Hp Integrated Lights-Out 4 User Manual download pdf (Page 251)

2. Is your configuration scalable?

• No—Deploy an instance of the schema-free directory integration to evaluate whether this

method meets your policy and procedural requirements. If necessary, you can deploy HP

schema directory integration later. For more information, see “Schema-free directory

integration” (page 256).

• Yes—Use HP schema directory integration. For more information, see “Setting up HP

extended schema directory integration” (page 260).

The following questions can help you determine whether your configuration is scalable:

• Are you likely to change the rights or privileges for a group of directory users?

• Will you regularly script iLO changes?

• Do you use more than five groups to control iLO privileges?

For more information, see the comprehensive list of benefits in “Directory integration benefits”

(page 250). “Directory-enabled remote management” (page 280) explains how roles, groups, and

security are enabled and enforced through directories.

Kerberos support

Kerberos support enables a user to log in to iLO without supplying a user name and password if

the client workstation is logged in to the domain and the user is a member of a directory group

for which iLO is configured. If the workstation is not logged in to the domain, the user can also

configured through the web interface, XML (RIBCL), or SSH (partial support for CLI).

Because a trust relationship between iLO and the domain is established by a system administrator

before user sign-on, any form of authentication (including two-factor authentication) is supported.

For instructions on configuring a user to support two-factor authentication, see the server operating

system documentation.

Click the following link for a video demonstration of this feature: Setting up Kerberos with iLO

4. For more HP iLO videos, see the HP iLO University Videos website: http://www.hp.com/go/

ilo/videos.

Domain controller preparation

In a Windows Server environment, Kerberos support is part of the domain controller.

Realm names

The Kerberos realm name for a DNS domain is usually the domain name converted to uppercase.

For example:

• Parent domain name: example.net

• Kerberos realm name: EXAMPLE.NET

Computer accounts

A computer account must be present and enabled in the domain directory for each iLO account.

In Windows, create the user account in the Active Directory Users and Computers snap-in. For

example:

• iLO host name: iloname

• Parent domain name: example.net

• iLO domain name (fully qualified): iloname.example.net

Kerberos support 251

1 2 ... 246 247 248 249 250 251 252 253 254 255 256 ... 355 356

No comments

Hp Integrated Lights-Out 4 User Manual Page 251