HP ntegrity iLO 2 MP Operation Manual page 73

LDAP displays and modifies the following LDAP directory settings:
• Directory Authentication: Activates or deactivates directory support on the iLO 2 MP.
— Enable with Extended Schema: Selects directory authentication and authorization using
directory objects created with the HP schema. Select this option if the directory server
is extended with the HP schema and you plan to use it.
— Enable with Default Schema: Selects directory authentication and authorization using
user accounts in the directory which has not been extended with the HP schema. User
accounts and group memberships are used to authenticate and authorize users. Data
in the Group Administration page must be configured after you select this option. In
the Group Administration page, configure one or more directory groups by entering
the distinguished name of the group and privileges to be granted to users who are
members of that group.
— Disable: Deactivates directory support on the iLO 2 MP.
• Local User Accounts: Includes or excludes access to local iLO 2 MP user accounts. If local
user accounts are enabled, you can log in to the iLO 2 MP using locally stored user credentials.
If they are disabled, access is limited to valid directory credentials only.
NOTE:
Locally stored user accounts can be active while directory support is enabled. This
enables both local- and directory-based user access. If both directory authentication and
local user accounts are enabled, login is attempted using the directory first, then using local
accounts.
• Directory Server IP Address: IP address or host name of the directory server.
• Directory Server LDAP Port: Port number for the secure LDAP service on the server. The
default value for this port is 636.
• Distinguished Name: Specifies where this iLO 2 MP instance is listed in the directory tree.
For example: cn=MP Server,ou=Management Devices,o=hp
• User Search Contexts (1,2,3): User name contexts that are applied to the login name entered
to access the iLO 2 MP.
User name contexts are used to locate an object in the tree structure of the directory server
and applied to the login name entered to access the iLO 2 MP. All objects listed in the
directory can be identified using their unique distinguished name. However, distinguished
names can be long, users might not know their distinguished names, or they might have
accounts in different directory contexts. Search contexts enables users to specify common
directory contexts, so that they do not have to enter their full distinguished name at login.
iLO 2 MP attempts to authenticate a user in the directory first by the login name entered,
and then by applying user search contexts to that login name until login succeeds. For
example:
Instead of logging in as cn=user,ou=engineering,o=hp, search context of
ou=engineering,o=hp enables a user to log in as user
When extended schema is selected and Active Directory is used as a directory server.
Microsoft Active Directory has an alternate user credential format. A user can log in as:
user@domain.hp.com, in which case a search context of @domain.hp.com enables the
user to login as user.
Command line usage and scripting:
LDAP [ -directory [ -ldap <d|x|s> ] [ -mp <e|d>]
| -groups
[ -ip <hostname/ipaddr> ] [ -port <n>]
[ -dn <text> ] [ -1context <test>]
[ -2context <text>] [ -3context <text>]
[ -change <groupNo.> [ -dn <text>]
[ rights <e|d>]
<console|mp|power|user|virtual|all|none> ]
[ -list <groupNo.> ]]
Text User Interface 73