Directory-enabled remote management 166
Directory-enabled remote management
Introduction to directory-enabled remote
management
This section is for administrators who are familiar with directory services and the iLO 2 product and want
to use the HP schema directory integration option for iLO 2. You must be familiar with the “Directory
services (on page
134
)" section and comfortable with setting up and understanding the examples.
Directory-enabled remote management enables you to:
•
Create Lights-Out Management Objects
You must create one LOM device object to represent each device that will use the directory service to
authenticate and authorize users. Refer to the "Directory services (on page
134
)" section for
additional information on creating LOM device objects for Active Directory ("
Directory services for
Active Directory
" on page
147
) and eDirectory ("
Directory services for eDirectory
" on page
157
). In
general, you can use the HP provided snap-ins to create objects. It is useful to give the LOM device
objects meaningful names, such as the device network address, DNS name, host server name, or
serial number.
•
Configure the Lights-Out management devices
Every LOM device that uses the directory service to authenticate and authorize users must be
configured with the appropriate directory settings. Refer to "Configuring directory settings (on page
52
)" for details on the specific directory settings. In general, you can configure each device with the
appropriate directory server address, LOM object distinguished name, and any user contexts. The
server address is either the IP address or DNS name of a local directory server or, for more
redundancy, a multi-host DNS name.
Creating roles to follow organizational structure
Often, the administrators within an organization are placed into a hierarchy in which subordinate
administrators must assign rights independently of ranking administrators. In this case, it is useful to have
one role that represents the rights assigned by higher-level administrators and to allow the subordinate
administrators to create and manage their own roles.
Using existing groups
Many organizations will have their users and administrators arranged into groups. In many cases, it is
convenient to use the existing groups and associate the groups with one or more Lights-Out Management
role objects. When the devices are associated with the role objects, the administrator controls access to
the Lights-Out devices associated with the role by adding or deleting members from the groups.
When using Microsoft® Active Directory, it is possible to place one group within another or nested
groups. Role objects are considered groups and can include other groups directly. Add the existing
