HP Ilo 4 User Guide

Verifyingsinglesign-on(HPZeroSignIn)configuration
ToverifythatHPZeroSignInisconfiguredcorrectly:
1.BrowsetotheiLOloginpage(forexample, http://iloname.example.net).
2.ClicktheHPZeroSignInbutton.
Ifapromptforcredentialsappears,Kerberosauthenticationhasfailedandthesystemhas
revertedtoNTLMauthentication.ClickCancel,andthenrepeattheproceduresin“Configuring
singlesign-on”(page269).
Loginbyname
Toverifythatloginbynameisworkingproperly:
1.BrowsetotheiLOloginpage(forexample, http://iloname.example.net)....

Usingschema-freedirectoryintegrationhasthefollowingdisadvantage:
•GroupprivilegesareadministeredoneachiLO.However,thisdisadvantagehasminimal
impactbecausegroupprivilegesrarelychange,andthetaskofchanginggroupmembership
isadministeredinthedirectoryandnotoneachiLO.HPprovidestoolsthatenableyouto
makechangestoalargenumberofiLOsatthesametime.
Settingupschema-freedirectoryintegration
Ifyouwanttousetheschema-freedirectoryintegrationmethod,yoursystemmustmeetthe...

7.Right-clickAutomaticCertificateRequestsSettings,andselectNew→AutomaticCertificate
Request.
TheAutomaticCertificateRequestSetupwizardstarts.
8.ClickNext.
9.SelecttheDomainControllertemplate,andclickNext.
10.Selectthelistedcertificateauthority(itisthesameCAthatwasdefinedduringtheCertificate
Servicesinstallation).ClickNext.
11.ClickFinishtoclosethewizard.
Schema-freesetupusingtheiLOwebinterface
Youcansetupaschema-freeconfigurationbyusingtheiLOwebinterface.Onlyuserswhohave...

Schema-freesetupoptions
Theschema-freesetupoptionsarethesame,regardlessofthemethodyouusetoconfigurethe
directory.
Toreviewtheavailablemethods,see“Schema-freesetupusingtheiLOwebinterface”(page273),
“Schema-freesetupusingscripts”(page273),and“Schema-freesetupwithHPDirectoriesSupport
forProLiantManagementProcessors”(page273).
Afteryouenabledirectoriesandselecttheschema-freeoption,youhavethefollowingoptions:
Minimumloginflexibility
•EnterthedirectoryserverDNSnameorIPaddressandLDAPport.Typically,theLDAPport...

SettingupHPextendedschemadirectoryintegration
WhenyouuseHPschemadirectoryintegration,iLOsupportsActiveDirectory.Thisdirectoryservice
requiresthattheschemabeextended.
FeaturessupportedbyHPschemadirectoryintegration
UsingtheHPschemaenablesyoutodothefollowing:
•Authenticateusersfromashared,consolidated,scalableuserdatabase.
•Controluserprivileges(authorization)byusingthedirectoryservice.
•Userolesinthedirectoryserviceforgroup-leveladministrationofiLOmanagementprocessors
andiLOusers....

4.Manage
a.Createamanagementdeviceobjectandaroleobjectbyusingthesnap-in.
b.Assignrightstotheroleobject,asnecessary,andassociatetherolewiththemanagement
deviceobject.
c.Adduserstotheroleobject.
Formoreinformationaboutmanagingthedirectoryservice,see“Directory-enabledremote
management”(page287).Examplesareavailablein“DirectoryservicesforActiveDirectory”
(page279).
5.Handleexceptions
iLOmigrationutilitiesareeasiertousewithasinglerole.Ifyouplantocreatemultipleroles...

installer,youmustinstallaGUIonthedomaincontrolleroruseadomaincontrollerthathostsan
earlierversionofWindows.
SchemaExtender
Several.xmlfilesarebundledwiththeSchemaExtender.Thesefilescontaintheschemasthat
areaddedtothedirectory.Typically,oneofthesefilescontainsacoreschemathatiscommonto
allofthesupporteddirectoryservices.Additionalfilescontainproduct-specificschemas.Theschema
installerrequiresthe.NETFramework.
TheSchemaExtenderinstallerincludesthreeimportantwindows:
•SchemaPreview
•Setup
•Results...

TheDirectoryServersectionoftheSetupwindowenablesyoutoselectActiveDirectory,andto
setthecomputernameandtheporttobeusedforLDAPcommunications.
NOTE:WhenyouarerunningtheSchemaExtendertool,youmustusetheAdministrator
loginalongwiththedomainname,forexample,[email protected]\
Administrator.
ExtendingtheschemaforActiveDirectoryrequiresthattheuserisanauthenticatedschema
administrator,thattheschemaisnotwriteprotected,andthatthedirectoryistheFSMOroleowner...

Managementsnap-ininstaller
Themanagementsnap-ininstallerinstallsthesnap-insrequiredtomanageiLOobjectsinaMicrosoft
ActiveDirectoryUsersandComputersdirectoryorNovellConsoleOnedirectory.
iLOsnap-insareusedtoperformthefollowingtasksincreatinganiLOdirectory:
•CreatingandmanagingtheiLOobjectsandroleobjects
•MakingtheassociationsbetweentheiLOobjectsandtheroleobjects
DirectoryservicesforActiveDirectory
Thefollowingsectionsprovideinstallationprerequisites,preparationinstructions,andaworking...

KnowledgeBaseArticle321051:HowtoEnableLDAPoverSSLwithaThird-Party
CertificationAuthority.
InstallingActiveDirectory
Fortheschema-freeconfiguration
1.InstallActiveDirectory,DNS,andtherootCA.
2.LogintoiLOandenterthedirectorysettingsanddirectoryusercontextsonthe
Administration→Security→Directorypage.
Formoreinformation,see“Configuringdirectorysettings”(page72).
3.ClickApplySettingstosavethechanges.
4.ClicktheAdministerGroupsbutton,andthencreatedirectorygroupsfortheiLOusers....