topic Re: ILO 5 CAC Smartcard authentication in ProLiant Servers (ML,DL,SL)

ILO 5 CAC Smartcard authentication

JLB-MP — Tue, 13 Feb 2024 05:06:32 GMT

I have been attempting to setup ILO 5 with CAC Smartcard authentication but have thus far been unsuccessful. I followed the instruction in the ILO user manual and always get invalid user input in the log. Can anyone give me in detail on what the certificate should look like? Is there a better log somewhere that might give me some insight? Any help would be greatly appreciated.

Query: ILO 5 CAC Smartcard authentication

support_s — Tue, 13 Feb 2024 00:32:12 GMT

System recommended content:

1. HPE iLO 5 Security Technology Brief | Recommended security settings for iLO 5

2. HPE iLO 5 3.01 User Guide | Logging in to the iLO web interface

Please click on "Thumbs Up/Kudo" icon to give a "Kudo".

Thank you for being a HPE valuable community member.

Re: ILO 5 CAC Smartcard authentication

Suman_1978 — Tue, 13 Feb 2024 04:34:35 GMT

Hi,

Per the documentation for CAC Smartcard Authentication, A common access card (CAC) is a United States Department of Defense (DoD) smartcard for multifactor authentication.

CAC Smartcard Authentication (requires an iLO Advanced license).

Thank You!
I work with HPE but opinions expressed here are mine.
HPE Tech Tips videos on How To and Troubleshooting topics

Re: ILO 5 CAC Smartcard authentication

JLB-MP — Tue, 13 Feb 2024 14:08:21 GMT

Can I only use a smartcard with ILO if I have a CAC Smartcard from the DoD? Does that mean my only option for ILO two factor authentication is email?

Re: ILO 5 CAC Smartcard authentication

Suman_1978 — Tue, 13 Feb 2024 14:37:02 GMT

Hi,

There is a video which may help you on iLO session creation with Two Factor Authentication and Redfish.

Thank You!
I work with HPE but opinions expressed here are mine.
HPE Tech Tips videos on How To and Troubleshooting topics

Re: ILO 5 CAC Smartcard authentication

JLB-MP — Tue, 13 Feb 2024 22:56:14 GMT

I was already able to get the two factor using a directory login and email to work. Unfortunately your posts haven't been much help nor answered my questions. I would really like to be able to use local ILO accounts and do some form of two factor. Is that even possible?

Re: ILO 5 CAC Smartcard authentication

Suman_1978 — Wed, 14 Feb 2024 03:17:10 GMT

Hi,

As already shared in the documentation, that is what can be done or configured.
If you need further help, you may contact our HPE Support and log a support case.

Thank You!
I work with HPE but opinions expressed here are mine.
HPE Tech Tips videos on How To and Troubleshooting topics

Re: ILO 5 CAC Smartcard authentication

JLB-MP — Wed, 14 Feb 2024 23:13:01 GMT

I did finally get smart card authentication to work with ILO 5 and a local user.

1. The certificate needs to be RSA format, Smart Card Logon as an application policy and the UPN as a SAN.
2. Create a local ILO user and make the Login Name the same as the SAN UPN in the certificate.
3. The certificate will need to be mapped to the user under certificate mapping.
4. Under CAC/Smartcard enable CAC Smartcard Authentication, select Use Certificate SAN UPN and upload the CA Certificate as a Trusted CA.

Re: ILO 5 CAC Smartcard authentication

Sunitha_Mod — Wed, 28 Feb 2024 15:37:44 GMT

Hello @JLB-MP,

That's awesome!

We are extremely glad to know you were able to find the solution and we appreciate you for keeping us posted.

Re: ILO 5 CAC Smartcard authentication

Eddie_2029 — Wed, 11 Feb 2026 04:39:12 GMT

Hi, JLB-MP or whoever can give expert advice.

I have been trying to get smart card login authentication in ILO5 configured and have tried what you stated that got it working for you but it's not working for me. Can you be more specific on how exaclty you got it to work beyond what you stated below? I have in the past got it to work in on older versions of ILO like 2 and 3 but can't seem to get it to work in ILO5. I have created a smart card template based on the recommended configuration for smart card login and I have installed both certtificates, the User and the CA and after typing in the Smart Card PIN all I receive is this: Log In with Smartcard: Login Authorization failed. There is nothing in the Security Logs with any information about why the login is failing. Thanks.

I did finally get smart card authentication to work with ILO 5 and a local user.