HP IP Console Switch Configuration Issue

[Rich Mahlerwein]

LDAP authentication is working fine, but I have an issue. Is there any way for a user who is NOT a Switch Admin to resync their Console Viewer Client?

In my testing, it seems that in order for a user to to be able to resync, they have to be a switch administrator. If they are a switch administrator, they can automatically see/use any server attached to that switch, regardless of any other group they are in. That makes the ability to control access using the groups useless.

UNLESS, of course, there's another way to resync that I've not found yet. Does anyone know of another way to do this?

Thanks!

[KarloChacon]

hi Rich Mahlerwein

sorry i don't the answer for that just let me ask you something
you followed the LDAP configuration on the IP Console Switch Viewer Manual to have your LDAP working?

I have something to do with a IP Console Switch and I would like to know any experience from another person

regards

[KarloChacon]

hi again

I mean from this manual

LDAP conf page 197.
http://h20000.www2.hp.com/bc/docs/support/SupportManual/c00678446/c00678446.pdf

regards

[Rich Mahlerwein]

Karlo,

No, that's not the document I used, but it's pretty similar. None of the docs I've found are very clear until *after* you know what you are doing. :)

Here's what I did:

First, on the Console Switch - go to "Manage Console Switch" and in the SNMP section put name "MainServerRoom"

In AD: Create a OU called ConsoleSwitch. I put it at the root of my structure so it shows up on the same level as "Users." Create a user "consoleldap" inside that OU and assign password. Create a new Computer called "MainServerRoom" (Matches name from SNMP above) inside that OU as well. Create a security group inside the ConsoleSwitch OU and add to that group the the switch "MainServerRoom" (have to use advanced search to find computers) and your user as well. On the "General" tab of the newly created group, in the notes field, put in the exact string "KVM Appliance Admin, Serial Appliance Admin". Now, create a second group with string "KVM User, Serial User" in the notes field, and add to it the computer name of one computer you want to be able to view and your username.

Back on the Console Switch: Name one interface the computername that we used above. Preferably, you should name the one attached to the right system, but that's up to you. :)

Then, Manage Console Switch and in the Global->Authentication tab, tell it to use LDAP. For Server Parameters, put IP address of AD server (your DC). In Search Parameters put Search DN of "CN=consoleldap,OU=ConsoleSwitches,DC=mycompany,DC=local"
(Assuming you are set up in AD like "mycompany.local". If your AD root is X.com, put the last two as "DC=X,DC=com"). Fill in password. Put Search Base to "DC=mycompany,DC=local" or "DC=X,DC=com", whichever. In query parameters, change both to "Group Attribute". Click OK and test.

After the ConsoleSwitch reboots, you should be able to log in using your regular AD login name and password. If you make a mistake, you can still log in as Administrator like usual to make changes.

I'm currently in the process of documenting this on our own network with screen shots and stuff, so if I get that done before I head out of town later today, I might try to scrub it this weekend and somehow post it here. I doubt I'll have time until next week though.

[KarloChacon]

really thanks for all that information

of course if you can post it much better

regards