HP Xw460c HP Integrated Lights-Out 2 User Guide for Firmware 1.75 and 1.77 - Page 141

At login time, the login name and user context are combined to make the user's distinguished name. For instance, if the user logs in as "JOHN.SMITH" and a user context is set up as "CN=USERS,DC=HP,DC=COM", then the distinguished name that iLO 2 will try will be "CN=JOHN.SMITH,CN=USERS,DC=HP,DC=COM." Maximum Login Flexibility • Configure iLO 2 as described. • Configure iLO 2 with a DNS name, not an IP address for the directory server's network address. The DNS name must be resolvable to an IP address from both iLO 2 and the client system. • Enable ActiveX controls in your browser. The iLO 2 login script will attempt to call a Windows® control to convert the login name to a distinguished name. Configuring iLO 2 with maximum login flexibility enables you to login using your full distinguished name and password, your name as it appears in the directory, NetBIOS format (domain/login_name), or the e-mail format (login_name@domain). NOTE: Your system security settings or installed software might prevent the login script from calling the Windows® ActiveX control. If this happens, your browser displays a warning message in the status bar, message box, or might stop responding. To help identify what software or setting is causing the problem, create another profile and log in to the system. In some cases, it might not be possible to get the maximum login flexibility option to work. For instance, if the client and iLO 2 are in different DNS domains, one of the two might not be able to resolve the directory server name to an IP address. Schema-free nested groups Many organizations have users and administrators arranged into groups. Having this arrangement of existing groups is convenient because you can associate them with one or more Integrated Lights-Out Management role objects. When the devices are associated with the role objects, you can use the administrator controls to access the Lights-Out devices associated with the role by adding or deleting members from the groups. When using Microsoft® Active Directory, you can place one group within another group, creating a nested group. Role objects are considered groups and can include other groups directly. You can add the existing nested group directly to the role and assign the appropriate rights and restrictions. New users can be added to either the existing group or the role. In previous implementations, only a schema-less user who was a direct member of the primary group was allowed to log in to iLO 2. Using schema-free integration, users who are indirect members (a member of a group which is a nested group of the primary group) are allowed to login to iLO 2. Novell eDirectory does not allow nested groups. In eDirectory, any user that can read a role is considered a member of that role. When adding an existing group, organizational unit or organization to a role, add the object as a read trustee of the role. All the members of the object are considered members of the role. New users can be added to either the existing object or the role. When using trustee or directory rights assignments to extend role membership, users must be able to read the LOM object representing the LOM device. Some environments require the same trustees of a role to also be read trustees of the LOM object to successfully authenticate users. Directory services 141