Nutanix: Role Mapping Quirk



Summary:
Basically was trying to map a set of AD groups to the Cluster Admin role in Nutanix/Prism.  It appears the role mapping config is very literal.  Meaning, putting in a group like this:

GroupA, GroupB

GroupA will work, but members of GroupB will not have access.  This is because of a 'space' after the comma.  Valid input would be:

GroupA,GroupB


Comments

Post a Comment

Popular posts from this blog

NSX-T: Release associated invalid node ID from certificate

Image
Summary: Basically had an expiring certificate registered in NSX-T that was associated to a node_id that is no longer valid.  Long story short, there wasn't anything obvious in API to delete or disassociate a certificate from a node_id for 3.2.2.  Not sure how things got in this state, but annotating for future reference.  This may change in future revisions, so always check API for latest. Details: Effectively had a stale node associated w/ a certificate that was expiring.  Could not delete certificate until that node was disassociated from the certificate. To get certificate details and associated node_id's, you can use the following curl call (UI works too): curl -k -X GET -H "Content-Type: application/json" -u admin https://<manager ip>/api/v1/trust-management/certificates/<cert UUID> Above will return something like this: Below must be run from one of the manager nodes via elevation to root: ONLY RUN THIS IF YOU ARE ABSOLUTELY SURE OF WHAT YOU ARE DO...
Read more

VMware | AVS: Content Library or Non vCenter objects on VSAN produces unassociated but valid objects

Image
Summary: Creating or Subscribing to a Content Library on vSAN is typical practice, but the annoying side effect?  Objects created on vSAN datastore that show up as "unassociated" objects and guess what, they simply inherit the Cluster's default VSAN policy at time of import.  Yeah, dumb right?  Also, by vSAN Operations Guide Standards section 6721 subsection 4 , you shouldn't do this. So then what? In Azure VMware Solution(AVS) , you have a couple of options.  You can do what the operations guide tells you that you shouldn't do or you can do something better.  Regardless of these options, the one thing you should do, is create a global content library.   Create Global Content Library:  here are instructions to create one on an Azure blob store. You should do this, makes life easier if you can. Also a fun little experiment to play w/ Azure Functions Centralized Storage of your ISO/OVF's etc. Attach external storage (Not necessary, but I'll explain ...
Read more

Misc: Navien NPE-240A Navilink App missing scheduling function

Image
NPE-240A Summary: Just had a new tankless water heater installed in my house to replace a failing 22 year-old 50 gallon tank.  Couldn't be happier w/ my new tankless, but was dealing with weirdness on the Navilink app to control/view my new Navien .  The app's scheduling function (for the recirculation pump) was missing. Solution: NR-20DU Disconnect NR-20DU remote controller. (if you want to schedule via App) *DIP Switches need to be set properly as well. In my case, w/ a bridge valve in my furthest faucet, is considered "External Recirculation". Check w/ your plumber for proper settings, they set mine properly. If you are in the Atlanta area, I highly recommend Plumbing Express LLC . Ask for Jonathan DeWeese. For reference only, these were set correctly by my plumber for my setup. DIP Switch 1 Off, 2 On.  (Internal Recirculation would be the opposite) Parameter 18 set to On (This is to enable Navilink ) These settings are detailed out in t...
Read more