topic Re: iLO 5 LDAP group permissions - using PowerShell in ProLiant Servers (ML,DL,SL)

iLO 5 LDAP group permissions - using PowerShell

NJK-Work — Tue, 23 Jan 2018 14:48:49 GMT

In iLO 5 there are the following permission that can be set for a LDAP group (some of these are new compared to iLO2-iLO4):

Login
Remote Console
Virtual Power and Reset
Virtual Media
Host BIOS
Configure ILO Settings
Administer User Accounts
Host NIC
Host Storage
Recovery Set

However, in the latest HPE iLO PowerShell module there in only the 6 settings that you can set using the Set-HPiLOSchemalessDirectory (which I believe are based on the original iLO security specs):

1 - Administer Group Accounts
2 - Remote Console Access
3 - Virtual Power and Reset
4- Virtual Media
5 - Configure iLO 4 settings
6 - Login Privilege

How does one use PowerShell to map the old settings so that ALL the new settings are checked when adding a new LDAP group to an iLO 5?

Thanks

Re: iLO 5 LDAP group permissions - using PowerShell

GokulKS — Tue, 23 Jan 2018 16:54:01 GMT

Hi,

Currently iLO cmdlets version 1.5 supports only till iLO4 version i.e. Gen 9. That is why you see the difference in privilages roles.

We are developing next version 2.0 which will be compatiable with Gen 10 planned to be released around starting of Q2 CY18.

Thanks,

Gokul

PowerShell Team

Re: iLO 5 LDAP group permissions - using PowerShell

NJK-Work — Tue, 23 Jan 2018 18:28:27 GMT

Ok, thanks. I thought I read somewhere GEN10 was supported, but I must have been mistaken. Maybe I am thinking of HPE BIOS module...

Re: iLO 5 LDAP group permissions - using PowerShell

NJK-Work — Wed, 25 Apr 2018 21:07:50 GMT

I just installed the latest PowerShell module for the iLO and I am still not seeing a way to set all these permissions. I am trying to use "Add-HPEiLODirectoryGroup" and all I see for permission options are the following:

-UserConfigPrivilege
-RemoteConsolePrivilege
-VirtualMediaPrivilege
-iLOConfigPrivilege
-LoginPrivilege
-VirtualPowerAndResetPrivilege

Not seeing:

Host Storage, Host BIOS, Host NIC, and Recovery Set

What cmdlet do I use to set those values?

Thanks

Re: iLO 5 LDAP group permissions - using PowerShell

NJK-Work — Wed, 25 Apr 2018 21:28:31 GMT

In fact, I just double checked the help for that cmdlet and it says it only supports iLO 4. So, you have no way to configure directory groups in the iLO 5?

Re: iLO 5 LDAP group permissions - using PowerShell

GokulKS — Thu, 26 Apr 2018 05:11:32 GMT

Hi,

Unfortunately there is no way from PowerShell to conifugre directory settings of iLO5.

The main reason behind this is lack of support from iLO5 interfaces which has limited our support for directory works.

I will check iLO team if they have any workarounds to achieve this.

Thanks,

Gokul

Re: iLO 5 LDAP group permissions - using PowerShell

NJK-Work — Thu, 26 Apr 2018 13:28:50 GMT

Thank you for the response.

Re: iLO 5 LDAP group permissions - using PowerShell

NJK-Work — Mon, 07 May 2018 14:21:13 GMT

Any update on this? This seems like it should be a simple thing to do - it is just a text field with the LDAP group name in. Its not doing any LDAP work...its just setting a text field in the iLO configuration...right? I mean, you can do this in the iLO4...why not the iLO5?

If I can use PowerShell to set the license code (a text field) why cant I use PowerShell to set an LDAP group name (a text field)?

Thanks, NK

Re: iLO 5 LDAP group permissions - using PowerShell

GokulKS — Tue, 08 May 2018 10:03:23 GMT

Hi,

I agree its simple work but iLO5 Redfish interfaces are not available to set those modifications. Without any interfaces PowerShell or even any scripting tool can't do much. You can approach iLO team but answer is going to be nearly same the support is not available currently and its coming in the future snaps of Gen10.

Thanks,

Gokul

Re: iLO 5 LDAP group permissions - using PowerShell

NJK-Work — Mon, 22 Oct 2018 21:43:29 GMT

Unbelievable - Version 2.1.0.0 just got released and it STILL does not support the "set-HPEiLODirectorySetting" and "get-HPEiLODirectorySetting" cmdlets for the iLO 5.

Re: iLO 5 LDAP group permissions - using PowerShell

GokulKS — Tue, 23 Oct 2018 05:29:50 GMT

We are sorry to disappoint you but again iLO5 is planning to provide these features in Redfish only by Snap4 or above.

Appreciate your feedback.

Thanks,

Gokul

Re: iLO 5 LDAP group permissions - using PowerShell

NJK-Work — Wed, 10 Apr 2019 17:37:15 GMT

My jaw just hit the floor...it now works with version 2.2.

Thank you.

Re: iLO 5 LDAP group permissions - using PowerShell

Interwebz — Thu, 12 Dec 2019 15:08:12 GMT

Hey,

Do you mind sharing how you managed to do this?

Whatever I try I get the following error.

$Connection | Set-HPEiLODirectorySetting -LDAPDirectoryAuthentication "DirectoryDefaultSchema" -LocalUserAccountEnabled Yes -DirectoryServerAddress domain.com -DirectoryServerPort 636 -UserContext "CN=GroupName,OU=Location,DC=domain,DC=com" -UserContextIndex 1 IP Hostname Status StatusInfo -- -------- ------ ---------- 10.14.67.1 ERROR HPE.Framework.Core.StatusInfo $Connection IP : 10.14.67.1 Hostname : ConnectionType : Redfish DisableCertificateAuthentication : True iLOGeneration : iLO5 iLOFirmwareVersion : 1.4 iLOResetWaitTimeout : 0 IsConnected : True ServerFamily : ProLiant ServerGeneration : Gen10 ServerModel : DL380 Timeout : 30 Get-Module *hpe* ModuleType Version Name ExportedCommands ---------- ------- ---- ---------------- Binary 2.2.0.0 HPEiLOCmdlets {Add-HPEiLODirectoryGroup, Add-HPEiLOFederationGroup, Add-HPEiLOInstallationQueu...

Thank you

Re: iLO 5 LDAP group permissions - using PowerShell

aireynol — Wed, 22 Jan 2020 14:28:55 GMT

I would also like an update. As of 2.2.0.0 set-hpeilodirectorysetting is not reliable for ilo5.