Configuring iLO 2 58
Setting up HP SIM SSO
The HP SIM SSO page allows you to view and configure the existing iLO 2 Single Sign-On settings. You
must have the Configure iLO 2 privilege to alter these settings. To access iLO 2 SSO settings, click
Administration>Security>HP SIM SSO.
The HP Systems Insight Manager Single Sign-On Settings page includes the following fields and options:
•
Single Sign-On Trust Mode— Enables you to control how SSO-initiated connections are accepted:
o
Trust None (default)—Rejects all SSO connection requests.
o
Trust by Certificate (most secure)—Enables only SSO connections from an HP SIM server
matching a certificate previously imported into iLO 2.
o
Trust by Name—Enables SSO connections from an HP SIM server matching a DNS name or
certificate previously imported into iLO 2.
o
Trust All (least secure)—Accepts any SSO connections initiated from any HP SIM server.
Users who log in to HP SIM are authorized based upon the role assignment at the HP SIM server.
The role assignment is passed to the LOM processor when SSO is attempted. You can configure iLO
2 privileges for each role in the Single Sign-On Settings section. For more information about each
privilege, see the section, "User administration (on page
28
)."
Using directory-based user accounts, SSO attempts to receive only the privileges assigned in this
section. Lights-Out directory settings do not apply. Default privilege assignments are:
o
User—Login only
o
Operator—Login, Remote Console, Power and Reset, and Virtual Media
o
Administrator—Login, Remote Console, Power and Reset, Virtual Media, Configure iLO 2, and
Administer Users
•
HP SIM Trusted Servers—Enables you to view the status of trusted HP SIM servers configured to use
SSO with the current LOM processor. Click
Add a SIM Server
to add a server name, import a server
certificate, or directly install a server certificate. For more information, see the section, "Adding HP
SIM trusted servers (on page
57
)."
The server table displays a list of registered HP SIM servers with the status of each. The actual
number of systems allowed depends on the size of the stored certificate data.
Although a system might be registered, SSO might be refused because of the current trust level or
certificate status. For example, if an HP SIM server name is registered and the trust level is set to Trust
