HP Integrated Lights-Out 2 User Guide

Setting up HP SIM SSO
The HP SIM SSO page allows you to view and configure the existing iLO 2 Single Sign-On settings.
You must have the Configure iLO 2 privilege to alter these settings. To access iLO 2 SSO settings,
click Administration>Security>HP SIM SSO.
The HP Systems Insight Manager Single Sign-On Settings page includes the following fields and
options:
• Single Sign-On Trust Mode – Enables you to control how SSO-initiated connections are
accepted:
— Trust None (default) – Rejects all SSO connection requests.
— Trust by Certificate (most secure) – Enables only SSO connections from an HP SIM server
matching a certificate previously imported into iLO 2.
— Trust by Name – Enables SSO connections from an HP SIM server matching a DNS name
or certificate previously imported into iLO 2.
— Trust All (least secure) – Accepts any SSO connections initiated from any HP SIM server.
Users who log in to HP SIM are authorized based upon the role assignment at the HP SIM
server. The role assignment is passed to the LOM processor when SSO is attempted. You can
configure iLO 2 privileges for each role in the Single Sign-On Settings section. For more
information about each privilege, see “User administration” (page 28).
Using directory-based user accounts, SSO attempts to receive only the privileges assigned in
this section. Lights-Out directory settings do not apply. Default privilege assignments are:
◦ User – Login only
◦ Operator – Login, Remote Console, Power and Reset, and Virtual Media
◦ Administrator – Login, Remote Console, Power and Reset, Virtual Media, Configure iLO
2, and Administer Users
• HP SIM Trusted Servers – Enables you to view the status of trusted HP SIM servers configured
to use SSO with the current LOM processor. Click Add a SIM Server to add a server name,
import a server certificate, or directly install a server certificate. For more information, see
“Adding HP SIM trusted servers” (page 56).
The server table displays a list of registered HP SIM servers with the status of each. The actual
number of systems allowed depends on the size of the stored certificate data.
Although a system might be registered, SSO might be refused because of the current trust level
or certificate status. For example, if an HP SIM server name is registered and the trust level is
set to Trust by Certificate, SSO is not allowed from that server. Likewise, if an HP SIM server
Security 57