User Authentication using MS AD

Hi,

I'd like to define NCM users in MS AD and use device credentials assigned to user accounts,i.e. each user has a specific NCM login and device credentials.

Devices use Radius authentication and MS IAS is used as the Radius server. The result is that the NCM user's account/password and the device credentials may be the same and be verified against the single MS AD.

Can you use some kind of macros, e.g. ${NCMLoginUsername},${NCMLoginPassword} (similar to ${GlobalUsername},${GlobalPassword} or ${Username},${Password}) to define the device credentials so that it would not be necessary to define the specific values of device credentials in NCM ? These macros would be assigned to the values entered by the NCM user on login into NCM.

It would much simplify the user management in such environments.

Any ideas ?

Filip

Find more posts tagged with

user_management

ncm

active_directory

Accepted answers

All comments

chris.lapoint

This not possible today, but this is certainly on our roadmap. The issue with passing along credentials from MS AD to the device is that NCM never stores the Windows password (in memory or in the database) - it is strictly pass through authentication to Windows.

pserwe

I have what seems to be a slightly different problem.

I'm using NCM 5.0SP1

1) I can't add any NCM built-in accounts.

2) I can't seem to authenticate using AD accounts (at all).

I have 2 AD accounts allowed to log into the devices. Neither one seems to work via any combination of user identification.

DOMAIN\username

username@domain.tld

username

Peter

chris.lapoint

NCM ships with 3 default built-in accounts (Administrator, Engineer, WebViewer). You cannot create any additional built-in accounts.

When you say you cannot authenticate using AD accounts, have you added them to the NCM using the desktop application (File > Manage Orion NCM Users > Add Windows Users)? NCM must be made aware of the AD accounts you want to have access before authentication is allowed.

pserwe

Yes, that's exactly what I'm saying. I did misspeak though when I said I have 2 accounts allowed to log into the devices, I meant, 2 AD accounts added to NCM.

Peter