You must configure LDAP or NIS server access to an SVM before LDAP or NIS accounts can access the SVM. The switch feature lets you use LDAP or NIS as alternative name service sources.

Configure LDAP server access

You must configure LDAP server access to an SVM before LDAP accounts can access the SVM. You can use the vserver services name-service ldap client create command to create an LDAP client configuration on the SVM. You can then use the vserver services name-service ldap create command to associate the LDAP client configuration with the SVM.

About this task

Most LDAP servers can use the default schemas provided by ONTAP:

MS-AD-BIS (the preferred schema for most Windows Server 2012 and later AD servers)
AD-IDMU (Windows Server 2012 and later AD servers)
RFC-2307 (UNIX LDAP servers)

It is best to use the default schemas unless there is a requirement to do otherwise. If so, you can create your own schema by copying a default schema and modifying the copy. For more information, see:

NFS configuration

Before you begin

You must have installed a CA-signed server digital certificate on the SVM.
You must be a cluster or SVM administrator to perform this task.

Steps

Create an LDAP client configuration on an SVM:

vserver services name-service ldap client create -vserver SVM_name -client-config client_configuration -servers LDAP_server_IPs -schema schema -use-start-tls true|false

Start TLS is supported for access to data SVMs only. It is not supported for access to admin SVMs.

For complete command syntax, see the worksheet.

The following command creates an LDAP client configuration named “corp” on SVM “engData”. The client makes anonymous binds to the LDAP servers with the IP addresses 172.160.0.100 and 172.16.0.101. The client uses the RFC-2307 schema to make LDAP queries. Communication between the client and server is encrypted using Start TLS.
```
cluster1::> vserver services name-service ldap client create
-vserver engData -client-config corp -servers 172.16.0.100,172.16.0.101 -schema RFC-2307 -use-start-tls true
```
Associate the LDAP client configuration with the SVM: vserver services name-service ldap create -vserver SVM_name -client-config client_configuration -client-enabled true|false

For complete command syntax, see the worksheet.

The following command associates the LDAP client configuration corp with the SVM engData, and enables the LDAP client on the SVM.
```
cluster1::>vserver services name-service ldap create -vserver engData -client-config corp -client-enabled true
```

Validate the status of the name servers by using the vserver services name-service ldap check command.

The following command validates LDAP servers on the SVM vs0.

cluster1::> vserver services name-service ldap check -vserver vs0

| Vserver: vs0                                                |
| Client Configuration Name: c1                               |
| LDAP Status: up                                             |
| LDAP Status Details: Successfully connected to LDAP server "10.11.12.13".                                              |

Configure NIS server access

You must configure NIS server access to an SVM before NIS accounts can access the SVM. You can use the vserver services name-service nis-domain create command to create an NIS domain configuration on an SVM.

About this task

You can create multiple NIS domains. Only one NIS domain can be set to active at a time.

Before you begin

All configured servers must be available and accessible before you configure the NIS domain on the SVM.
You must be a cluster or SVM administrator to perform this task.

Step

Create an NIS domain configuration on an SVM:

vserver services name-service nis-domain create -vserver SVM_name -domain client_configuration -active true|false -nis-servers NIS_server_IPs

For complete command syntax, see the worksheet.

The following command creates an NIS domain configuration on SVM “engData”. The NIS domain nisdomain is active on creation and communicates with an NIS server with the IP address 192.0.2.180.
```
cluster1::>vserver services name-service nis-domain create
-vserver engData -domain nisdomain -active true -nis-servers 192.0.2.180
```

Create a name service switch

The name service switch feature lets you use LDAP or NIS as alternative name service sources. You can use the vserver services name-service ns-switch modify command to specify the look-up order for name service sources.

Before you begin

You must have configured LDAP and NIS server access.
You must be a cluster administrator or SVM administrator to perform this task.

Step

Specify the lookup order for name service sources:

vserver services name-service ns-switch modify -vserver SVM_name -database name_service_switch_database -sources name_service_source_order

For complete command syntax, see the worksheet.

The following command specifies the lookup order of the LDAP and NIS name service sources for the “passwd” database on SVM “engData”.
```
cluster1::>vserver services name-service ns-switch
modify -vserver engData -database passwd -source files ldap,nis
```