The CLI command pureds is used to configure the Secure Array Administration with Multi-User Access Control.
Note:
-
These commands vary depending on Purity//FA version. Use the help menu by running the command
pureds -horpureds --helpto view the valid commands relative to your Purity//FA version as in the below example. -
For information on how to configure Directory Services on FlashArray for your Purity//FA version, or for specific information on Directory Services Roles and Access policy mappings, please review the "Directory Service Configuration on the Array" section in the CLI reference guide.
pureuser@flasharray1> pureds list
Name URI Base DN Bind User Bind Password Check Peer Enabled User Login Attribute User Object Class
data - - - - False False - -
management - - - - False False - -
pureuser@flasharray1>
pureuser@flasharray1> pureds setattr --help
usage: pureds setattr [-h] [--uri URI] [--base-dn BASE_DN] [--bind-user BIND_USER] [--bind-password] [--readonly-group READONLY_GROUP] [--storage-admin-group STORAGE_ADMIN_GROUP] [--array-admin-group ARRAY_ADMIN_GROUP]
[--group-base GROUP_BASE] [--ca-certificate] [--trust] [--auto-fetch] [--user-login-attribute USER_LOGIN_ATTRIBUTE] [--user-object-class USER_OBJECT_CLASS]
[SERVICE-NAME]
positional arguments:
SERVICE-NAME service name, only one service name at a time. (Ex: management or data)
optional arguments:
-h, --help show this help message and exit
--uri URI comma separated directory server URIs (Ex: ldaps://ad.company.com)
--base-dn BASE_DN base DN of directory service (Ex: DC=company,DC=com)
--bind-user BIND_USER
sAMAccountName to use for doing lookups in Active Directory (Ex: ldapreader). Full Distinguished Name of the bind user for doing lookups in OpenLDAP (Ex: "cn=ldapreader,dc=company,dc=com")
--bind-password use prompt to set password of bind-user account
--readonly-group READONLY_GROUP
(deprecated) use "pureds role setattr"
--storage-admin-group STORAGE_ADMIN_GROUP
(deprecated) use "pureds role setattr"
--array-admin-group ARRAY_ADMIN_GROUP
(deprecated) use "pureds role setattr"
--group-base GROUP_BASE
(deprecated) use "pureds role setattr"
--ca-certificate use prompt to enter PEM format CA certificate (including "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----" lines)
--trust skip certificate chain trust verification
--auto-fetch download and confirm the server certificate. Use with --ca-certificate.
--user-login-attribute USER_LOGIN_ATTRIBUTE
User login attribute in your LDAP structure. Typically, the attribute field that holds the user's unique login name. Defaults to sAMAccountName for Active Directory, or uid for other directory services.
--user-object-class USER_OBJECT_CLASS
Value of the object class used for the LDAP user. Defaults to User for AD, posixAccount or shadowAccount for OpenLDAP, or person for all others.
pureuser@flasharray1> pureds role setattr --help
usage: pureds role setattr [-h] [--group GROUP] [--group-base GROUP_BASE] ROLE ...
positional arguments:
ROLE role name (readonly, ops_admin, storage_admin, or array_admin)
optional arguments:
-h, --help show this help message and exit
--group GROUP CN of the group
--group-base GROUP_BASE
OU path to configured groups
pureuser@flasharray1>- Set the role for the Groups created previously in your Active Directory Domain.
pureuser@flasharray1> pureds role setattr readonly --group purereadonly --group-base OU=PureGroups,OU=SANManagers Name Group Group Base readonly purereadonly OU=PureGroups,OU=SANManagers pureuser@flasharray1> pureds role setattr ops_admin --group pureops --group-base OU=PureGroups,OU=SANManagers Name Group Group Base ops_admin pureops OU=PureGroups,OU=SANManagers pureuser@flasharray1> pureds role setattr storage_admin --group purestorage --group-base OU=PureGroups,OU=SANManagers Name Group Group Base storage_admin purestorage OU=PureGroups,OU=SANManagers pureuser@flasharray1> pureds role setattr array_admin --group pureadmin --group-base OU=PureGroups,OU=SANManagers Name Group Group Base array_admin pureadmin OU=PureGroups,OU=SANManagers - Set the URI to point to the active directory server:
pureuser@flasharray1> pureds setattr --uri ldaps://windows1.testdrive.local Name URI Base DN Bind User Bind Password Check Peer Enabled User Login Attribute User Object Class management ldaps://windows1.testdrive.local DC=testdrive,DC=local - - False False -Note that this auto-populated the BaseDN. The default is derived from the domain in the URI. You may also enter more than one URI. Up to 30 can be entered, comma separated. They must all use ldaps or ldap. The DCs must be members of the same domain. For example:
pureuser@flasharray1> pureds setattr --uri "ldaps://mydomaincontroller.mycompany.com,ldaps://<wbr/>mydomaincontroller2.mycompany.com,ldaps://mydomain<wbr/>controller3.mycompany.com" - Set the bind credentials by adding the sAMAccountName (username) of the binduser (aka ldap reader account) and the beinduser's password:
pureuser@flasharray1> pureds setattr --bind-user purebinduser Name URI Base DN Bind User Bind Password Check Peer Enabled User Login Attribute User Object Class management ldaps://windows1.testdrive.local DC=testdrive,DC=local purebinduser - False False - - pureuser@flasharray1> pureds setattr --bind-password Enter bind password: Retype bind password: Name URI Base DN Bind User Bind Password Check Peer Enabled User Login Attribute User Object Class management ldaps://windows1.testdrive.local DC=testdrive,DC=local purebinduser **** False False - - pureuser@flasharray1> pureds setattr --user-login-attribute sAMAccountName --user-object-class User Name URI Base DN Bind User Bind Password Check Peer Enabled User Login Attribute User Object Class management ldaps://windows1.testdrive.local DC=testdrive,DC=local purebinduser **** False False sAMAccountName User - Set the attribute for Group Base. You may enter just "OU=PureGroups" as the group, but in this scenario, there was an existing OU which became a sub OU. Our group-base is now "OU=PureGroups,OU=SANManagers":
pureuser@flasharray1> pureds setattr --base-dn DC=testdrive,DC=local Name URI Base DN Bind User Bind Password Check Peer Enabled User Login Attribute User Object Class management ldaps://windows1.testdrive.local DC=testdrive,DC=local - - False False - -To test the configuration, enter the following: - To test the configuration, enter the following:
pureuser@flasharray1> pureds test Output Feature Status: Disabled Testing from ct0: Resolving windows1.testdrive.local... PASSED Searching ldaps://windows1.testdrive.local... PASSED Searching for group CN=purereadonly... PASSED Searching for group CN=pureops... PASSED Searching for group CN=purestorage... PASSED Searching for group CN=pureadmin... PASSED pureuser@flasharray1> - Once the test results are successful, you can proceed to enable the configuration:
pureuser@flasharray1> pureds enable
URI Base DN Bind User Bind Password Check Peer Enabled User Login Attribute User Object Class
ldaps://windows1.testdrive.local DC=testdrive,DC=local purebinduser **** False True sAMAccountName User
pureuser@flasharray1> You may now access the FlashArray from the CLI or GUI using a Windows Account that's a member of one of the Pure Groups in AD.
(TLS Support) Configuring a Certificate via CLI
After all other configuration is completed using the steps above, you can import the certificate(s).