HP rp3440 HP Integrity and HP 9000 iLO MP Operations Guide, Fifth Edition - Page 46

Login Process Using Directory Services with Extended LDAP, Configuring LDAP Lite Default Schema

Get HP rp3440 PDF manuals and user guides View all HP rp3440 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 46 highlights

Login Process Using Directory Services with Extended LDAP You can choose to enable directory services to authenticate users and authorize user privileges for groups of the iLO MPs. The iLO MP directory services feature uses the industry-standard LDAP. HP layers LDAP on top of SSL to transmit the directory services information securely to the directory servers. More information about directory services is available from the HP web site at: http://www.hp.com/servers/lights-out Using directory services after a user enters their login and password, the browser sends the cookie to the iLO MP. The iLO MP accesses the directory service to determine which roles are available for that user login. The iLO MP first uses the credentials to access the iLO MP device object in the directory. The directory service returns only the roles for which the user has rights. If the user credentials allow read access to the iLO MP device object and the role object, the iLO MP determines the role object's distinguished name and the associated user privileges. The iLO MP then calculates the current user privileges based on those roles and grants them to that user. Configuring LDAP Lite Default Schema The iLO MP schema-free directory integration enables you to use the standard directory schema instead of adding HP's schema to the directory database. You accomplish this by authenticating users from the directory database and authorizing iLO MP privileges based on matching groups stored on each iLO MP. NOTE: The LDAP feature is available only if you have the iLO MP Advanced Pack license. In addition to general directory integration benefits, the iLO MP schema-free integration provides the following advantages: • Easy implementation without schema extensions. The iLO MP schema-free integration is configured from any iLO MP user interface (browser, command line or script). • Minimal administration and maintenance: - After initial setup, only groups and permissions require maintenance support on iLO MPs; typically group and permission changes occur infrequently. - The schema-free approach does not require updating directory databases with new iLO MP devices objects. • Reliable security. iLO MP schema-free integration does not affect standard directory attributes, avoiding conflicting use of attributes that might result over time. • Complements two-factor authentication. iLO MP schema-free integration can be used in conjunction with iLO MP two-factor authentication to provide asset protection using strong authentication. NOTE: If you have already extended your directory with HP schema, there is no need to switch to the schema-free approach. Schema extension provides the lowest maintenance approach for directory integration and once this process has taken place there is no advantage for the schema-free approach until a schema change is required. To configure LDAP Lite, follow these steps: 1. Follow the procedure for "Configuring LDAP Extended Schema" (page 44), but omit step 8. It is not necessary to enter a new port number. 2. Set up directory security groups. 46 Configuring DHCP, DNS, LDAP, and LDAP Lite

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
Login Process Using Directory Services with Extended LDAP
You can choose to enable directory services to authenticate users and authorize user privileges
for groups of the iLO MPs. The iLO MP directory services feature uses the industry-standard
LDAP. HP layers LDAP on top of SSL to transmit the directory services information securely to
the directory servers. More information about directory services is available from the HP web
site at:
http://www
.hp.com/serv
ers/lights-out
Using directory services after a user enters their login and password, the browser sends the
cookie to the iLO MP. The iLO MP accesses the directory service to determine which roles are
available for that user login. The iLO MP first uses the credentials to access the iLO MP device
object in the directory. The directory service returns only the roles for which the user has rights.
If the user credentials allow read access to the iLO MP device object and the role object, the iLO
MP determines the role object’s distinguished name and the associated user privileges. The iLO
MP then calculates the current user privileges based on those roles and grants them to that user.
Configuring LDAP Lite Default Schema
The iLO MP schema-free directory integration enables you to use the standard directory schema
instead of adding HP’s schema to the directory database. You accomplish this by authenticating
users from the directory database and authorizing iLO MP privileges based on matching groups
stored on each iLO MP.
NOTE:
The LDAP feature is available only if you have the iLO MP Advanced Pack license.
In addition to general directory integration benefits, the iLO MP schema-free integration provides
the following advantages:
•
Easy implementation without schema extensions. The iLO MP schema-free integration is
configured from any iLO MP user interface (browser, command line or script).
•
Minimal administration and maintenance:
—
After initial setup, only groups and permissions require maintenance support on iLO
MPs; typically group and permission changes occur infrequently.
—
The schema-free approach does not require updating directory databases with new iLO
MP devices objects.
•
Reliable security. iLO MP schema-free integration does not affect standard directory
attributes, avoiding conflicting use of attributes that might result over time.
•
Complements two-factor authentication. iLO MP schema-free integration can be used in
conjunction with iLO MP two-factor authentication to provide asset protection using strong
authentication.
NOTE:
If you have already extended your directory with HP schema, there is no need to switch
to the schema-free approach. Schema extension provides the lowest maintenance approach for
directory integration and once this process has taken place there is no advantage for the
schema-free approach until a schema change is required.
To configure LDAP Lite, follow these steps:
1.
Follow the procedure for
“Configuring LDAP Extended Schema” (page 44)
, but omit step
8. It is not necessary to enter a new port number.
2.
Set up directory security groups.
46
Configuring DHCP, DNS, LDAP, and LDAP Lite