Validate AD Cluster Delegation with CLI SPN Tests

Introduction

This is a CLI-based validation method, distinct from the GUI-based Effective Access check described in Configure Delegation of Cluster Machine Accounts. Both validate the same underlying requirement — that SPN delegation between cluster machine accounts is configured correctly — but this method directly exercises SPN create/delete operations from the cluster CLI, rather than reading effective permissions from Active Directory Users and Computers.

Use this procedure to validate AD delegation was done correctly. A common mistake is delegating permissions to the wrong computer object.

This test methodology validates AD delegation readiness for failover under four scenarios:

• PRIMARY cluster SELF SPN delegation
• PRIMARY cluster CROSS SPN delegation
• DR cluster SELF SPN delegation
• DR cluster CROSS SPN delegation

Applies to OneFS 8.x

The commands below use isi_classic, which applies to OneFS 8.x.x.x. You will need two OneFS 8.x.x.x clusters connected to the same Active Directory domain to run these tests.

Understanding How Failover Works

The failover process requires the target cluster to have AD permissions to manage SPN(s) on the source cluster's AD machine account. The cluster delegation guide sets this up for each cluster's machine account so failover can proceed in either direction.

If delegation is not set up correctly, you will commonly see:

• LDAP constraint violation
• LDAP permissions error

Locate the AD PowerScale Machine Account Name

Log in to the cluster as root and run:

isi auth ads list -v

Section 1 — Steps Performed on the PRIMARY Cluster

1A — SELF Test

Create SPN for PRIMARY cluster:

1. Log in to the PRIMARY cluster using the eyeglass user and confirm identity:

   whoami

2. Add a SPN:

   sudo isi_classic auth ads spn add --machinecreds --spn=HOST/superna.test.spn --domain=xxx
   • --machinecreds is needed to authenticate your cluster.
   • --domain= — enter your domain name.

3. Verify the SPN was created:

   sudo isi_classic auth ads spn list --machinecreds --domain=xxx

Delete SPN for PRIMARY cluster:

1. Log in to the PRIMARY cluster using the eyeglass user and confirm identity:

   whoami

2. Delete the SPN from the same cluster:

   sudo isi_classic auth ads spn delete --machinecreds --spn=HOST/superna.test.spn --domain=xxx

3. Verify the SPN was deleted:

   sudo isi_classic auth ads spn list --machinecreds --domain=xxx

1B — CROSS Test

Create SPN for DR cluster (from the PRIMARY cluster):

1. Log in to the PRIMARY cluster using the eyeglass user and confirm identity:

   whoami

2. Add the SPN for the DR cluster, using the PRIMARY cluster:

   sudo isi_classic auth ads spn add --machinecreds --account=xxx$ --spn=HOST/superna.test.spn --domain=xxx
   • --account= is the AD computer machine name you are adding the SPN to. A $ is required after the AD computer name.

3. Verify the SPN was created:

   sudo isi_classic auth ads spn list --machinecreds --account=xxx$ --domain=xxx

Delete SPN for DR cluster (from the PRIMARY cluster):

1. Log in to the PRIMARY cluster using the eyeglass user and confirm identity:

   whoami

2. Delete the SPN for the DR cluster, using the PRIMARY cluster:

   sudo isi_classic auth ads spn delete --machinecreds --account=xxx$ --spn=HOST/superna.test.spn --domain=xxx

3. Verify the SPN was deleted:

   sudo isi_classic auth ads spn list --machinecreds --account=xxx$ --domain=xxx

Section 2 — Steps Performed on the DR Cluster

1A — SELF Test

Create SPN for DR cluster:

1. Log in to the DR cluster using the eyeglass user and confirm identity:

   whoami

2. Add a SPN:

   sudo isi_classic auth ads spn add --machinecreds --spn=HOST/superna.test.spn.domain.com --domain=xxx

3. Verify the SPN was created:

   sudo isi_classic auth ads spn list --machinecreds --domain=xxx

Delete SPN for DR cluster:

1. Log in to the DR cluster using the eyeglass user and confirm identity:

   whoami

2. Delete the SPN from the same cluster:

   sudo isi_classic auth ads spn delete --machinecreds --spn=HOST/superna.test.spn --domain=xxx

3. Verify the SPN was deleted:

   sudo isi_classic auth ads spn list --machinecreds --domain=xxx

1B — CROSS Test

Create SPN for PRIMARY cluster (from the DR cluster):

1. Log in to the DR cluster using the eyeglass user and confirm identity:

   whoami

2. Add the SPN for the PRIMARY cluster, using the DR cluster:

   sudo isi_classic auth ads spn add --machinecreds --account=xxx$ --spn=HOST/superna.test.spn --domain=xxx

3. Verify the SPN was created:

   sudo isi_classic auth ads spn list --machinecreds --account=xxx$ --domain=xxx

Delete SPN for PRIMARY cluster (from the DR cluster):

1. Log in to the DR cluster using the eyeglass user and confirm identity:

   whoami

2. Delete the SPN for the PRIMARY cluster, using the DR cluster:

   sudo isi_classic auth ads spn delete --machinecreds --account=xxx$ --spn=HOST/superna.test.spn.domain.com --domain=xxx

3. Verify the SPN was deleted:

   sudo isi_classic auth ads spn list --machinecreds --account=xxx$ --domain=xxx

See Also

• Configure Delegation of Cluster Machine Accounts — the GUI-based Effective Access check for validating the same SPN delegation, using Active Directory Users and Computers instead of the CLI.