Home

Move to the Cloud! User Azure AD for on-premise NAS

%3CLINGO-SUB%20id%3D%22lingo-sub-91381%22%20slang%3D%22en-US%22%3EMove%20to%20the%20Cloud!%20User%20Azure%20AD%20for%20on-premise%20NAS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-91381%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20there%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ewe%20are%20planing%20to%20move%20(nearly)%20all%20of%20our%20services%20to%20the%20cloud.%20We%20have%20a%20on-prem%20Exchange%202010%20and%20Windows%20Fileserver.%26nbsp%3B%3CBR%20%2F%3EWe%20plan%20to%20use%20O365%20Exchange.%3CBR%20%2F%3E%3CBR%20%2F%3EThe%20only%20Problem%20is%20that%20we%20need%20a%20on-prem%20fileserver%20because%20we%20are%20working%20with%20big%20files%20at%20around%2020gb.%20So%20there%20is%20no%20way%20to%20use%20OneDrive%20etc.%20because%20we%20only%20have%2020Mbit%2Fs%20Upload%20Speed.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENow%20we%20have%20a%20on-prem%20AD%20and%20we%20can%20sync%20the%20AD%20Resources%20with%20dirsync%20to%20Azure%20AD.%20We%20will%20have%20a%20new%20Qnap%20NAS%20System%20wich%20will%20be%20the%20new%20fileshare.%20I%20will%20join%20it%20to%20the%20AD%20to%20use%20the%20AD%20Users%20to%20control%20the%20sharing%20permissions.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20a%20way%20to%20get%20rid%20of%20on-prem%20AD%20when%20using%20a%20on-prem%20NAS%3F%20I%20havent%20found%20a%20way%20to%20connect%20a%20NAS%20System%20to%20Azure%20AD.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWould%20be%20nice%20to%20have%20a%20solution%20that%20the%20only%20Hardware%20we%20will%20have%20on-prem%20is%20our%20NAS%20for%20the%20big%20Fileshares.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-91381%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ECloud%20Essentials%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-132062%22%20slang%3D%22en-US%22%3ERe%3A%20Move%20to%20the%20Cloud!%20User%20Azure%20AD%20for%20on-premise%20NAS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-132062%22%20slang%3D%22en-US%22%3E%3CP%3EIt%20looks%20like%20this%20can%20be%20done%20using%20Azure%20AD%20Domain%20Services%2C%20but%20there%20are%20some%20things%20to%20consider%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3EADDS%20can%20expose%20an%20LDAPS%20endpoint%20to%20the%20public%20internet%20(that%20you%20can%20lock%20down%20using%20Network%20Security%20Groups)%20so%20your%20NAS%20will%20need%20to%20support%20LDAPS%20on%20port%20636%3C%2FLI%3E%0A%3CLI%3EThere%20are%20some%20specific%20requirements%20for%20the%20SSL%20certificate%20-%20you%20can't%20use%20a%20web%20host%20one%3C%2FLI%3E%0A%3CLI%3EManagement%20of%20the%20domain%20is%20most%20easily%20actioned%20from%20a%20domain-joined%20server%20inside%20the%20Azure%20vnet%20you'll%20create%2C%20that's%20not%20free%3C%2FLI%3E%0A%3CLI%3EI%26nbsp%3Bdidn't%20execute%20step%203%2C%26nbsp%3Band%20I%20couldn't%20find%20any%20way%20of%20determining%20the%20NETBIOS%20name%20(which%20was%20needed%20in%20my%20case)%3C%2FLI%3E%0A%3CLI%3EThe%20domain%20is%20read-only%20over%20LDAP%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3EI%20couldn't%20get%20it%20to%20work%20at%20all%20with%20my%20Netgear%20ReadyDATA%20NAS%2C%20but%20then%20I%20can't%20get%20that%20to%20join%20a%20local%20domain%20either%2C%20so%20it%20could%20just%20be%20a%20half-arsed%20implementation%20by%20Netgear.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-130772%22%20slang%3D%22en-US%22%3ERe%3A%20Move%20to%20the%20Cloud!%20User%20Azure%20AD%20for%20on-premise%20NAS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-130772%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Julian%20-%20was%20curious%20if%20you%20ever%20figured%20this%20out.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI've%20seen%20that%20you%20can%20setup%20a%20file%20server%20on%20QNAP's%20with%20virtualization%20station.%20Would%20it%20be%20possible%20to%20join%20this%20to%20AAD%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-91533%22%20slang%3D%22en-US%22%3ERe%3A%20Move%20to%20the%20Cloud!%20User%20Azure%20AD%20for%20on-premise%20NAS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-91533%22%20slang%3D%22en-US%22%3EYou%20could%2C%20but%20the%20challenge%20would%20be%20that%20you%20then%20have%20two%20systems%20to%20authenticate%20to%20-%20O365%2FAAD%20services%20and%20then%20the%20NAS%20as%20it%20would%20probably%20be%20using%20local%20authentication.%3CBR%20%2F%3ERealistically%20things%20like%20%22save%20password%22%20make%20it%20easier%2C%20but%20it's%20something%20you%20need%20to%20factor%20in%20from%20a%20user%20experience.%20If%20it's%20a%20small%20group%20of%20users%20-%20it%20shouldn't%20be%20an%20issue%2C%20but%20bigger%20groups%20then%20it%20can%20become%20one.%3C%2FLINGO-BODY%3E
Julian Stabentheiner
Occasional Visitor

Hi there,

 

we are planing to move (nearly) all of our services to the cloud. We have a on-prem Exchange 2010 and Windows Fileserver. 
We plan to use O365 Exchange.

The only Problem is that we need a on-prem fileserver because we are working with big files at around 20gb. So there is no way to use OneDrive etc. because we only have 20Mbit/s Upload Speed.

 

Now we have a on-prem AD and we can sync the AD Resources with dirsync to Azure AD. We will have a new Qnap NAS System wich will be the new fileshare. I will join it to the AD to use the AD Users to control the sharing permissions.

 

Is there a way to get rid of on-prem AD when using a on-prem NAS? I havent found a way to connect a NAS System to Azure AD.

 

Would be nice to have a solution that the only Hardware we will have on-prem is our NAS for the big Fileshares.

 

Thank you!

3 Replies
You could, but the challenge would be that you then have two systems to authenticate to - O365/AAD services and then the NAS as it would probably be using local authentication.
Realistically things like "save password" make it easier, but it's something you need to factor in from a user experience. If it's a small group of users - it shouldn't be an issue, but bigger groups then it can become one.

Hi Julian - was curious if you ever figured this out.

 

I've seen that you can setup a file server on QNAP's with virtualization station. Would it be possible to join this to AAD?

It looks like this can be done using Azure AD Domain Services, but there are some things to consider:

 

  1. ADDS can expose an LDAPS endpoint to the public internet (that you can lock down using Network Security Groups) so your NAS will need to support LDAPS on port 636
  2. There are some specific requirements for the SSL certificate - you can't use a web host one
  3. Management of the domain is most easily actioned from a domain-joined server inside the Azure vnet you'll create, that's not free
  4. I didn't execute step 3, and I couldn't find any way of determining the NETBIOS name (which was needed in my case)
  5. The domain is read-only over LDAP

I couldn't get it to work at all with my Netgear ReadyDATA NAS, but then I can't get that to join a local domain either, so it could just be a half-arsed implementation by Netgear.

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
35 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
9 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies