Virtualized server systems and methods including domain joining techniques

Patent metadata

Field	Value
Publication number	US-11086826-B2
Application number	US-201815966943-A
Country	US
Kind code	B2
Filing date	Apr 30, 2018
Priority date	Apr 30, 2018
Publication date	Aug 10, 2021
Grant date	Aug 10, 2021

Abstract

Examples described herein include virtualized environments including a virtualized file server. Examples of secure domain join processes are described which may facilitate joining a virtualized file server or portions thereof to a domain. In some examples, the secure domain join process itself, and/or an associated file server virtual machine, may have insufficient credentials to write objects into an active directory. The active directory credentials need not be shared with the file server virtual machine. Rather, in some examples, the secure domain join process may provide a user system with a list of actions to be performed using active directory credentials.

First claim

What is claimed is:

1. A system comprising:
a plurality of host machines implementing a virtualization environment, wherein each of the host machines comprises a hypervisor;
a distributed file server comprising a plurality of file server virtual machines (a plurality of FSVMs) and a storage pool, wherein each of the FSVMs is running on one of the host machines, wherein the FSVMs are configured to conduct I/O transactions with the storage pool; and
a secure domain join process hosted by at least one of the plurality of file server virtual machines, the secure domain join process configured to:
receive a request to domain join the distributed file server to an active directory domain;
provide an identification of actions to be taken using active directory credentials;
initiate a domain join process using regular credentials, wherein the regular credentials are different from the active directory credentials, and wherein the regular credentials are associated with permissions different from the active directory credentials; and
verify completion of the domain join process using the regular credentials.

2. The system of claim 1 , wherein the domain join process is configured to verify completion of the domain join process including completion of the actions to be taken.

3. The system of claim 1 , wherein the active directory credentials are different than the regular credentials.

4. The system of claim 3 , wherein the active directory credentials are sufficient for write access to the active directory.

5. The system of claim 3 , wherein the regular credentials are insufficient for write access to the active directory.

6. The system of claim 1 , wherein the actions to be taken include a list of entities to create on the active directory.

7. The system of claim 6 , wherein the entities to create comprise account name, account attributes, nameserver entries, or combinations thereof.

8. The system of claim 1 , wherein the identification of actions to be taken is specific to the active directory domain.

9. The system of claim 1 , wherein the active directory credentials have sufficient permission to create entities on the active directory domain.

10. The system of claim 1 , wherein the at least one of the plurality of file server virtual machines is configured to verify completion of the domain join process using active directory and name server configuration data.

11. The system of claim 1 , wherein the regular credentials have insufficient permission to create entities on the active directory domain.

12. The system of claim 1 , wherein based on the identification, accessing, by the at least one of the plurality of file server virtual machines, the active directory and writing one or more objects pertaining to the at least one file server virtual machine.

13. The system of claim 1 , wherein the active directory credentials include active director administrator credentials.

14. The system of claim 1 , wherein the regular credentials comprise regular user credentials.

15. The system of claim 1 , wherein the active directory credentials have sufficient permission to create entities on the activity directory domain and the regular credentials have insufficient permission to create entities on the active domain.

16. The system of claim 1 , wherein the regular credentials provide for read access to the active directory and the active directory credentials provide for read and write access to the active directory.

17. At least one non-transitory computer readable medium encoded with instructions which, when executed, cause a system to perform actions comprising:
receive, at a file server virtual machine of a distributed file server, a request to domain join the distributed file server to an active directory domain;
provide, using a secure domain join process of the file server virtual machine, an identification of actions to be taken using active directory credentials;
initiate a domain join process with the active directory domain using regular credentials, wherein the regular credentials are different from the active directory credentials, and wherein the regular credentials are associated with permissions different from the active directory credentials; and
verify completion of the domain join process with the active directory domain using the regular credentials.

18. The non-transitory computer readable medium of claim 17 , wherein the domain join process is configured to verify completion of the domain join process including completion of the actions to be taken.

19. The non-transitory computer readable medium of claim 17 , wherein the active directory credentials are sufficient for write access to the active directory.

20. The non-transitory computer readable medium of claim 17 , wherein the actions to be taken include a list of entities to create on the active directory.

21. The non-transitory computer readable medium of claim 20 , wherein the entities to create comprise account name, account attributes, nameserver entries, or combinations thereof.

22. The non-transitory computer readable medium of claim 17 , wherein the regular credentials are insufficient for write access to the active directory.

23. The non-transitory computer readable medium of claim 17 , wherein the instructions, when executed, cause the system to use the active directory credentials with sufficient permission to create entities on the active directory domain.

24. The non-transitory computer readable medium of claim 17 , wherein the instructions, when executed, cause the system to verify completion of the domain join process using active directory and name server configuration data.

25. The non-transitory computer readable medium of claim 17 , wherein the instructions, when executed, cause the system to use the regular credentials having insufficient permission to create entities on the active directory domain.

26. The non-transitory computer readable medium of claim 17 , wherein the instructions, when executed, cause the system to, based on the identification of actions to be taken using the active directory credentials, access the active directory and write one or more objects, including attributes of the objects, pertaining to the file server virtual machine.

27. The non-transitory computer readable medium of claim 17 , wherein the instructions, when executed, cause the system to use the active directory credentials that include active directory administrator credentials.

28. The on-transitory computer readable medium of claim 17 , wherein the instructions, when executed, cause the system to use the regular credentials comprising regular user credentials.

29. The non-transitory computer readable medium of claim 17 , wherein the instructions, when executed, cause the system to use the active directory credentials having sufficient permission to create entities on the active directory domain and use the regular credentials with insufficient permission to create entities on the active directory domain.

30. The non-transitory computer readable medium of claim 17 , wherein the instructions, when executed, cause the system to use the regular credentials that provide for read access to the active directory and use the active directory credentials that provide for read and write access to the active directory.

31. A method comprising:

Assignees

• Nutanix Inc

Inventors

• Thummala Hemantha Kumar
• Pillai Krishna Shibu
• Gupta Manish
• Rathi Shyamsunder Prayagchand

Classifications

• H04L63/102

  Entity profiles · CPC title

• G06F16/182 Primary

  Distributed file systems · CPC title

• G06F2009/45583

  Memory management, e.g. access or allocation · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title