HP Integrated Lights-Out 2 User Guide

After you have selected a certificate, if the certificate is protected with a password, or if the certificate
is stored on a smart card, a second page appears prompting you to enter the PIN or password
associated with the chosen certificate.
The certificate is examined by iLO 2 to ensure it was issued by a trusted CA by checking the
signature against the CA certificate configured in iLO 2. iLO 2 determines if the certificate has
been revoked and if it maps to a user in the iLO 2 local user database. If all of these tests pass,
then the normal iLO 2 user interface appears.
If your credential authentication fails, the Login Failed page appears. If login fails, you are instructed
to close the browser, open a new browser page, and then try connecting again. If directory
authentication is enabled, and local user authentication fails, iLO 2 displays a login page with the
directory user name field populated with either the User Principal Name from the certificate or the
Distinguished Name (derived from the subject of the certificate). iLO 2 requests the password for
the account. After providing the password, you are authenticated.
Using two-factor authentication with directory authentication
In some cases, configuring two-factor authentication with directory authentication is complicated.
iLO 2 can use HP Extended schema or Default Directory schema to integrate with directory services.
To ensure security when two-factor authentication is enforced, iLO 2 uses an attribute from the
client certificate as the directory user's login name. Which client certificate attribute iLO 2 uses is
determined by the Certificate Owner Field configuration setting on the Two-Factor Authentication
Settings page. If Certificate Owner Field is set to SAN, iLO 2 obtains the directory user's login
name from the UPN attribute of the SAN. If the Certificate Owner Field setting is set to Subject,
iLO 2 obtains the directory user's distinguished name from the subject of the certificate.
Which Certificate Owner Field setting to choose depends on the directory integration method used,
the directory architecture, and what information is contained in the user certificates that are issued.
The following examples assume you have the appropriate permissions.
Security 49