HP Integrity rx2800 HP Integrity iLO 3 Operations Guide - Page 132

User address restrictions, Creating multiple restrictions and roles, User time restrictions

Get HP Integrity rx2800 - i2 PDF manuals and user guides View all HP Integrity rx2800 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 132 highlights

Figure 60 User time restrictions User address restrictions You can place network address restrictions on a directory user account, and the directory server enforces these restrictions. For information about the enforcement of address restrictions on LDAP clients, such as a user logging in to an iLO 3 device, see the directory service documentation. Network address restrictions placed on the user in the directory may not be enforced in the expected manner if the directory user logs in through a proxy server. When a user logs in to an iLO 3 device as a directory user, the iLO 3 device attempts authentication to the directory as that user, which means that address restrictions placed on the user account apply when accessing the iLO 3 device. However, because the user is proxied at the iLO 3 device, the network address of the authentication attempt is that of the iLO 3 device, not that of the client workstation. Creating multiple restrictions and roles The most useful application of multiple roles includes restricting one or more roles so that rights do not apply in all situations. Other roles provide different rights under different constraints. Using multiple restrictions and roles enables you to create arbitrary, complex rights relationships with a minimum number of roles. For example, an organization might have a security policy in which iLO 3 administrators are allowed to use the iLO 3 device from within the corporate network but are only able to reset the server outside of regular business hours. Directory administrators may be tempted to create two roles to address this situation, but extra caution is required. Creating a role that provides the required server reset rights and restricting it to an after-hours application might allow administrators outside the corporate network, to reset the server, which is contrary to most security policies. Figure 61 shows how security policy dictates that general use is restricted to clients within the corporate subnet, and server reset capability is additionally restricted to after hours. 132 Installing and configuring directory services

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
Figure 60 User time restrictions
User address restrictions
You can place network address restrictions on a directory user account, and the directory server
enforces these restrictions. For information about the enforcement of address restrictions on LDAP
clients, such as a user logging in to an iLO 3 device, see the directory service documentation.
Network address restrictions placed on the user in the directory may not be enforced in the expected
manner if the directory user logs in through a proxy server. When a user logs in to an iLO 3 device
as a directory user, the iLO 3 device attempts authentication to the directory as that user, which
means that address restrictions placed on the user account apply when accessing the iLO 3 device.
However, because the user is proxied at the iLO 3 device, the network address of the authentication
attempt is that of the iLO 3 device, not that of the client workstation.
Creating multiple restrictions and roles
The most useful application of multiple roles includes restricting one or more roles so that rights do
not apply in all situations. Other roles provide different rights under different constraints. Using
multiple restrictions and roles enables you to create arbitrary, complex rights relationships with a
minimum number of roles.
For example, an organization might have a security policy in which iLO 3 administrators are
allowed to use the iLO 3 device from within the corporate network but are only able to reset the
server outside of regular business hours.
Directory administrators may be tempted to create two roles to address this situation, but extra
caution is required. Creating a role that provides the required server reset rights and restricting it
to an after-hours application might allow administrators outside the corporate network, to reset the
server, which is contrary to most security policies.
Figure 61
shows how security policy dictates that general use is restricted to clients within the
corporate subnet, and server reset capability is additionally restricted to after hours.
132
Installing and configuring directory services