VSI 8.7 only support standalone users or users belonging to a group on the vsphere.local SSO domain. If you have an AD integration -in my case LDAP- then users from the AD domain either standalone or belonging to any other AD groups are not allowed storage access. I have tested both scenarios and usage of users/groups from the LDAP AD domain integrated is just not allowed. The only change on VSI 8.7 is that you no longer receive the message "failed to find user object for logged in username "user@domain.com". Storage Actions will be disabled" when you are logged on the vCenter as user@domain.com even if have vCenter Administrator Role.
Adding an AD Domain user as member of any local group on the vsphere.local SSO domain and grant storage access to that local group also does not grant storage access to the AD user@domain.com.
From what I see VSI is not fully AD integrated as NOT all the users or groups from the AD Domain are visible on the list when trying to attemp to grant access to the storage. Even if you select an object from the list -if you are lucky and the ADuser@domain.com or ADgroup@domain.com is available on the list- and grant storage access, when you are logged as that username@domain.com on the vCenter, running any storage operation is not allowed due the storage does not appear as available.
Hi, recently upgrade my vsi and work fine with group AD, remove my vsi 8.5 from my vcenter and install fresh vsi 8.7. I only had problems with the docker IPs that had the same range as my storage and I had to open a case in dell to help me change the docket ip.
Eric Jiang
5 Posts
1916
0
Posted March 11th, 2021 06:00
VSI 8.7 would support AD totally. Current plan is to release it in June. Stay tuned