Users Guide

NOTE: If certificate validation is enabled, specify the Domain Controller Server addresses and the FQDN. Ensure
that DNS is configured correctly under iDRAC Settings > Network.
Using the following RACADM command may be optional:
racadm sslcertdownload -t 1 -f <RAC SSL certificate>
2. If DHCP is enabled on iDRAC and you want to use the DNS provided by the DHCP server, enter the following command:
racadm set iDRAC.IPv4.DNSFromDHCP 1
3. If DHCP is disabled in iDRAC or you want to manually input your DNS IP address, enter the following command:
racadm set iDRAC.IPv4.DNSFromDHCP 0
racadm set iDRAC.IPv4.DNSFromDHCP.DNS1 <primary DNS IP address>
racadm set iDRAC.IPv4.DNSFromDHCP.DNS2 <secondary DNS IP address>
4. If you want to configure a list of user domains so that you only need to enter the user name during log in to iDRAC web interface, use
the following command:
racadm set iDRAC.UserDomain.<index>.Name <fully qualified domain name or IP Address of the
domain controller>
You can configure up to 40 user domains with index numbers between 1 and 40.
Testing Active Directory settings
You can test the Active Directory settings to verify whether your configuration is correct, or to diagnose the problem with a failed Active
Directory log in.
Testing Active Directory settings using iDRAC web interface
To test the Active Directory settings:
1. In iDRAC Web Interface, go to iDRAC Settings > Users > Directory Services > Microsoft Active Directory, click Test.
The Test Active Directory Settings page is displayed.
2. Click Test.
3. Enter a test user's name (for example, [e-mail]) and password and click Start Test. A detailed test results and the
test log displays.
If there is a failure in any step, examine the details in the test log to identify the problem and a possible solution.
NOTE:
When testing Active Directory settings with Enable Certificate Validation checked, iDRAC requires that the
Active Directory server be identified by the FQDN and not an IP address. If the Active Directory server is identified
by an IP address, certificate validation fails because iDRAC is not able to communicate with the Active Directory
server.
Testing Active Directory settings using RACADM
To test the Active Directory settings, use the testfeature command.
For more information, see the iDRAC RACADM CLI Guide available at www.dell.com/idracmanuals.
Configuring generic LDAP users
iDRAC provides a generic solution to support Lightweight Directory Access Protocol (LDAP)-based authentication. This feature does not
require any schema extension on your directory services.
To make iDRAC LDAP implementation generic, the commonality between different directory services is utilized to group users and then
map the user-group relationship. The directory service specific action is the schema. For example, they may have different attribute
names for the group, user, and the link between the user and the group. These actions can be configured in iDRAC.
NOTE:
The Smart Card based Two Factor Authentication (TFA) and the Single Sign-On (SSO) logins are not supported
for generic LDAP Directory Service.
136 Configuring user accounts and privileges