HP Xw460c HP Integrated Lights-Out 2 User Guide for Firmware 1.75 and 1.77 - Page 50

After you have selected a certificate, if the certificate is protected with a password or if the certificate is stored on a smart card, a second page appears prompting you to enter the PIN or password associated with the chosen certificate. The certificate is examined by iLO 2 to ensure it was issued by a trusted CA by checking the signature against the CA certificate configured in iLO 2. iLO 2 determines if the certificate has been revoked and if it maps to a user in the iLO 2 local user database. If all of these tests pass, then the normal iLO 2 user interface appears. If your credential authentication fails, the Login Failed page appears. If login fails, you are instructed to close the browser, open a new browser page, and try connecting again. If directory authentication is enabled, and local user authentication fails, iLO 2 displays a login page with the directory user name field populated with either the User Principal Name from the certificate or the Distinguished Name (derived from the subject of the certificate). iLO 2 requests the password for the account. After providing the password, you are authenticated. Using two-factor authentication with directory authentication In some cases, configuring two-factor authentication with directory authentication is complicated. iLO 2 can use HP Extended schema or Default Directory schema to integrate with directory services. To ensure security when two-factor authentication is enforced, iLO 2 uses an attribute from the client certificate as the directory user's login name. Which client certificate attribute iLO 2 uses is determined by the Certificate Owner Field configuration setting on the Two-Factor Authentication Settings page. If Certificate Owner Field is set to SAN, iLO 2 obtains the directory user's login name from the UPN attribute of the SAN. If the Certificate Owner Field setting is set to Subject, iLO 2 obtains the directory user's distinguished name from the subject of the certificate. Which Certificate Owner Field setting to choose depends on the directory integration method used, the directory architecture, and what information is contained in the user certificates that are issued. The following examples assume you have the appropriate permissions. Authentication using Default Directory Schema, part 1: The distinguished name for a user in the directory is CN=John Doe,OU=IT,DC=MyCompany,DC=com, and the following are the attributes of John Doe's certificate: • Subject: DC=com/DC=MyCompany/OU=IT/CN=John Doe • SAN/UPN: [email protected] Authenticating to iLO 2 with username:[email protected] and password, will work if two-factor authentication is not enforced. After two-factor authentication is enforced, if SAN is selected on the TwoFactor Authentication Settings page, the login page automatically populates the Directory User field with [email protected]. The password can be entered, but the user will not be authenticated. The user is not authenticated because [email protected], which was obtained from the certificate, is not the distinguished name for the user in the directory. In this case, you must select Subject on the TwoFactor Authentication Settings page. Then the Directory User field on the login page will be populated Configuring iLO 2 50