Directory services 137
A role contains one or more iLO 2 and one or more users, and has a list of privileges that these users
have with the iLO 2 in the role. All iLO 2 access is managed by adding and removing users and iLO 2 to
and from the role, and by managing the privileges on the role. For example:
Advantages of using HP schema directory integration:
o
Greater flexibility controlling access. For example, you can limit access to a time of day or by a
certain range of IP addresses.
o
Groups and permissions are maintained in the directory, not on each iLO 2, and HP provides the
snap-ins required for managing HP groups and targets for Active Directory Users and Computers,
and eDirectory ConsoleOne.
o
Integration with eDirectory
Disadvantages of HP schema directory integration
•
The directory schema must be extended. However, this task is minimized because HP provides the
.ldf file and a wizard to extend the schema, and later versions of Active Directory enable you to
undo schema changes.
For information about how to extend the schema and configuration of directory settings information,
see
Integrating HP ProLiant Lights-Out processors with Microsoft® Active Directory
(
http://h20000.www2.hp.com/bc/docs/support/SupportManual/c00190541/c00190541.pdf
).
•
Certificate requirements
iLO 2 must communicate with the directory using LDAP over SSL. This communication requires the
directory server to have a certificate. Installing the certificate for the domain replicates it throughout
the domain controllers in the domain. For information about installing the certificate, refer to the
Customer Advisory available on the HP website
(
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=PSD_EM030604_
CW01&locale=en_US
).
•
Failover options
To enable failover (redundancy), use the domain name as the directory server name when
configuring iLO 2. Most DNS servers resolve a domain name to a working directory server (domain
controller).
•
Login format
NetBIOS, UPN, and distinguished name formats are accepted for login names. The login script for
iLO 2 communicates with the client operating system and attempts to translate the login name into a
directory distinguished name. For the login script to do this, the directory name must be a DNS
name, not an IP address. Also, both the client and iLO 2 must be able to access the directory server
using the same name. Both the client and iLO 2 must be in the same DNS domain.
