content_image/998928.jpg
## Reasons for using remote authentication 

Use remote authentication for the following reasons: 

GLYPH<SM590000> Remote authentication saves you from having to configure a local user on every IBM storage system in your storage infrastructure. 

GLYPH<SM590000> If you have multiple LDAP-enabled storage systems, remote authentication makes it more efficient to set up authentication. 

GLYPH<SM590000> The audit log shows the domain user name of the issuer when commands are run. The domain user name is more informative than a local user name or just superuser . 

GLYPH<SM590000> Remote authentication gives you central access control. If someone leaves the company, you need to remove access at the domain controller only, which means that no orphan user IDs remain on the storage system. 

## Prepare the LDAP server 

The first step in configuring LDAP is to prepare the LDAP server. Our example uses a Microsoft Windows 2008 R2 Enterprise server, which is promoted to be a Domain Controller by using the dcpromo  command. Next, the computer role Active Directory Lightweight Directory Services  is added. 

The privileges that the LDAP user receives on the IBM FlashSystem 900 are controlled by user groups on the storage system. Matching user groups must be available on the Active Directory (AD) server and on the IBM FlashSystem 900. The LDAP users must be added to the AD server group. 

In this example, you create a group that is called FlashAdmin , which you use to manage your FlashSystem 900 storage device. Complete the following steps: 

1. To create this group, log on to the AD Domain Controller and configure Active Directory. An easy way to configure Active Directory from the AD controller is to select Start →  Run , enter dsa.msc , and click OK . The Active Directory Users and Computers management console opens (see Figure 8-15). 

<img src='content_image/998928.jpg'>

Click the Create a new group in the current container  icon. 

