HP Ilo 3 User Guide

2.Isyourconfigurationscalable?
•No—Deployaninstanceoftheschema-freedirectoryintegrationtoevaluatewhetherthis
methodmeetsyourpolicyandproceduralrequirements.Ifnecessary,youcandeployHP
schemadirectoryintegrationlater.Formoreinformation,see“Schema-freedirectory
integration”(page166).
•Yes—UseHPschemadirectoryintegration.Formoreinformation,see“SettingupHP
extendedschemadirectoryintegration”(page170).
Thefollowingquestionscanhelpyoudeterminewhetheryourconfigurationisscalable:...

Generatingakeytab
ThissectiondescribeshowtogenerateakeytabfileforiLOinaWindowsenvironment.
TheiLOhostnamethatyouuseforkeytabgenerationmustbeidenticaltotheconfigurediLOhost
name.iLOhostnamesarecasesensitive.
1.Usethektpasscommandtogenerateakeytabandsetthesharedsecret.
Thecommandiscasesensitiveandhasspecialcharacters.
ktpass -out iloname.keytab +rndPass -ptype KRB5_NT_SRV_HST -mapuser
[email protected] -princ HTTP/[email protected]
Theoutputshouldbesimilartothefollowing:
Targeting domain...

Universalandglobalusergroups(forauthorization)
TosetpermissionsiniLO,youmustcreateagroupinthedomaindirectory.Userswhologinto
iLOaregrantedthesumofthepermissionsforallgroupsofwhichtheyareamember.Only
universalandglobalusergroupscanbeusedtosetpermissions.Domainlocalgroupsarenot
supported.
ConfiguringiLOforKerberoslogin
ThissectiondescribestheiLOrequirementsforKerberoslogin.YoucanconfigureiLOforKerberos
loginusingtheiLOwebinterface,XMLconfigurationandcontrolscripts,ortheCLI,CLP,orSSH
interface....

UsingXMLconfigurationandcontrolscripts
ThefollowingsamplescriptsshowhowtosettheiLOparametersfordirectories:
•Set_Server_Name.xmlshowshowtosettheiLOhostname.
•Mod_Schemaless_Directory.xmlshowshowtoconfiguredirectorygroups.
•Mod_Network_Settings.xmlshowshowtoconfigureSNTPsettings.
•Mod_Kerberos_Config.xmlshowshowtoconfigureKerberos-specificparameters.
NOTE:YoucandownloadsampleXMLscriptsfromhttp://www.hp.com/support/ilo3.Formore
information,seetheHPiLO3ScriptingandCommandLineGuide....

1.EnableauthenticationinInternetExplorer:
a.SelectTools→InternetOptions.
b.ClicktheAdvancedtab.
c.ScrolltotheSecuritysection.
d.VerifythattheEnableIntegratedWindowsAuthenticationoptionisselected.
e.ClickOK.
2.AddtheiLOdomaintotheIntranetzone:
a.SelectTools→InternetOptions.
b.ClicktheSecuritytab.
c.ClicktheLocalintraneticon.
d.ClicktheSitesbutton.
e.ClicktheAdvancedbutton.
f.EnterthesitetoaddintheAddthiswebsitetothezonebox.
Onacorporatenetwork,*.example.netissufficient.
g.ClickAdd.
h.ClickClose....

Verifyingsinglesign-on(HPZeroSignIn)configuration
ToverifythatHPZeroSignInisconfiguredcorrectly:
1.BrowsetotheiLOloginpage(forexample, http://iloname.example.net).
2.ClicktheHPZeroSignInbutton.
Ifapromptforcredentialsappears,Kerberosauthenticationhasfailedandthesystemhas
revertedtoNTLMauthentication.ClickCancel,andthenrepeattheproceduresin“Configuring
singlesign-on”(page164).
Loginbyname
Toverifythatloginbynameisworkingproperly:
1.BrowsetotheiLOloginpage(forexample, http://iloname.example.net)....

Usingschema-freedirectoryintegrationhasthefollowingdisadvantage:
•GroupprivilegesareadministeredoneachiLO.However,thisdisadvantagehasminimal
impactbecausegroupprivilegesrarelychange,andthetaskofchanginggroupmembership
isadministeredinthedirectoryandnotoneachiLO.HPprovidestoolsthatenableyouto
makechangestoalargenumberofiLOsatthesametime.
Settingupschema-freedirectoryintegration
Ifyouwanttousetheschema-freedirectoryintegrationmethod,yoursystemmustmeetthe...

5.ClickFinish,andthenclickCloseandOKtoclosetheremainingdialogboxes.
6.ExpandComputerConfiguration→WindowsSettings→SecuritySettings→PublicKey.
7.Right-clickAutomaticCertificateRequestsSettings,andselectNew→AutomaticCertificate
Request.
TheAutomaticCertificateRequestSetupwizardstarts.
8.ClickNext.
9.SelecttheDomainControllertemplate,andclickNext.
10.Selectthelistedcertificateauthority(itisthesameCAthatwasdefinedduringtheCertificate
Servicesinstallation).ClickNext.
11.ClickFinishtoclosethewizard....

Formoreinformation,see“HPDirectoriesSupportforProLiantManagementProcessorsutility”
(page196).
Schema-freesetupoptions
Theschema-freesetupoptionsarethesame,regardlessofthemethodyouusetoconfigurethe
directory.
Toreviewtheavailablemethods,see“Schema-freesetupusingtheiLOwebinterface”(page168),
“Schema-freesetupusingscripts”(page168),and“Schema-freesetupwithHPDirectoriesSupport
forProLiantManagementProcessors”(page168).
Afteryouenabledirectoriesandselecttheschema-freeoption,youhavethefollowingoptions:...

Whenyouareusingtrusteeordirectoryrightsassignmentstoextendrolemembership,usersmust
beabletoreadtheobjectthatrepresentstheiLOdevice.Someenvironmentsrequirethatthe
trusteesofarolealsobereadtrusteesoftheobjecttosuccessfullyauthenticateusers.
SettingupHPextendedschemadirectoryintegration
WhenyouareusingHPschemadirectoryintegration,iLOsupportsbothActiveDirectoryand
eDirectory.However,thesedirectoryservicesrequirethattheschemabeextended.
FeaturessupportedbyHPschemadirectoryintegration...