HP Integrity rx2800 HP Integrity iLO 3 Operations Guide - Page 35

Configuring schema-free LDAP

Get HP Integrity rx2800 - i2 PDF manuals and user guides View all HP Integrity rx2800 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 35 highlights

iLO 3. This is for set up and management. It will not do automatic migration for you. For Integrity iLO 3, you must manually add iLO 3 objects to the directory server and set up user accounts and privileges. You can find the tool on the HP website at http://h20000.www2.hp.com/bizsupport/ TechSupport/SoftwareDescription.jsp?lang=en&cc=US&swItem=MTX-UNITY-I23896. Using directory services after users enter their login and password, the browser sends the cookie to iLO 3. The iLO 3 processor accesses the directory service to determine which roles are available for that user login. The iLO 3 first uses the credentials to access the iLO 3 device object in the directory. The directory service returns only the roles for which the user has rights. If the user credentials allow read access to the iLO 3 device object and the role object, iLO 3 determines the role object distinguished name and the associated user privileges. The iLO 3 then calculates the current user privileges based on those roles and grants them to that user. Configuring schema-free LDAP IMPORTANT: Due to command syntax changes in schema-free LDAP, some customer-developed scripts may not run. You must change any scripts you developed to enable them to run with the new schema-free LDAP syntax. Integrity iLO 3 schema-free directory integration enables you to use the standard directory schema instead of adding HP schema to the directory database. You accomplish this by authenticating users from the directory database and authorizing iLO 3 privileges based on matching groups stored on each iLO 3. In addition to general directory integration benefits, iLO 3 schema-free integration provides the following advantages: • Easy implementation without schema extensions. iLO 3 schema-free integration is configured from any iLO 3 user interface (browser, command line, or script). • Minimal administration and maintenance. ◦ After initial setup, only groups and permissions require maintenance support on iLO 3; typically group and permission changes occur infrequently. ◦ The schema-free approach does not require updating directory databases with new iLO 3 devices objects. • Reliable security. Integrity iLO 3 schema-free integration does not affect standard directory attributes, avoiding conflicting use of attributes that can result over time. • Complements two-factor authentication. Integrity iLO 3 schema-free integration can be used in conjunction with iLO 3 two-factor authentication to provide asset protection using strong authentication. NOTE: If you have already extended your directory with HP schema, there is no need to switch to the schema-free approach. Schema extension provides the lowest maintenance approach for directory integration. When this process has taken place, there is no advantage for the schema-free approach until a schema change is required. To configure schema-free LDAP: 1. Follow the procedure for "Configuring LDAP extended schema" (page 33), but omit Step 8. It is not necessary to enter a new port number. 2. Set up directory security groups. Configuring schema-free LDAP 35

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
iLO 3. This is for set up and management. It will not do automatic migration for you. For Integrity
iLO 3, you must manually add iLO 3 objects to the directory server and set up user accounts and
privileges. You can find the tool on the HP website at
h
t
tp://h20000.w
w
w2
.hp
.co
m/b
i
zsu
ppo
r
t/
T
ec
hSu
ppo
r
t/S
o
f
t
w
ar
eD
e
s
c
r
ipti
o
n
.js
p?lang=e
n&cc=U
S&s
wIt
e
m=MTX
-UNI
T
Y
-I2
3
8
9
6
.
Using directory services after users enter their login and password, the browser sends the cookie
to iLO 3. The iLO 3 processor accesses the directory service to determine which roles are available
for that user login. The iLO 3 first uses the credentials to access the iLO 3 device object in the
directory. The directory service returns only the roles for which the user has rights. If the user
credentials allow read access to the iLO 3 device object and the role object, iLO 3 determines the
role object distinguished name and the associated user privileges. The iLO 3 then calculates the
current user privileges based on those roles and grants them to that user.
Configuring schema-free LDAP
IMPORTANT:
Due to command syntax changes in schema-free LDAP, some customer-developed
scripts may not run. You must change any scripts you developed to enable them to run with the
new schema-free LDAP syntax.
Integrity iLO 3 schema-free directory integration enables you to use the standard directory schema
instead of adding HP schema to the directory database. You accomplish this by authenticating
users from the directory database and authorizing iLO 3 privileges based on matching groups
stored on each iLO 3.
In addition to general directory integration benefits, iLO 3 schema-free integration provides the
following advantages:
•
Easy implementation without schema extensions.
iLO 3 schema-free integration is configured from any iLO 3 user interface (browser, command
line, or script).
•
Minimal administration and maintenance.
After initial setup, only groups and permissions require maintenance support on iLO 3;
typically group and permission changes occur infrequently.
◦
◦
The schema-free approach does not require updating directory databases with new iLO
3 devices objects.
•
Reliable security.
Integrity iLO 3 schema-free integration does not affect standard directory attributes, avoiding
conflicting use of attributes that can result over time.
•
Complements two-factor authentication.
Integrity iLO 3 schema-free integration can be used in conjunction with iLO 3 two-factor
authentication to provide asset protection using strong authentication.
NOTE:
If you have already extended your directory with HP schema, there is no need to switch
to the schema-free approach. Schema extension provides the lowest maintenance approach for
directory integration. When this process has taken place, there is no advantage for the schema-free
approach until a schema change is required.
To configure schema-free LDAP:
1.
Follow the procedure for
“Configuring LDAP extended schema” (page 33)
, but omit Step 8.
It is not necessary to enter a new port number.
2.
Set up directory security groups.
Configuring schema-free LDAP
35