ILO 5 CAC Smartcard authentication

[JLB-MP]

I have been attempting to setup ILO 5 with CAC Smartcard authentication but have thus far been unsuccessful.   I followed the instruction in the ILO user manual and always get invalid user input in the log.    Can anyone give me in detail on what the certificate should look like?   Is there a better log somewhere that might give me some insight?   Any help would be greatly appreciated.

[support_s]

System recommended content:

1. HPE iLO 5 Security Technology Brief | Recommended security settings for iLO 5

2. HPE iLO 5 3.01 User Guide | Logging in to the iLO web interface

Please click on "Thumbs Up/Kudo" icon to give a "Kudo".

Thank you for being a HPE valuable community member.

[Suman_1978]

Hi,

Per the documentation for CAC Smartcard Authentication, A common access card (CAC) is a United States Department of Defense (DoD) smartcard for multifactor authentication.

CAC Smartcard Authentication (requires an iLO Advanced license).

Thank You!
I work with HPE but opinions expressed here are mine.
HPE Tech Tips videos on How To and Troubleshooting topics

[JLB-MP]

Can I only use a smartcard with ILO if I have a CAC Smartcard from the DoD?   Does that mean my only option for ILO two factor authentication is email?

[Suman_1978]

Hi,

There is a video which may help you on iLO session creation with Two Factor Authentication and Redfish.

Thank You!
I work with HPE but opinions expressed here are mine.
HPE Tech Tips videos on How To and Troubleshooting topics

[JLB-MP]

I was already able to get the two factor using a directory login and email to work.   Unfortunately your posts haven't been much help nor answered my questions.   I would really like to be able to use local ILO accounts and do some form of two factor.  Is that even possible?

[Suman_1978]

Hi,

As already shared in the documentation, that is what can be done or configured.
If you need further help, you may contact our HPE Support and log a support case.

Thank You!
I work with HPE but opinions expressed here are mine.
HPE Tech Tips videos on How To and Troubleshooting topics

[JLB-MP · Accepted solution]

I did finally get smart card authentication to work with ILO 5 and a local user.

1. The certificate needs to be RSA format, Smart Card Logon as an application policy and the UPN as a SAN.
2. Create a local ILO user and make the Login Name the same as the SAN UPN in the certificate.
3. The certificate will need to be mapped to the user under certificate mapping.
4. Under CAC/Smartcard enable CAC Smartcard Authentication, select Use Certificate SAN UPN and upload the CA Certificate as a Trusted CA.

[Sunitha_Mod]

Hello @JLB-MP,

That's awesome! 

We are extremely glad to know you were able to find the solution and we appreciate you for keeping us posted.