ADD-HPEiLODirectoryGroup dont work on ilo 2.30 ProLiant DL380 Gen10

[mrus]

Hey,

I noticed that after updating ilo to ver. 2.30 add-HPEiLODirectoryGroup (HPEiLOCmdlets) im not able to add new directory groups. I have all the time same error : 

add-HPEiLODirectoryGroup : NAME OF HOST Target url(s) could not be located.
At line:1 char:15
+ $connection | add-HPEiLODirectoryGroup -GroupName "Global_Test"
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: (:) [Add-HPEiLODirectoryGroup], Exception
+ FullyQualifiedErrorId : HPE.iLO.Cmdlet.AddHPEiLODirectoryGroup

The same command worked well when on same host when it had ilo 2.1x ...

I tried this on few hosts with 2.30 and all of them have same issue.

I tested this on :

3.0.0.1
3.0.0.0 (current version)

[mrus]

Any ideas about this ?

[Pra_Sah]

Hello  mrus,

Thank you sharing your query.

We checked for any known issue or a possible solution for this behaviour. As of now we do not see any such issue being reported. This will require further investigation from our Technical Team to isolate this and then find a solution for this behaviour.

So I would request to please log a support ticket with our Technical Team for further investigation.

Regards,

[Datacenter_ICTS]

Hello,

We have the same problem

is there already a solution for this problem?

thx

set-HPEiLODirectoryGroup : [x.x.x.x]: Target url(s) could not be located.
At line:1 char:11
+ $result = set-HPEiLODirectoryGroup -Connection $ilo `
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: (:) [Set-HPEiLODirectoryGroup], Exception
+ FullyQualifiedErrorId : HPE.iLO.Cmdlet.SetHPEiLODirectoryGroup

[mrus]

hey,

There is new SPP, didnt try yet if this will fix the issue. But was planning to install it on one host and check if this change anything .  

But still confirm that if iLO ver. ilo 2.30 will be installed on ony host ( g9/g10) this issue appear. 

[Bobinhed]

I'm having the same problem for both Set and Add-HPEiLODirectoryGroup.  HPEFrameworkCore doesn't even populate an error message to return. Would like a resolution ASAP considering you can't really domain authenticate without the groups.

$HPEFrameworkCore = Set-HPEiLODirectoryGroup -Connection $HPEILOConnection `
-GroupName $GroupName

-NewGroupName $NewGroupName

Set-HPEiLODirectoryGroup : []: Target url(s) could not be located.
At line:1 char:21
+ ... meworkCore = Set-HPEiLODirectoryGroup -Connection $HPEILOConnection `
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: (:) [Set-HPEiLODirectoryGroup], Exception
+ FullyQualifiedErrorId : HPE.iLO.Cmdlet.SetHPEiLODirectoryGroup

[mrus]

Hi Pra_Sah

As you can see its not single user isse, but more global ilo v2.30 issue. 

[Pra_Sah]

Hello  mrus,

Thank you sharing your concern,

We have a new ILO5 release i.e. 2.31:- https://support.hpe.com/hpsc/swd/public/detail?swItemId=MTX_950d3dfe4d854854a0be9ec6a0#tab5

Please update the ILO firmware to latest ILO 2.31 and check if you are still getting this issue. 

If yes,  I would request to please log a support ticket with our Technical Team for further investigation.

Regards,

[mrus]

Hi,

I updated ilo to 2.31, but still same issue, same error.
I didnt see also any changes in change log in that ver. ilo so i guess this was not even checked and changed in this ver..

I will create case to HPe.

[Datacenter_ICTS]

Hi,

Raw json REST calls to the RedFish API work on 2.30+, so we're currently using this as a temporarily workaround. (You can look up the iLO RESTful API documentation for info and CURL/Python examples.)

However because the RedFish API works fine on all versions, I decided to take a closer look at what breaks in these DirectorGroup commands. I ran the Set/Add-HPEiLODirectoryGroup commands with -Verbose on a iLO5 2.18, iLO5 2.30 and iLO5 2.31. From the output I figured out that it stops working after printing "GetRemoteRoleMapping - Getting existing iLO directory users". This function uses the object returned by the previous query:
/redfish/v1/AccountService/?$select=Oem.Hpe.DirectorySettings.LdapServerPort,Oem.Hpe.DirectorySettings.LdapAuthenticationMode,LDAP.ServiceAddresses,LDAP.AccountProviderType,LDAP.LDAPService.SearchSettings.BaseDistinguishedNames,LocalAccountAuth,LDAP.Authentication.Username,LDAP.RemoteRoleMapping

There is also a stacktrace:
ExceptionMessage:Target url(s) could not be located..
InnerException:.
StackTrace: at HPE.iLO.Cmdlet.AddHPEiLODirectoryGroup.GetRemoteRoleMapping(DirectorySettingInfo dirgroup)
at HPE.iLO.Cmdlet.AddHPEiLODirectoryGroup.ValidateCmdletRecord(CmdletRecord cmdletRecord)

Running this query manually on iLO5 2.18 results in a working object:
{"Oem.Hpe.DirectorySettings.LdapServerPort": 636,"Oem.Hpe.DirectorySettings.LdapAuthenticati
onMode":null,"LDAP.ServiceAddresses":["domain.local"],"LDAP.AccountProviderType":"ActiveDirectoryService",
"LDAP.LDAPService.SearchSettings.BaseDistinguishedNames":["OU=administrators,OU=domain,DC=local"],
"LocalAccountAuth":null,"LDAP.Authentication.Username":"","LDAP.RemoteRoleMapping":[{"LocalRole":"dirgroup1234abcd1234abcd1234abcd",
"RemoteGroup":"Admin.our.admin.group"}]}

Running this query manually on iLO5 2.30 and 2.31 results in an almost empty object:
{
"@odata.context": "/redfish/v1/$metadata#AccountService.AccountService",
"@odata.etag": "W/\"75D0D302\"",
"@odata.id": "/redfish/v1/AccountService/",
"@odata.type": "#AccountService.v1_5_0.AccountService"
}

After some testing I figured out that for 2.30+ the "?$select=" only works for a single level eg. "?select=Oem" or "?select=Oem,LDAP" and not for multi level "Oem.Hpe,LDAP.Authentication". So either this select parameter needs to be fixed in the iLO5 2.30+ firmware to accept multi level paths again. Or the HPEiLO Cmdlets module needs to be changed to not rely on "?$select=". All it does is the reduce the size of the object returned by the RedFish API. If you don't supply a select it returns the full object which works fine.

I assume @mrus already created a ticket, so please pass this along to the Technical Team and hopefully this gets resolved soon.

PS. If any developer of the HPE iLO Cmdlets reads this, maybe consider open-sourcing it? Would make debugging and fixing issues like this much easier.