HP Integrated Lights-Out 2 User Guide

Minimum Login Flexibility• Enter the directory server’s DNS name or IP address and LDAP port. Typically, the LDAP port for anSSL connection is 636.• Enter the distinguished name for at least one group. This group can be a security group (forexample: "CN=Administrators,CN=Builtin,DC=HP,DC=com") or any other group as long as theintended iLO 2 users are members of the group.With a minimum configuration, you can log into iLO 2 using your full distinguished name andpassword. You must be a member of a group that iLO 2 recognizes.Better Login Flexibility• In addition to the minimum settings, enter at least one directory user context.At login time, the login name and user context are combined to make the user's distinguished name.For instance, if the user logs in as "JOHN.SMITH" and a user context is set up as"CN=USERS,DC=HP,DC=COM", then the distinguished name that iLO 2 will try will be"CN=JOHN.SMITH,CN=USERS,DC=HP,DC=COM."Maximum Login Flexibility• Configure iLO 2 as described.• Configure iLO 2 with a DNS name, not an IP address for the directory server's network address. TheDNS name must be resolvable to an IP address from both iLO 2 and the client system.• Enable ActiveX controls in your browser. The iLO 2 login script will attempt to call a Windows®control to convert the login name to a distinguished name.Configuring iLO 2 with maximum login flexibility enables you to login using your full distinguishedname and password, your name as it appears in the directory, NetBIOS format(domain/login_name), or the e-mail format (login_name@domain).NOTE: Your system security settings or installed software might prevent the login script from calling theWindows® ActiveX control. If this happens, your browser displays a warning message in the status bar,message box, or might stop responding. To help identify what software or setting is causing the problem,create another profile and log in to the system.In some cases, it might not be possible to get the maximum login flexibility option to work. For instance, ifthe client and iLO 2 are in different DNS domains, one of the two might not be able to resolve thedirectory server name to an IP address.Setting up HP schema directory integrationWhen using the HP schema directory integration, iLO 2 supports both Active Directory and eDirectory.However, these directory services require the schema being extended.Features supported by HP schema directory integrationiLO 2 Directory Services functionality enables you to:• Authenticate users from a shared, consolidated, scalable user database.• Control user privileges (authorization) using the directory service.• Use roles in the directory service for group-level administration of iLO 2 management processors andiLO 2 users.Extending the schema must be completed by a Schema Administrator. The local user database isretained. You can decide not to use directories, to use a combination of directories and local accounts, orto use directories exclusively for authentication.Directory services 108