topic Re: ILO Active Directory User Name Issue in Server Management - Remote Server Management

ILO Active Directory User Name Issue

Kamal Kotecha — Tue, 28 Feb 2006 11:33:34 GMT

I've configured ILO with AD, and can log in when I put my "First name, initial and surname".
Can I configure ILO login page to accept my userid instead i.e. kotek001

Thanks

Kamal

Re: ILO Active Directory User Name Issue

M.S.Srivatsa — Thu, 09 Mar 2006 08:03:26 GMT

What is the format of the login name you
are trying to use.
Is it
1.short name
Ex : sriv s
2.Distinguished name
Ex : CN=sriv s,CN=Users,DC=mycompu,DC=com
3.loginname@domain.com format
Ex : sriv@mycompu.com

Is kotek001 is the login name ?

Re: ILO Active Directory User Name Issue

Kamal Kotecha — Thu, 09 Mar 2006 08:54:32 GMT

I want to use my login name (userid) i.e kotek001. At the moment I have to use First Name, Initial and Last Name (Kamal K. Kotecha).
I think its the way LDAP works on Active Directory, but I wondered if there was way of changing the setting.

Re: ILO Active Directory User Name Issue

Scott_278 — Mon, 20 Mar 2006 11:21:12 GMT

I would be interested at seeing a screen shot of your Directory Settings. I also have ILOs configured for AD authentication. If I left the the "Directory User Context #1" field blank, I could only log in with my UserPrincipleName (i.e.userid@domain). Since I put the fully-qualified domain name in "Directory User Context #1", then I only have to enter the SamAccountName (i.e. userid). But in neither case can I log in with First name, Middle Initial, and Surname like you.

Re: ILO Active Directory User Name Issue

Kamal Kotecha — Mon, 20 Mar 2006 11:50:57 GMT

Hi

I've attached a word document with screen shots.
As you can see I have configured
Directory User Conext 1 , and 2 with our OU's
I have also done the administrator group setiings.
I can log in as Kamal K. Kotecha , but not kotek001 (my SAMID).

Many Thanks

Kamal

Re: ILO Active Directory User Name Issue

Scott_278 — Mon, 20 Mar 2006 11:56:14 GMT

I am using the extended schema, not the Default Directory schema like you are. I'm not sure how the default schema works, so I don't have much input. I'll keep watching the thread though.

Re: ILO Active Directory User Name Issue

Kamal Kotecha — Mon, 20 Mar 2006 11:58:46 GMT

Thankyou !

Re: ILO Active Directory User Name Issue

acartes — Mon, 03 Apr 2006 16:23:01 GMT

Try configuring the user search contexts. You can also verify that these are working on the Directory Tests page.

For example, if you can log in as kotek001@domain
you might want to add the search context @domain.

This should also work with the default schema mode.

Re: ILO Active Directory User Name Issue

acartes — Mon, 03 Apr 2006 16:23:46 GMT

Try configuring the user search contexts. You can also verify that these are working on the Directory Tests page.

For example, if you can log in as kotek001@domain
you might want to add the search context @domain.
There are some suggestions that you should consult on the Directory Settings help page.

This should also work with the default schema mode.

Re: ILO Active Directory User Name Issue

M.S.Srivatsa — Tue, 04 Apr 2006 03:06:11 GMT

Try to configure iLO manually by following the steps below
Please configure iLO with the appropriate directory settings and Group
distinguished name.

1.Logon to iLO with the appropriate login and password.
2.Click Administration->Directory settings.
3.Configure "directory settings" with appropriate parameters as under
1.Directory Server address
Ex : dlilo1.india.hp.com
2.LDAP port as "636".
3.Fill in appropriate "Directory User Context 1
Ex:CN=Users,DC=mycompu,DC=com
4.Click "Apply Settings" to save the directory settings.

5.Repeat "Step 2" to go back to directory
settings page.
4.Now click on "Administer Groups".
5.Select the appropriate group.
Ex : custom1
6.Fill in the Group distinguished name.
Ex : CN=newgroup,CN=Users,DC=mycompu,DC=com
NOTE : Please don't give any extra space.
7.Enable the appropriate access rights for this group.

8.Click on "Save Group Information" save the group settings.

