HP Integrated Lights-Out 2 User Guide

Directory servicesIn this sectionOverview of directory integration........................................................................................................... 104Benefits of directory integration.............................................................................................................. 104Advantages and disadvantages of schema-free and HP Extended schema .................................................. 105Setup for Schema-free directory integration ............................................................................................. 105Setting up HP schema directory integration ............................................................................................. 108Overview of directory integrationiLO 2 can be configured to use a directory to authenticate and authorize its users. Before configuring iLO2 for directories, you must decide whether or not you want to use the HP Extended schema option.The advantages of using the HP Extended schema option are:• There is much more flexibility in controlling access. For example, access can be limited to a time ofday or from a certain range of IP addresses.• Groups are maintained in the directory, not on each iLO 2.• RILOE and RILOE II only work with HP Extended schema. (Schema-free will be added to RILOE II atlater date.)iLO 2, RILOE, and RILOE II will only work with eDirectory with HP Extended schema.See the comprehensive list of benefits in the "Benefits of directory integration (on page 104)" section. The"Directory-enabled remote management (on page 129)" section details how roles, groups, and security isenabled and enforced using directories. There are also white papers available for more information ondirectory integration on the HP website (http://www.hp.com/servers/lights-out).Benefits of directory integration• Scalability—The directory can be leveraged to support thousands of users on thousands of iLO 2s.• Security—Robust user password policies are inherited from the directory. User password complexity,rotation frequency, and expiration are policy examples.• Anonymity (lack thereof)—In some environments, users share Lights-Out accounts, which results in thelack of knowing who performed an operation, instead of knowing what account (or role) was used.• Role-based administration—You can create roles (for instance, clerical, remote control of the host,complete control) and associate users or user groups with those roles. A change at a single roleapplies to all users and Lights-Out devices associated with that role.• Single point of administration—You can use native administrative tools like MMC and ConsoleOneto administrate Lights-Out users.• Immediacy—A single change in the directory rolls-out immediately to associated Lights-Outprocessors. This eliminates the need to script this process.• Elimination of another username and password—You can use existing user accounts and passwordsin the directory without having to record or remember a new set of credentials for Lights-Out.Directory services 104