Integration with FreeIPA

FreeIPA has some notable differences in its implementation on the FlashArray.

Base DN

In order for the FlashArray to accept CN= in the Base DN, you may need to upgrade Purity to the latest version. The Base DN should look something like this:

CN=accounts,DC=dev,DC=company,DC=com

Group Base

The Group Base should look something like this, since FreeIPA doesn't support OUs:

CN=groups

So for example:

> pureds list
Name        URI                           Base DN                                   Bind User                                                                       Bind Password  Check Peer  Enabled  User Login Attribute  User Object Class
management  ldap://ipa1.dev.company.com   CN=accounts,DC=dev,DC=company,DC=com      UID=ldap_checker,CN=users,CN=accounts,DC=dev,DC=company,DC=com                  ****           False       True     uid                   posixAccount
            ldap://ipa2.dev.company.com  

> pureds list --groups
Read-only Group  Storage Admin Group  Array Admin Group  Group Base
purereadonly     purestorageadmin     pureadmins         CN=groups 

Users should not be members of more than one security group, or the login will fail.

You can test what permissions the FlashArray will find with "pureadmin list username --force". The --force requires the FlashArray to bypass cached permissions (permissions are stored for a user for 30 minutes) and query the domain controller again.