Identity Providers (User & Provider Management in the VAST Management System)

This video from VAST Data Customer Education provides a comprehensive explanation of identity providers within the VAST Management System (VMS) and how they are leveraged to manage user identities and control data access on VAST clusters. This is a critical topic for storage administrators seeking to implement secure and efficient authentication and authorization. We begin by defining what a user identity represents in VAST (e.g., UID, SID, S3 Access Key) and introduce the role of providers in looking up, validating, and mapping these identities across various protocols. The video details the identity providers supported by VAST Data:

• Active Directory (AD): Discussing its role in authentication and its primary function in identifying users, group memberships, and attributes.

• OpenLDAP: Covering its broad compatibility with any LDAP-speaking directory service, including solutions like FreeIPA.

• NIS: Acknowledging its continued use by some customers, despite its age.

• Local Users: Briefly explaining how to define users directly on the VAST system.

A key aspect of VAST’s multi-protocol design is highlighted: all configured providers are consulted during data access, ensuring consistent permissions regardless of the access protocol (e.g., SMB or NFS). We explain that providers are defined at the cluster level, enabling their reusability across multiple tenants without redundant configurations like multiple Active Directory joins. The video then delves into common provider combinations for achieving comprehensive multi-protocol access, such as combining Active Directory with OpenLDAP for POSIX attributes, or using single providers where appropriate. It also touches upon how VAST handles Kerberos SPN instances for a single Active Directory computer object used across multiple tenants. This explanation aims to provide VAST Data operators with a robust understanding of identity management and authorization within the VAST environment, facilitating secure and flexible client access.