Allow Local Break-Glass and IBM Service Accounts to Coexist with LDAP Authentication on DS8000 HMC

Enhance DS8000 HMC LDAP authentication to allow customers to selectively retain designated local accounts when LDAP authentication is enabled.

Currently, we can successfully configure and use LDAP for remote user authentication. However, we also require a local storage administrator account to serve as a break-glass account in the event LDAP or the supporting authentication infrastructure becomes unavailable.

When the local account is enabled for this purpose, the current behavior also impacts the IBM-designated service accounts used by IBM service engineers. This can prevent IBM personnel from remotely accessing the system for maintenance or recovery activities.

We would like the ability to differentiate between the following account types:

• LDAP-managed remote user accounts for normal administrative access.
• A customer-designated local break-glass account that remains available if LDAP is unavailable.
• IBM-designated service accounts, which remain available and are not affected by the customer's decision to enable a local break-glass account.

Ideally, the DS8000 HMC would allow an administrator to explicitly designate one or more local accounts as break-glass accounts while leaving IBM service accounts under their existing IBM-controlled access behavior.

Business / Operational Value:
This enhancement would allow customers to use centralized LDAP authentication without sacrificing emergency administrative access or IBM remote serviceability. It would improve resiliency by removing a dependency on LDAP availability during recovery scenarios while preserving IBM's ability to perform authorized remote maintenance and recovery.