If you enter the FQDN, ensure that the DNS settings are configured in iLO.
Hewlett Packard Enterprise recommends using DNS round-robin when you define the directory server.
•
Directory Server LDAP Port
—Specifies the port number for the secure LDAP service on the server.
The default value is 636. If your directory service is configured to use a different port, you can specify
a different value. Make sure that you enter a secured LDAP port. iLO cannot connect to an unsecured
LDAP port.
•
iLO Object Distinguished Name/CAC LDAP Service Account
—For the HPE Extended Schema
configuration, this setting specifies where this iLO instance is listed in the directory tree (for example,
cn=Mail Server iLO,ou=Management Devices,o=ab
).
User search contexts are not applied to the iLO object DN when iLO accesses the directory server.
•
Directory User Contexts
—These boxes enable you to specify common directory subcontexts so that
users do not need to enter their full DNs at login. Directory user contexts can be up to 128 characters.
•
Certificate Status
—Specifies whether a directory server CA certificate is loaded.
If the status is
Loaded
, click
View
to display the CA certificate details. If no CA certificate is loaded,
the status
Not Loaded
is displayed. iLO supports SSL certificates up to 4 KB in size.
More information
Running directory tests on page 254
iLO directory groups on page 206
Directory user contexts
You can identify the objects listed in a directory by using unique DNs. However, DNs can be long, users
might not know their DNs, or users might have accounts in different directory contexts. When you use
user contexts, iLO attempts to contact the directory service by DN, and then applies the search contexts
in order until login is successful.
•
Example 1
—If you enter the search context
ou=engineering,o=ab
, you can log in as
user
instead
of logging in as
cn=user,ou=engineering,o=ab
.
•
Example 2
—If the IM, Services, and Training departments manage a system, the following search
contexts enable users in these departments to log in by using their common names:
◦
Directory User Context 1:ou=IM,o=ab
◦
Directory User Context 2:ou=Services,o=ab
◦
Directory User Context 3:ou=Training,o=ab
If a user exists in both the
IM
organizational unit and the
Training
organizational unit, login is first
attempted as
cn=user,ou=IM,o=ab
.
•
Example 3 (Active Directory only)
—Microsoft Active Directory allows an alternate user credential
format. A user can log in as
user@domain.example.com
. Entering the search context
@domain.example.com
allows the user to log in as
user
. Only a successful login attempt can test
search contexts in this format.
•
Example 4 (OpenLDAP user)
—If a user has the DN
UID=user,ou=people,o=ab
, and you enter
the search context
ou=people,o=ab
, the user can log in as
user
instead of entering the DN.
Directory user contexts
253
