HP Integrated Lights-Out 2 User Guide

Authentication using Default Directory Schema, part 1: The distinguished name for a user in the
directory is CN=John Doe,OU=IT,DC=MyCompany,DC=com, and the following are the attributes
of John Doe's certificate:
• Subject: DC=com/DC=MyCompany/OU=IT/CN=John Doe
• SAN/UPN: [e-mail]
Authenticating to iLO 2 with username:[e-mail] and password works if
two-factor authentication is not enforced. After two-factor authentication is enforced, if SAN is
selected on the Two-Factor Authentication Settings page, the login page automatically populates
the Directory User field with [e-mail]. The password can be entered, but the
user is not authenticated. The user is not authenticated because [e-mail],
which was obtained from the certificate, is not the distinguished name for the user in the directory.
In this case, you must select Subject on the Two-Factor Authentication Settings page. The Directory
User field on the login page is then populated with the user's actual distinguished name, as follows:
CN=John Doe,OU=IT,DC=MyCompany,DC=com
If the correct password is entered, the user is authenticated.
Authentication using Default Directory Schema, part 2: The distinguished name for a user in the
directory is CN=[e-mail],OU=IT,DC=MyCompany,DC=com, and the following
are the attributes of John Doe's certificate:
• Subject: DC=com/DC=MyCompany/OU=Employees/CN=John Doe/
E=[e-mail]
• SAN/UPN: [e-mail]
• Search context on the Directory Settings page is set to: OU=IT,DC=MyCompany,DC=com
In this example, if SAN is selected on the Two-Factor Authentication Settings page, the Directory
User field on the login page is populated with [e-mail]. After the correct
password is entered, the user is authenticated. The user is authenticated even though
[e-mail] is not the distinguished name for the user. The user is authenticated
because iLO 2 attempts to authenticate using the search context fields
(CN=[e-mail], OU=IT, DC=MyCompany, DC=com) configured on the
Directory Settings page. Because this is the correct distinguished name for the user, iLO 2 successfully
finds the user in the directory.
NOTE: Selecting Subject on the Two-Factor Authentication Settings page causes authentication
to fail, because the subject of the certificate is not the distinguished name for the user in the directory.
When authenticating using the HP Extended Schema method, HP recommends selecting the SAN
option on the Two-factor Authentication Settings page.
Directory settings
iLO 2 connects to Microsoft Active Directory, Novell e-Directory, and other LDAP 3.0-compliant
directory services for user authentication and authorization. You can configure iLO 2 to authenticate
and authorize users using the HP schema directory integration or the schema-free directory
integration. iLO 2 only connects to directory services using SSL-secured connections to the directory
server LDAP port. The default secure LDAP port is 636. Directory services support is a licensed
feature available with the purchase of optional licenses. For more information, see “Licensing”
(page 26) and “Directory services” (page 130).
Locally-stored user accounts (found on the User Administration page) can be active while iLO 2
directory support is enabled. This support enables both local- and directory-based user
directory-based user accesses. Typically, an administrator can delete local user accounts (except
required accounts, such as an emergency access account) after iLO 2 is successfully configured
to access the directory service. You can also disable access to these accounts if directory support
is enabled.
50 Configuring iLO 2