Please ensure the following.
1.In windows Active directory setup
the same group(Ex:newgroup) exists.
2.User who tries to login to iLO is
present in this group.

Re: ILO Active Directory User Name Issue

Kamal Kotecha — Tue, 04 Apr 2006 08:34:10 GMT

I can get ILO to work with the default directory, as you have suggested.
BUT i can't get it to work with my SAM_ID.
I have to use my full name,Kamal K. Kotecha not my SAM_ID (user_id) kotek001.
The contexts etc have all been set.
I wondered if there was a way of configuring my sam_id to be the primary identifier.

Thanks

Re: ILO Active Directory User Name Issue

Scott Huisman — Fri, 10 Nov 2006 17:19:30 GMT

Was this issue ever resolved? My company is having the exact same problem, AD authentication works but only using the full display name not the actual userid.

Re: ILO Active Directory User Name Issue

Rancher — Tue, 19 Dec 2006 12:33:59 GMT

We can log in either with our AD name (first name, last name) or our userid. However, for the userid to work, it must be in this format:
domain\userid

Re: ILO Active Directory User Name Issue

Scott Huisman — Tue, 19 Dec 2006 13:21:44 GMT

What did you configure to allow the "User logon name" attribute to pass through? I've tried every possible configuration that I can think of with for userid (domain\userid, userid@domain, etc) and things still aren't working. That leads me to think that I haven't configured something correctly. Could you take a screen shot of the directory settings that you are using in the iLO? If there is nothing configured differently then I'm going to guess there is something with the domain attributes of your account that have been configured differently than mine.

Re: ILO Active Directory User Name Issue

Scott_278 — Tue, 19 Dec 2006 13:26:52 GMT

I have been away from this for a while, but I remember having to set the context as "@.com". Then I could log in with just my user account.

Re: ILO Active Directory User Name Issue

Scott Huisman — Tue, 19 Dec 2006 13:58:34 GMT

I tried what you suggested and put @domain.com in the "Directory User Context 1:" field but when I test the settings I still get "Unable to authenticate test user t801622a@corp.ads [User Object not found]". Could you confirm the syntax that was used? This is sounding promising :)

Re: ILO Active Directory User Name Issue

Scott_278 — Tue, 19 Dec 2006 14:06:11 GMT

Not sure which syntax you are referring to. Say the name of our AD domain is "manufacturing.company.com". I set the Directory User Context 1 field to "@manufacturing.company.com". Then at the logon page, you enter your user id, "t801622a" and password.

I think I also remember tinkering around with the AD settings using the test link in the ILO page where the AD settings are configured. I can't remember exactly what I did there or what it looks like, but I think it was useful to me.

Like I said it's been a while since I did this, and I don't have access to these cards anymore - so I'm doing it from memory.

Re: ILO Active Directory User Name Issue

Rancher — Tue, 19 Dec 2006 14:08:40 GMT

Our configuration was a little more complicated than that.

In the LOM Object Distinguished Name, we have the entire AD path for the iLo itself:
Cn=iloname,ou=one,ou=two,ou=etc.,ou=etc, DC=domainname,DC=org

Directory User 1 Context:
CN=Users,DC=domainname,DC=org

Directory User 2 Context:
OU-Administrators (Or however you have it named),OU=etc,OU=etc,DC=domainname,DC=org

Directory User 3 Context:
OU=etc,OU=etc,DC=domainname,DC=org

We are also using HP extended schema.

Re: ILO Active Directory User Name Issue

Scott Huisman — Wed, 20 Dec 2006 17:12:36 GMT

Thanks for all of the help, it turns out everything was configured correctly but a GPO that was applied to my machines was causing ActiveX to be blocked. The iLO uses an ActiveX call to associate the userid with the user's CN. Once ActiveX was enabled the passthrough worked flawlessly!!

Re: ILO Active Directory User Name Issue

TienDNguyen — Tue, 17 Apr 2007 14:12:58 GMT

All...I am working on the schema-free iLO AD integration, would it be possible for me to email one of you guys directly if you have this setup? My email is tien@ibx.com.

So far, my test has failed "Unable to Bind to AD".

I've tried using logging with:

short name
long name
domain\username
username@domain.com

Keep telling me that unable to connect to directory server.