HP Integrated Lights-Out 2 User Guide

Directory-enabled remote managementIn this sectionIntroduction to directory-enabled remote management .............................................................................. 129Creating roles to follow organizational structure ...................................................................................... 129How directory login restrictions are enforced........................................................................................... 131Using bulk import tools.......................................................................................................................... 134Introduction to directory-enabled remote managementThis section is for administrators who are familiar with directory services and the iLO 2 product and wantto use the HP schema directory integration option for iLO 2. You must be familiar with the “Directoryservices (on page 104)" section and comfortable with setting up and understanding the examples.Directory-enabled remote management enables you to:• Create Lights-Out Management ObjectsYou must create one LOM device object to represent each device that will use the directory service toauthenticate and authorize users. Refer to the "Directory services (on page 104)" section foradditional information on creating LOM device objects for Active Directory ("Directory services forActive Directory" on page 113) and eDirectory ("Directory services for eDirectory" on page 121). Ingeneral, you can use the HP provided snap-ins to create objects. It is useful to give the LOM deviceobjects meaningful names, such as the device network address, DNS name, host server name, orserial number.• Configure the Lights-Out management devicesEvery LOM device that uses the directory service to authenticate and authorize users must beconfigured with the appropriate directory settings. Refer to "Configuring directory settings (on page44)" for details on the specific directory settings. In general, you can configure each device with theappropriate directory server address, LOM object distinguished name, and any user contexts. Theserver address is either the IP address or DNS name of a local directory server or, for moreredundancy, a multi-host DNS name.Creating roles to follow organizational structureOften, the administrators within an organization are placed into a hierarchy in which subordinateadministrators must assign rights independently of ranking administrators. In this case, it is useful to haveone role that represents the rights assigned by higher-level administrators and to allow the subordinateadministrators to create and manage their own roles.Using existing groupsMany organizations will have their users and administrators arranged into groups. In many cases, it isconvenient to use the existing groups and associate the groups with one or more Lights-Out Managementrole objects. When the devices are associated with the role objects, the administrator controls access tothe Lights-Out devices associated with the role by adding or deleting members from the groups.Directory-enabled remote management 129