AD/LDAP Integration w/ Onboard Administrator -- Issues

[Craig A. Liess]

Hi folks -

We're in the process of bringing up a c7000 blade enclosure and our last task before putting it into production is to configure Active Directory authentication with our Onboard Administrator modules.

At this point, we're just trying to authenticate with a single domain controller, per the OA configuration guide.

Everything appears to be set up correctly (certificate uploaded, search context pointed at the OU where our group resides, domain group created in the OA matching our AD group, etc.)

Both of our OA modules are on v2.02, which I believe is the latest.

All of the troubleshooting steps in the OA guide come back as positive, so I think we're pretty close, just missing something small here.

Any help would be greatly appreciated. Thanks!

-Craig

[Raghuarch]

Hi Craig,

Please refer to page 181 it has detailed description of the steps.

http://h20000.www2.hp.com/bc/docs/support/SupportManual/c00702815/c00702815.pdf


Regards,
Raghuarch

[Craig A. Liess]

This is exactly what we have been doing..have followed the guide to the letter, just no luck.

There's really no good error reporting for this, either.. it just says "invalid username/password."

-Craig

[James ~ Happy Dude]

Hello Craig,
Just to make sure, You are using your ACCOUNT NAME(admin profile) to login & not the USERNAME.

Regards,
James.

[Raghuarch]

Hi Craig,

I am listing some of the possible typo or other error which may occur.

In OA:
verify The IP address is Correct in Directory Server Address.
Verify the Search Context is correct.
Verify the group for which user is member is present under the Directory Groups of OA Page.

In Active Directory.
Verify the user is a member of Valid group.
Verify the user is member of Domain users and the new group you created.

Try installing a certificate this is Optional, LDAP should work even without a certificate.

Regards,
Raghuarch

[Craig A. Liess]

The IP and port are def. correct.

For search context, we're just having it look the default 'Groups' folder, so we're using the following in the Search Context field:

OU=Groups,DC=xxxxxxxxx,DC=com

The group is in 'Directory Groups' and in the above directory path. The accounts we're trying to use are in the AD group (this is the same group we use for other devices, like our IPKVMs, for example.)

Have tried checking the 'Use NT Account Name Mapping' check box as well to no avail.

-Craig

[Raghuarch]

Hi Craig,

Can you try these.

CN=Groups,DC=xxxxxxxxx,DC=com
or
CN=Users,DC=xxxxxxxxx,DC=com

Regards,
Raghuarch

[Craig A. Liess]

No dice on those, I had already tried them :(

-Craig

[jmiller_2]

Craig i have this working on 13 chassis, but i am using edirectory. configed as follows...

Directory settings
server address...DNS alias for redundancy
port 636
Search1 ou=group name,ou=city,o=organization
search2 o=organization

Group
cn=my group,ou=groups,ou=city,o=organization
privilege level admin or whatever and then select the components in the bottom

good luck...

[Craig A. Liess]

Where are you putting the DN for your group? In the 'Search Context 3' field?

-Craig