HP SMH RHEL 4 LDAP Authentication problems

[Support Microsoft Serv]

Hi All,

We are running RHEL 4 on Proliant DL380's running PSP 8.12. The System Management Homepage installed in this pack is hpsmh-2.1.12-200.

These machines all authenticate via LDAP to MS Active Directory tree

I have been modifing HP SMH to disable anonymous login and have been trying add an admin group restriction to the smhpd.xml but it will not recognise the LDAP group.

I have tried the full distingished name as well just the short name as below.

SRV-IT-PRODUCTION-UNIX-Services;sysadmin

CN=,OU=LDAP-NIS,OU=Server,OU=Security Groups,OU=Administrative Area,DC=,DC=,DC=local

Has anyone else managed to get HPSMH authenticating to LDAP on Linux ?

Any help would be greatly appreciated.

Rob.

[Predator]

Hi Rob,

If your LDAP client is authenticating via LDAP server, then if you add *\* to SMH user groups, it will work.
Get back if there is any problem :-)

Thnx
Predator

[Douglas Poland]

I'm requesting clarification of the response from Predator...

"If your LDAP client is authenticating via LDAP server, then if you add *\* to SMH user groups, it will work."

I tried variations of your suggestion with no success. Let's say my domain is "example.com", and my username is "linuxadmin". Would the syntax be:

\

Is that syntax correct?

When you say add the value to the SMH user groups, are you referring to elements?

[Predator]

Hi,

>>Would the syntax be:
\
Is that syntax correct?

This syntax is correct

>>When you say add the value to the SMH user groups, are you referring to elements?

When you add the above syntax in SMH UI under settings user groups, it will store that value in or .

Thnx
predator

[Douglas Poland]

Curious,

When I change my smhpd.xml file as follows:

\

and start the daemon:
/etc/init.d/hpsmhpd start,

I get the following message:
Starting hpsmhd: Invalid configuration file (/opt/hp/hpsmh/[FAILED]pd.xml). Ask your system administrator to run "/opt/hp/hpsmh/sbin/smhconfig".

My smhpd.xml file is re-written and the LDAP entries are removed.

I'm running RHEL 4.6 and 5.2 (x64). The SMH page --> HP Version Control Agent reports:

HP System Management Homepage 3.0.2-77

While the HP SIM server says:

Management Protocols HTTP:, SMH:2.0, SNMP:1.0, SSH:SSH-1.99-OpenSSH_3.9p1

So I'm not sure if I'm runnig SMH 2.0 or 3.0. I thought I read somewhere that directory authentication is not available in SMH 2.0.

[Predator]

Hi,

If the xml file is corrupted, during service restart SMH will erase that file and create it with default configurations. This is the way it is designed to work.

You have to edit it like
ldapdomain\ldapuser
donot use "<>" in between

It is better to use the SMH UI to configure these values rather than doing it in the back end.

Thnx
Predator

[Douglas Poland]

Thank you for the clarification. I tried your suggestion of using the SMH UI to enter the ldap info. Unfortunately, the UI will not accept an entry in the form ldapdomain\ldapuser. It returns an error "Invalid group name".

When I manually enter the ldap credentials in smhpd.xml, I can see the info in the web UI, but still cannot login via AD.

Do you use the form LDAPdomain\LDAPuser
on the SMH Homepage as the User Name ?

[Predator]

Hi,

In SMH UI, you have to add the groupname not the username
ldapdomain\ldapusergroup
Then try to login with the user in that groupname you have added in SMH.
ldapdomain\ldapuser

If the SMH UI is not accepting the usergroup which you have provided means, client is unable to contact the AD you have setup.

Thnx
predator.