Active Directory Authentication via Onboard Administrator (OA)

[chuckk281]

Troy had a customer question regarding authentication:

*******************

Hello,

I have a customer that is trying to setup the OA to use Active Directory authentication. They followed all of the instructions in the OA user guide and were able to get the certificate exported correctly and working. However, when the customer tries to use the “Test Settings” button, ALL of the test pass, except the last one: “User Authorization”. The OA is running 3.21

Initiating Directory Settings diagnostic for server xx.xx.xx.xx
Accepting Directory Server certificate for signed by ********************
Successful SSL connection (TLSv1/SSLv3, AES128-SHA, 128 bits)

Test user *************** authenticated.
Unable to authorize test user.
Some diagnostics FAILED for server xx.xx.xx.xx. Tests complete.

They have already created the proper Admin group using the “Directory Groups” setting as well. Do we have any other documentation about Active Directory support than what is in the OA user guide? I’m not sure how to troubleshoot this furthers so any ideas would be greatly appreciated.

**********************

Monty replied:

**********************

The OA passes the user login credentials to the directory server – this is the authentication test which passes if the user login is successful.

The last test is the authorization on the OA – whether the user is a member of a group that matches a group configured on the OA.

The three critical items here are:

1. The OA finds a user attribute of “memberOf” for Active Directory or “groupMembership” for Novell eDirectory.
2. The configurable OA search context strings find a match in the customer directory service for the group name
3. The directory group name found is an exact match for the group name configured on the OA

Example:

Groupname:                      testsomething@hp.com

Search context1:              OU=US,OU=Users,OU=Accounts,DC=americas,DC=cpqcorp,DC=net

If the groupname is fully qualified, the OA must be configured with the complete groupname.  If I left “@hp.com” out of the OA configuration of this group name – the authorization would fail.  Similarly if the group name is not part of the directory group name, then the OA group name would need to be configured as testsomething.

**********************

Other help for Troy??

[asho22]

Hi,

I am having the same issue!  I pass all tests except 'User Authorization'.  I get the error:

Unable to authorize test user.
Some diagnostics FAILED for server xxx.xxx.xxx.xxx

Tests complete

Is this an issue with the 'Directory Groups' section of the OA iLo?  What format do I need to provide in this section?  Do I have to supply an Active Directory group or an Organizational Unit? 

Thanks

[Jase4772]

Hi,

To get this working this is how I did it :-

The directory server is your AD server and port 636

Then the first context I put as the Users OU off the root of the structure ie CN=Users,DC=Domain,DC=co,DC=uk

Second context is where the actual user accounts are (and any additional for 3-6)

Create a Group in the Users OU called OA Admins (or whatever) then go to the Directory Groups on the Onboard Admin and create a new one with the Group Name* field as the name you created, ie OA Admins and then just set the user level to the required access.

To then login use the format domain\firstname.lastname and you should get in.

Hope this helps.

Jase