Users Guide

companies add extensions to the schema, they can be guaranteed to be unique and not to conflict with each other. To extend
the schema in Microsoft's Active Directory, Dell received unique OIDs, unique name extensions, and uniquely linked attribute IDs
for the attributes and classes that are added into the directory service.
● Dell extension: dell
● Dell base OID: 1.2.840.113556.1.8000.1280
● RAC LinkID range: 12070 to 12079
Overview of Schema Extensions
Dell has extended the schema to include an Association, Device, and Privilege property. The Association property is used to link
together the users or groups with a specific set of privileges to one or more RAC devices. This model provides an administrator
maximum flexibility over the different combinations of users, RAC privileges, and RAC devices on the network without much
complexity.
When there are two CMCs on the network that you want to integrate with Active Directory for authentication and
authorization, create at least one association object and one RAC device object for each CMC. You can create multiple
association objects, and each association object can be linked to as many users, groups of users, or RAC device objects as
required. The users and RAC device objects can be members of any domain in the enterprise.
However, each association object can be linked (or, may link users, groups of users, or RAC device objects) to only one privilege
object. This example allows an administrator to control each user’s privileges on specific CMCs.
The RAC device object is the link to RAC firmware for querying Active Directory for authentication and authorization. When a
RAC is added to the network, the administrator must configure the RAC and its device object with its Active Directory name so
that users can perform authentication and authorization with Active Directory. Additionally, the administrator must add the RAC
to at least one association object for users to authenticate.
NOTE: The RAC privilege object applies to CMC.
You can create as many or as few association objects as required. However, you must create at least one Association Object,
and you must have one RAC device object for each RAC (CMC) on the network that you want to integrate with Active
Directory.
The Association Object allows as many or as few users and/or groups as well as RAC Device Objects. However, the Association
Object only includes one Privilege Object per Association Object. The Association Object connects the Users who have
Privileges on RACs (CMCs).
Additionally, you can configure Active Directory objects in a single domain or in multiple domains. For example, you have two
CMCs (RAC1 and RAC2) and three existing Active Directory users (user1, user2, and user3). You want to give user1 and user2
an administrator privilege to both CMCs and give user3 a login privilege to the RAC2 card.
When adding Universal Groups from separate domains, create an Association Object with Universal Scope. The Default
Association objects created by the Dell Schema Extender Utility are Domain Local Groups and does not work with Universal
Groups from other domains.
To configure the objects for the single domain scenario:
1. Create two Association Objects.
2. Create two RAC Device Objects, RAC1 and RAC2, to represent the two CMCs.
3. Create two Privilege Objects, Priv1 and Priv2, in which Priv1 has all privileges (administrator) and Priv2 has login privilege.
4. Group user1 and user2 into Group1.
5. Add Group1 as Members in Association Object 1 (A01), Priv1 as Privilege Objects in A01, and RAC1, RAC2 as RAC Devices in
A01.
6. Add User3 as Members in Association Object 2 (A02), Priv2 as Privilege Objects in A02, and RAC2 as RAC Devices in A02.
To configure the objects for the multiple domain scenario:
1. Make that the domain forest function is in Native or Windows 2003 mode.
2. Create two Association Objects, A01 (of Universal scope) and A02, in any domain. The figure Setting Up Active Directory
Objects in Multiple Domains shows the objects in Domain2.
3. Create two RAC Device Objects, RAC1 and RAC2, to represent the two CMCs.
4. Create two Privilege Objects, Priv1 and Priv2, in which Priv1 has all privileges (administrator) and Priv2 has login privilege.
5. Group user1 and user2 into Group1. The group scope of Group1 must be Universal.
6. Add Group1 as Members in Association Object 1 (A01), Priv1 as Privilege Objects in A01, and RAC1, RAC2 as RAC Devices in
A01.
7. Add User3 as Members in Association Object 2 (A02), Priv2 as Privilege Objects in A02, and RAC2 as RAC Devices in A02.
Configuring User Accounts and Privileges
125