2 host/tstsrv.acme.com@ACME.COM 2 host/tstsrv.acme.com@ACME.COM 2 host/tstsrv.acme.com@ACME.COM tstsrv:~/Desktop # The 12 keytab entries represents the Service Principals of the OES server. You can also execute kinit -k <name of the OES server>$ to ensure that the OES server is joined to the AD domain successfully. For example, kinit -k tstsrv$ On successful execution of the above command, it does not display any output message and returns to terminal.
	Media-upgrade the NSS32 pools that your AD users need access to. The following is a simple, GUI-driven method. At a terminal prompt, enter nssmu. Select Pools Select a pool. Type g, then type Y(es) > O(kay). Select another pool and continue until all of the NSS32 pools that AD users need access to are media-upgrated For more information on the NSS Media upgrade options and processes, see NSS Media Upgrade Commands in the Storage Services File System (NSS) Administration Guide for Linux.
	AD-enable the NSS volumes that your AD users need access to. The following is a simple, GUI-driven method. At a terminal prompt, enter nssmu. Select Volumes Select a volume. Type G, then type Y(es) > O(kay). Select another volume and continue until all of the volumes that AD users need access to are AD-enabled. For more information on the NSS Media upgrade options and processes, see NSS Media Upgrade Commands in the Storage Services File System (NSS) Administration Guide for Linux. See also, AD-enable the Volume in the Storage Services File System (NSS) Administration Guide for Linux.
	Review the information in Section 5.0, Assigning NSS Trustee Rights for AD Users and Groups to ensure that you understand the trustee-assignment processes and the associated caveats, then continue with Step 2. Assess whether the OES User Rights Map utility (NURM) applies to your organization by considering the following questions: Do any of your AD users and groups have matching eDirectory accounts? If so, you can use the OES User Rights Map utility (NURM) to map the rights between eDirectory and Active Directory users and groups and then apply NSS trustee assignments based on the mapping. If not, skip to process 7. Do you use NetIQ Identify Manager 4.5 or later to coordinate identities and passwords between Active Directory and eDirectory, and do you have a user map that was created using IDM Designer? If so, NURM can leverage that map. If not, you can create a map using NURM. Do you want to consolidate your overlapping eDirectory and Active Directory accounts to only Active Directory? If so, you can have NURM delete the eDirectory trustee assignments. If applicable, run NURM to assign NSS trustee rights to your AD users. For more information, see Section 7.4, NURM (OES User Rights Map).
	For AD users and groups who need NSS access and do not have matching eDirectory accounts, you can grant trustee assignments using either the NFARM Windows shell extension or the rights utility. Use other NSS tools to manage file and directory ownership, usage quotas and the other things that you manage for eDirectory users and groups. For more information, see OES File Access Rights Management (NFARM), rights, nsschown, and nssquota in the Storage Services File System (NSS) Administration Guide for Linux.
	To access the AD enabled NSS volumes, do the following: Ensure to create a forward lookup DNS entry for OES server where AD enabled NSS volumes are available. Map the NSS volume with the complete DNS name of the OES server or host name (not with the IP address).