Configuring iLO 2 50
After you have selected a certificate, if the certificate is protected with a password or if the certificate is
stored on a smart card, a second page appears prompting you to enter the PIN or password associated
with the chosen certificate.
The certificate is examined by iLO 2 to ensure it was issued by a trusted CA by checking the signature
against the CA certificate configured in iLO 2. iLO 2 determines if the certificate has been revoked and if
it maps to a user in the iLO 2 local user database. If all of these tests pass, then the normal iLO 2 user
interface appears.
If your credential authentication fails, the Login Failed page appears. If login fails, you are instructed to
close the browser, open a new browser page, and try connecting again. If directory authentication is
enabled, and local user authentication fails, iLO 2 displays a login page with the directory user name
field populated with either the User Principal Name from the certificate or the Distinguished Name
(derived from the subject of the certificate). iLO 2 requests the password for the account. After providing
the password, you are authenticated.
Using two-factor authentication with directory authentication
In some cases, configuring two-factor authentication with directory authentication is complicated. iLO 2
can use HP Extended schema or Default Directory schema to integrate with directory services. To ensure
security when two-factor authentication is enforced, iLO 2 uses an attribute from the client certificate as
the directory user's login name. Which client certificate attribute iLO 2 uses is determined by the
Certificate Owner Field configuration setting on the Two-Factor Authentication Settings page. If Certificate
Owner Field is set to SAN, iLO 2 obtains the directory user's login name from the UPN attribute of the
SAN. If the Certificate Owner Field setting is set to Subject, iLO 2 obtains the directory user's
distinguished name from the subject of the certificate.
Which Certificate Owner Field setting to choose depends on the directory integration method used, the
directory architecture, and what information is contained in the user certificates that are issued. The
following examples assume you have the appropriate permissions.
Authentication using Default Directory Schema, part 1:
The distinguished name for a user in the directory
is CN=John Doe,OU=IT,DC=MyCompany,DC=com, and the following are the attributes of John Doe's
certificate:
•
Subject: DC=com/DC=MyCompany/OU=IT/CN=John Doe
•
SAN/UPN: [email protected]
Authenticating to iLO 2 with username:[email protected] and password, will work if two-factor
authentication is
not
enforced. After two-factor authentication is enforced, if SAN is selected on the Two-
Factor Authentication Settings page, the login page automatically populates the Directory User field with
[email protected]. The password can be entered, but the user will
not
be authenticated. The
user is not authenticated because [email protected], which was obtained from the certificate,
is not the distinguished name for the user in the directory. In this case, you must select
Subject
on the Two-
Factor Authentication Settings page. Then the Directory User field on the login page will be populated
