HP ntegrity iLO 2 MP, Operation Manual

Page: 179 / 199

Figure 7-26 Restricting General Use
Alternatively, the directory administrator could create a role that grants the login right and
restrict it to the corporate network, create another role that grants only the server reset right and
restrict it to after-hours operation. This configuration is easier to manage but more dangerous
because ongoing administration can create another role that grants users from addresses outside
the corporate network the login right, which could unintentionally grant the iLO 2 MP
administrators in the server reset role the ability to reset the server from anywhere, provided
they satisfy the time constraints of that role.
The previous configuration satisfies corporate security policy. However, adding another role
that grants the login right can inadvertently grant server reset privileges from outside the corporate
subnet after hours. A more manageable solution would be to restrict the reset role, as well as the
general use role.
Figure 7-27 Restricting the Reset Role
Directory Services Schema (LDAP)
A directory schema specifies the types of objects that a directory can have and the mandatory
and optional attributes of each object type. The following sections describe both the HP
management core, and the LDAP object identifier classes and attributes that are specific to iLO
2 MP.
HP Management Core LDAP Object Identifier Classes and Attributes
Object identifiers (OIDs) are unique numbers that are used by LDAP to identify object class,
attribute, syntaxes (data types), matching rules, protocol mechanisms, controls, extended operation
and supported features.
Directory Services Schema (LDAP) 179