HP Integrated Lights-Out 2 User Guide
HP Integrated Lights-Out 2 User Guide
HP Integrated Lights-Out 2 User Guide
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Owner Field is set to SAN, iLO 2 obtains the directory user's login name from the UPN attribute of theSAN. If the Certificate Owner Field setting is set to Subject, iLO 2 obtains the directory user'sdistinguished name from the subject of the certificate.Which Certificate Owner Field setting to choose depends on the directory integration method used, thedirectory architecture, and what information is contained in the user certificates that are issued. Thefollowing examples assume you have the appropriate permissions.Authentication using Default Directory Schema, part 1: The distinguished name for a user inthe directory is CN=John Doe,OU=IT,DC=MyCompany,DC=com, and the following are the attributes ofJohn Doe's certificate:• Subject: DC=com/DC=MyCompany/OU=IT/CN=John Doe• SAN/UPN: john.doe@MyCompany.comAuthenticating to iLO 2 with username:john.doe@MyCompany.com and password, will work if two-factorauthentication is not enforced. After two-factor authentication is enforced, if SAN is selected on the Two-Factor Authentication Settings page, the login page automatically populates the Directory <strong>User</strong> field withjohn.doe@MyCompany.com. The password can be entered, but the user will not be authenticated. Theuser is not authenticated because john.doe@MyCompany.com, which was obtained from the certificate,is not the distinguished name for the user in the directory. In this case, you must select Subject on theTwo-Factor Authentication Settings page. Then the Directory <strong>User</strong> field on the login page will bepopulated with CN=John Doe,OU=IT,DC=MyCompany,DC=com, which is the user's actual distinguishedname. If the correct password is entered, the user is authenticated.Authentication using Default Directory Schema, part 2: The distinguished name for a user inthe directory is CN=john.doe@MyCompany.com,OU=IT,DC=MyCompany,DC=com, and the followingare the attributes of John Doe's certificate:• Subject: DC=com/DC=MyCompany/OU=Employees/CN=JohnDoe/E=john.doe@MyCompany.com• SAN/UPN: john.doe@MyCompany.com• Search context on the Directory Settings page is set to: OU=IT,DC=MyCompany,DC=comIn this example, if SAN is selected on the Two-Factor Authentication Settings page, the Directory <strong>User</strong> fieldon the login page is populated with john.doe@MyCompany.com. After the correct password is entered,the user is authenticated. The user is authenticated even though john.doe@MyCompany.com is not thedistinguished name for the user. The user is authenticated because iLO 2 attempts to authenticate usingthe search context fields (CN=john.doe@MyCompany.com, OU=IT, DC=MyCompany, DC=com)configured on the Directory Settings page. Because this is the correct distinguished name for the user, iLO2 successfully finds the user in the directory.NOTE: Selecting Subject on the Two-Factor Authentication Settings page causes authentication to fail,because the subject of the certificate is not the distinguished name for the user in the directory.When authenticating using the <strong>HP</strong> Extended Schema method, <strong>HP</strong> recommends selecting the SAN optionon the Two-factor Authentication Settings page.Directory SettingsThe Directory Settings screen enables you to configure and test your directory services. For additionalinformation on directories, refer to "Directory services (on page 104)." For additional information ondirectory configuration parameters, refer to "Configuring Directory Settings (on page 44)."Configuring iLO 2 43
Change language