topic Re: iLO LDAP integration letting everyone in!? in Server Management - Remote Server Management

iLO LDAP integration letting everyone in!?

wreigle1 — Mon, 11 Jul 2016 17:21:12 GMT

I have configured iLO with LDAP directory integration. I am able to successfully login to iLO using my AD credentials. However, other AD users are also able to login to iLO. Users who are NOT in the "iloadmins" security group shown below are able to successfully login to iLO.

Settings I am using:
Administration > Security > Directory
"User Directory Default Schema"
Directory Server Address: <FQDN of AD server>
Port: 636
Directory User Context 1: OU=groups,OU=employees,DC=contoso,DC=dc,DC=com

Administration > User Administration
Directory Groups: CN=iloadmins,OU=groups,OU=employees,DC=contoso,DC=dc,DC=com

Re: iLO LDAP integration letting everyone in!?

Oscar A. Perez — Tue, 12 Jul 2016 17:39:21 GMT

Go to "Administration->User Administration" and remove the "Authenticated Users" from the Directory Groups.

Re: iLO LDAP integration letting everyone in!?

wreigle — Tue, 12 Jul 2016 17:49:55 GMT

Thanks for the suggestion Oscar but that did not resolve my issue. I deleted the Autehnticated Users group all together. Another user was still able to login to iLO.

Re: iLO LDAP integration letting everyone in!?

wreigle — Thu, 14 Jul 2016 13:15:20 GMT

Any other ideas here? A bug in iLO 4 (version 2.40)?

Re: iLO LDAP integration letting everyone in!?

wreigle — Fri, 29 Jul 2016 15:45:34 GMT

I tried again with the latest iLO 2.44. Still no luck, it's letting everyone in with their domain creds. Oh well.

Re: iLO LDAP integration letting everyone in!?

Oscar A. Perez — Wed, 03 Aug 2016 13:52:03 GMT

Every time we get a case like this, it ends up being caused by a misconfiguration. Like for example, the iLO group you've created is inheriting permissions from other groups or, there are nested groups associated with this iLO group. If user "Bob", for example, is a member of such groups, he will be able to login to iLO.

Please have a hard look at how your AD groups are setup and check for all "effective" permissions user "Bob" has.