Issue with remote console and timeouts when using AD for iLO4 authentication

[dzr0001]

I am currently working with a set of DL360p Gen8 servers with iLO 4 Advanced 1.0.1. I am able to successfully authenticate against active directory to login with iLO. However, whenever I attempt to launch a remote console, I receive the following error:

"Please verify with your administrator that you have permission to use this iLO and that the Active Session limit has not been reached."

The group this user belongs to has been given rights to everything in the group configuration. Whenever I receive this error, the iLO page resets stating that my session has timed out. I don't experience any of these problems when logging in with a local user. I suspect this issue may somehow be related to a load balancer we have in front of the AD servers. As such, I was wondering if there were any ways to get any kind of debug output from the iLO authentication process.

Thanks in advance,

Dylan

[Oscar A. Perez]

Does it happen with the Java Remote Console as well? With Java, you can enable debugging and capture the output from the debug console.
I would also suggest you to upgrade iLO4 firmware to 1.10.

[dzr0001]

Thanks for the reply. I will update the firmware and give it a shot.

[dzr0001]

Updating the iLO firmware didn't seem to make any difference, unfortunately. When the failure occurs, the relevant message in the java console is:

<cut>

RC port number 17990
updated: connecting to 10.10.5.63:17990
network: Connecting http://10.10.5.63:17990/  with proxy=DIRECT
set TcpNoDelay
Received hello byte. Requesting remote connection...
Access denied.
</cut>

If I configure iLO to use one of the domain controllers directly, I can launch the console. If I login to iLO while configured for 1 server, but switch the authentication to use the load balancer before launching the remote console, the console loads fine.

Does the iLO do some sort of credential caching that doesn't play nice with directory servers changing?

Thanks,

Dylan

Moderator [above link is no longer valid, please visit https://support.hpe.com/connect/s/  to find the latest info ]

[Oscar A. Perez]

That access denied message means that iLO did not grant access to the remote console app due to problems with the credentials.

You can run the .NET Remote Console (IRC.exe) as a standalone app and try playing with more credentials. The IRC.exe file should be somewhere in: c:\Users\<UserName>\AppData\Local\Apps\2.0\...

[dzr0001]

Thanks for the reply. It seems that when I connect directly with the application, it works as expected and without issue. This only occurrs when launching the console through the iLO web interface.

Thanks,

Dylan

[yaro137]

This is interesting as I have exact same issue way after the op reported it and it's 2,61. I always use the .net console. Has it ever been found what is the root cause of this access denied issue? I wouldn't want to give away local admin creds just so ops can connect to the console.

[yaro137]

When I tested the account the Cumulative Rights field only displays "Login". This is odd as as the account is a member of a group in Directory User Context. However, the account is in a diferent domain then the group. Perhaps this is the problem and if so how to go about it?