Users Guide

Using the iDRAC6 Directory Service 181
NOTE: In this release, non-SSL port based LDAP bind is not supported. Only
LDAP over SSL is supported.
6 Under Certificate Settings , check Enable Certificate Validation to enable
certificate validation. If enabled, iDRAC6 uses the CA certificate to
validate the LDAP server certificate during Secure Socket Layer (SSL)
handshake; if disabled, iDRAC6 skips the certificate validation step of the
SSL handshake. You can disable certificate validation during testing or if
your system administrator chooses to trust the domain controllers in the
security boundary without validating their SSL certificates.
CAUTION: Ensure that CN = open LDAP FQDN is set (for example, CN=
openldap.lab) in the subject field of the LDAP server certificate during certificate
generation. The LDAP server address field in iDRAC6 should be set to match the
same FQDN address for certificate validation to work.
7 Under Upload Directory Service CA Certificate , type the file path of the
certificate or browse to find the certificate file.
NOTE: You must type the absolute file path, which includes the full path and
the complete file name and file extension.
8 C lick Upload .
The certificate of the root CA that signs all the domain controllers'
Security Socket Layer (SSL) server certificates is uploaded.
9 Click Next to go to the Step 2 of 3 Generic LDAP Configuration and
Management
page. Use this page to configure location information about
generic LDAP servers and user accounts.
NOTE: In this release, the Smart Card based Two Factor Authentication (TFA)
and the single sign-on (SSO) features are not supported for generic LDAP
Directory Service.
10 Select Enable Generic LDAP .
NOTE: In this release, nested group is not supported. The firmware searches
for the direct member of the group to match the user DN. Also, only single
domain is supported. Cross domain is not supported.
11 Check the option Use Distinguished Name to Search Group Membership
to use the Distinguished Name (DN) as group members. iDRAC6
compares the User DN retrieved from the directory to compare with the
members of the group. If unchecked, user name provided by the login user
is used to compare with the members of the group.