Dell PowerEdge VRTX Chassis Management Controller Version 1.0 for Dell PowerEd - Page 116

Configuring Generic LDAP Users, Configuring the Generic LDAP Directory to Access CMC

Get Dell PowerEdge VRTX PDF manuals and user guides View all Dell PowerEdge VRTX manuals
Add to My Manuals
Save this manual to your list of manuals

Page 116 highlights

NOTE: In this case, you do not have to upload a CA certificate. To enforce the certificate validation during SSL handshake (optional): racadm config -g cfgActiveDirectory -o cfgADCertValidationEnable 1 In this case, you must upload a CA certificate: racadm sslcertupload -t 0x2 -f < ADS root CA certificate > NOTE: If certificate validation is enabled, specify the Domain Controller Server addresses and the FQDN. Make sure that DNS is configured correctly under. Using the following RACADM command may be optional: racadm sslcertdownload -t 0x1 -f < RAC SSL certificate > Configuring Generic LDAP Users CMC provides a generic solution to support Lightweight Directory Access Protocol (LDAP)-based authentication. This feature does not require any schema extension on your directory services. A CMC administrator can now integrate the LDAP server user logins with CMC. This integration requires configuration on both LDAP server and CMC. On the LDAP server, a standard group object is used as a role group. A user who has CMC access becomes a member of the role group. Privileges are still stored on CMC for authorization similar to the working of the Standard Schema setup with Active Directory support. To enable the LDAP user to access a specific CMC card, the role group name and its domain name must be configured on the specific CMC card. You can configure a maximum of five role groups in each CMC. A user has the option to be added to multiple groups within the directory service. If a user is a member of multiple groups, then the user obtains the privileges of all their groups. For information about the privileges level of the role groups and the default role group settings, see Types of Users. Configuring the Generic LDAP Directory to Access CMC The CMC's Generic LDAP implementation uses two phases in granting access to a user-user authentication, and then the user authorization. Authentication of LDAP Users Some directory servers require a bind before a specific LDAP server can be searched for. To authenticate a user: 1. Optionally bind to the Directory Service. The default is an anonymous bind. 2. Search for the user on the basis of the user login. The default attribute is uid. If more than one object is found, then the process returns an error. 3. Unbind and perform a bind with the user's DN and password. If the system is unable to bind, then the login will not be successful. 4. If these steps succeed, the user is authenticated. 116

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
NOTE:
In this case, you do not have to upload a CA certificate.
To enforce the certificate validation during SSL handshake (optional):
racadm config -g cfgActiveDirectory -o cfgADCertValidationEnable 1
In this case, you must upload a CA certificate:
racadm sslcertupload -t 0x2 -f < ADS root CA certificate >
NOTE:
If certificate validation is enabled, specify the Domain Controller Server addresses and the FQDN. Make
sure that DNS is configured correctly under.
Using the following RACADM command may be optional:
racadm sslcertdownload -t 0x1 -f < RAC SSL certificate >
Configuring Generic LDAP Users
CMC provides a generic solution to support Lightweight Directory Access Protocol (LDAP)-based authentication. This
feature does not require any schema extension on your directory services.
A CMC administrator can now integrate the LDAP server user logins with CMC. This integration requires configuration
on both LDAP server and CMC. On the LDAP server, a standard group object is used as a role group. A user who has
CMC access becomes a member of the role group. Privileges are still stored on CMC for authorization similar to the
working of the Standard Schema setup with Active Directory support.
To enable the LDAP user to access a specific CMC card, the role group name and its domain name must be configured
on the specific CMC card. You can configure a maximum of five role groups in each CMC. A user has the option to be
added to multiple groups within the directory service. If a user is a member of multiple groups, then the user obtains the
privileges of all their groups.
For information about the privileges level of the role groups and the default role group settings, see
Types of Users
.
Configuring the Generic LDAP Directory to Access CMC
The CMC's Generic LDAP implementation uses two phases in granting access to a user—user authentication, and then
the user authorization.
Authentication of LDAP Users
Some directory servers require a bind before a specific LDAP server can be searched for.
To authenticate a user:
1.
Optionally bind to the Directory Service. The default is an anonymous bind.
2.
Search for the user on the basis of the user login. The default attribute is
uid
. If more than one object is found,
then the process returns an error.
3.
Unbind and perform a bind with the user's DN and password. If the system is unable to bind, then the login will not
be successful.
4.
If these steps succeed, the user is authenticated.
116