Dell PowerEdge R830 Integrated Remote Access Controller 8 Version 2.70.70.70 U - Page 143

Configuring iDRAC for Single Sign-On or smart card login

Page 143 highlights

8 Configuring iDRAC for Single Sign-On or smart card login This section provides information to configure iDRAC for Smart Card login (for local users and Active Directory users), and Single Sign-On (SSO) login (for Active Directory users.) SSO and smart card login are licensed features. iDRAC supports Kerberos based Active Directory authentication to support Smart Card and SSO logins. For information on Kerberos, see the Microsoft website. Related tasks Configuring iDRAC SSO login for Active Directory users Configuring iDRAC smart card login for local users Configuring iDRAC smart card login for Active Directory users Topics: • Prerequisites for Active Directory Single Sign-On or smart card login • Configuring iDRAC SSO login for Active Directory users • Configuring iDRAC smart card login for local users • Configuring iDRAC smart card login for Active Directory users • Enabling or disabling smart card login Prerequisites for Active Directory Single Sign-On or smart card login The prerequisites to Active Directory based SSO or Smart Card logins are: • Synchronize iDRAC time with the Active Directory domain controller time. If not, kerberos authentication on iDRAC fails. You can use the Time zone and NTP feature to synchronize the time. To do this, see Configuring time zone and ntp. • Register iDRAC as a computer in the Active Directory root domain. • Generate a keytab file using the ktpass tool. • To enable Single Sign-On for Extended schema, make sure that the Trust this user for delegation to any service (Kerberos only) option is selected on the Delegation tab for the keytab user. This tab is available only after creating the keytab file using ktpass utility. • Configure the browser to enable SSO login. • Create the Active Directory objects and provide the required privileges. • For SSO, configure the reverse lookup zone on the DNS servers for the subnet where iDRAC resides. NOTE: If the host name does not match the reverse DNS lookup, Kerberos authentication fails. • Configure the browser to support SSO login. For more information, see Configuring supported web browsers. NOTE: Google Chrome and Safari do not support Active Directory for SSO login. Related tasks Registering iDRAC as a computer in Active Directory root domain Generating Kerberos keytab file Creating Active Directory objects and providing privileges Configuring iDRAC for Single Sign-On or smart card login 143

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
  • 231
  • 232
  • 233
  • 234
  • 235
  • 236
  • 237
  • 238
  • 239
  • 240
  • 241
  • 242
  • 243
  • 244
  • 245
  • 246
  • 247
  • 248
  • 249
  • 250
  • 251
  • 252
  • 253
  • 254
  • 255
  • 256
  • 257
  • 258
  • 259
  • 260
  • 261
  • 262
  • 263
  • 264
  • 265
  • 266
  • 267
  • 268
  • 269
  • 270
  • 271
  • 272
  • 273
  • 274
  • 275
  • 276
  • 277
  • 278
  • 279
  • 280
  • 281
  • 282
  • 283
  • 284
  • 285
  • 286
  • 287
  • 288
  • 289
  • 290
  • 291
  • 292
  • 293
  • 294
  • 295
  • 296
  • 297
  • 298

Configuring iDRAC for Single Sign-On or
smart card login
This section provides information to configure iDRAC for Smart Card login (for local users and Active Directory users), and Single Sign-On
(SSO) login (for Active Directory users.) SSO and smart card login are licensed features.
iDRAC supports Kerberos based Active Directory authentication to support Smart Card and SSO logins. For information on Kerberos, see
the Microsoft website.
Related tasks
Configuring iDRAC SSO login for Active Directory users
Configuring iDRAC smart card login for local users
Configuring iDRAC smart card login for Active Directory users
Topics:
Prerequisites for Active Directory Single Sign-On or smart card login
Configuring iDRAC SSO login for Active Directory users
Configuring iDRAC smart card login for local users
Configuring iDRAC smart card login for Active Directory users
Enabling or disabling smart card login
Prerequisites for Active Directory Single Sign-On
or smart card login
The prerequisites to Active Directory based SSO or Smart Card logins are:
Synchronize iDRAC time with the Active Directory domain controller time. If not, kerberos authentication on iDRAC fails. You can use
the Time zone and NTP feature to synchronize the time. To do this, see
Configuring time zone and ntp
.
Register iDRAC as a computer in the Active Directory root domain.
Generate a keytab file using the ktpass tool.
To enable Single Sign-On for Extended schema, make sure that the
Trust this user for delegation to any service (Kerberos only)
option is selected on the
Delegation
tab for the keytab user. This tab is available only after creating the keytab file using ktpass utility.
Configure the browser to enable SSO login.
Create the Active Directory objects and provide the required privileges.
For SSO, configure the reverse lookup zone on the DNS servers for the subnet where iDRAC resides.
NOTE:
If the host name does not match the reverse DNS lookup, Kerberos authentication fails.
Configure the browser to support SSO login. For more information, see
Configuring supported web browsers
.
NOTE:
Google Chrome and Safari do not support Active Directory for SSO login.
Related tasks
Registering iDRAC as a computer in Active Directory root domain
Generating Kerberos keytab file
Creating Active Directory objects and providing privileges
8
Configuring iDRAC for Single Sign-On or smart card login
143