Viewing the QAS status errors
After you have checked the status of the Authentication Services hosts, you can view the reported failures or warnings on the Host Notifications tab.
To view QAS agent status
- From the Host Notifications tab, select the QAS Status view.
Note: If the Host Notifications tab is not currently available on the mangement console, open the Open Views menu and choose Host Notifications.
- Expand the host to see the warning and failure messages.
The QAS Status view indicates the health status of the listed Authentication Services hosts using these icons:
- Critical Failure
- Failure
- Warning
- To list only the hosts of one or more status levels
- Open the QAS Status state column drop-down menu, indicated with
icon.
- Navigate to the Filters option.
- Choose one or more of the status levels.
Note: The mangement console does not preserve the filter settings across log-on sessions. To clear the filter settings, click the Clear column filters button in the toolbar. If the Clear column filters button is not enabled, no status filters are set.
- To see the details about a particular warning or failure message, double-click it and open the Properties window.
Note: You can also click the 
icon in the toolbar to show status properties.
- To close the status Properties window, click the Show status properties icon.
- To re-check the QAS agent status for a host, select any warning or failure for that host and click the Check QAS agent status button on the toolbar.
Note: The Check QAS Status button is only available when a warning or failure is selected.
- To change the auto-status configuration, open the Check menu and choose Check QAS agent status automatically.
Note: You can also right-click any warning or failure to access the two Check QAS options.
Viewing the QAS status heartbeat errors
The host sends a heartbeat every four hours by default. If the server does not receive a heartbeat in over four hours, it displays an alert on the QAS Heartbeat tab.
Note: The QAS Status Heartbeat tab only lists hosts that fail to send a heartbeat in four hours.
To view QAS agent heartbeat
- From the Host Notifications tab, select the QAS Status Heartbeat view.
The QAS Status Heartbeat view shows alerts for hosts that have failed to send a QAS agent status heartbeat using this icon:
- No heartbeat received in over 4 hours
When a host, configured for automatic checking, receives a QAS agent status heartbeat error, in addition to displaying the alert on the QAS Status Heartbeat view, it displays the icon in the Authentication Services state column on the All Hosts view.
Adding AD user to a local group
Once you have successfully joined a host to an Active Directory domain, use the Groups view on the host's properties to add an Active Directory user to a local group (or remove users from a group).
To add an Active Directory user to a local group
-
On the All Hosts view, right-click a host that is joined to an Active Directory domain and choose the Groups.
You can also double-click the host name to open its properties, then click the Groups tab.
-
Double-click a local group name or right-click the group name and choose Properties to open its properties.
-
On the group's properties, click the Members tab, open the Add menu and choose AD user.
-
On the Select Unix-Enabled AD User dialog, search Active Directory to locate users to add.
Note: When searching Active Directory, the mangement console only lists Unix-enabled users. See Unix-Enable an Active Directory User for details.
To find a particular user you can filter the list of users. Enter one or more characters in the Search by name box. The mangement console automatically displays the users whose name contains the characters you enter.
You can also click 
to select the container where you want to being the search.
- Select one or more users from the list and click OK.
The mangement console adds the selected users to the list on the Members tab with an 
icon.
-
Click OK on the Members tab to save your selections.
-
On the Log on to Host dialog, enter the user credentials to access the selected host and click OK.
This information is pre-populated if you saved the credentials for the host.
Note: To remove objects from a local group, select one or more objects from the list on the Members tab and click Remove User.
Mapping local users to Active Directory users
Management Console for Unix provides a feature called "Require AD Logon" where you can map local Unix user accounts to Active Directory users accounts. In other words, you can specify an Active Directory user account with which local users can authenticate, or login to a Unix host. Active Directory password policies are enforced requiring that these users use their Active Directory password with their local user name or Active Directory log on name. Local users retain all of their local Unix attributes such as UID Number and Login Shell, but they authenticate using their Active Directory password.
Note: This feature is only available if you meet these criteria:
- Authentication Services 4.x is installed on the client host
- Your client host is joined to Active Directory
- You are logged on as an Active Directory account in the Manage Hosts role. See Console Roles and Permissions system settings for details.
Advantages of Requiring Users to Log in with Active Directory Authentication:
- Provides a rapid deployment path to take advantage of Active Directory authentication
- Kerberos authentication provides stronger security
- Enables centralized access control
- Enforces Active Directory Password policies
- Provides a path for consolidating identities in Active Directory with the Ownership Alignment Tool (OAT)
- Low impact to existing applications and systems on the Unix host
- Easy to deploy with Authentication Services self enrollment
By "mapping" a local user to an Active Directory account, the user can log in with his Unix user name and Active Directory password.
