HP Directories Support for Management Processors

[FrancWest]

Hi,

I'm trying the above utility to configure directory support for our ILO's. However, everything looks fine, it detects the ilo's, displays it's firmware (all 1.75) and shows that AD authentication is disabled. So I configure everything, select the groups and ou. But when I click 'configure' on the final page I get a result: ERRROR: bad login. How can this be, it should be using the same credentials used to query the status of ILO (firmware version, directory status), the first step succeeds, but the actual configuration doesn't.

Any ideas ?

Franc.

[acartes]

Try using the utility with a single lights-out processor. Also, you may want to login to the iLO directly and use the Directory Settings tests to troubleshoot the configuration.

Finally, I recommend allowing local and directory credentials, at least until your directory configuration is working as you desire.

[FrancWest]

Hi,

did that, same result. Looks like the utility is flawed or something. Configuring from inside the ILO RBSU works fine, but that's not the idea behind the utility is it ?

Franc.

[acartes]

Let me see if I understand your trouble with the HP Lights-Out Migration utility.

The tool works in a series of steps as follows:

1) Search for processors using "Management Processor Login" credentials manually specified.
This step succeeds.

2) Upgrade firmware
This page shows all of the iLOs running 1.75 firmware, so no update is needed.

3) Name the management processors. This defines directory object names for the iLO processors.
Note that this step merely creates object names in the tool. They are not applied to iLO or directory yet.

4) "Update Directory" step
In this step, the utility can talk to the directory server using SSL to create the iLO processor objects in the directory using the HP Schema. The directory credentials specified are used to authenticate to the directory - that is, the Directory Server Login Name and Password represent an account with rights to create the objects in the designated container.

Q: Did you install the HP Schema Extensions in the directory?
Q: If the credentials specified in this step are failing, perhaps try a fully distinguished account name.

5) "Configure lights out processors"
This step uses the credentials specified in step 1 to apply the settings to the selected processors. If the credentials do not have "configure iLO" or "configure local device settings" privilege, then they will be rejected.

[FrancWest]

Hi,

Step 1 and 2 are correct.

3) Name the management processors. This defines directory object names for the iLO processors.
Note that this step merely creates object names in the tool. They are not applied to iLO or directory yet.

Did that also.

4) "Update Directory" step
In this step, the utility can talk to the directory server using SSL to create the iLO processor objects in the directory using the HP Schema. The directory credentials specified are used to authenticate to the directory - that is, the Directory Server Login Name and Password represent an account with rights to create the objects in the designated container.

This step is not quite clear to me. Do I need to create the role manually using the AD snapin ? Or will the utility create the role for me ?

Q: Did you install the HP Schema Extensions in the directory?

Yes I did...

Q: If the credentials specified in this step are failing, perhaps try a fully distinguished account name.

Credentials are correct. AD is updated, if I run it again it says object already exists.

5) "Configure lights out processors"
This step uses the credentials specified in step 1 to apply the settings to the selected processors. If the credentials do not have "configure iLO" or "configure local device settings" privilege, then they will be rejected.

Where do I set these privileges ? If it can query the current status using the credentials, why can't it update the settings ?

Franc.

[FrancWest]

Hi,

something to add. I've created a different OU for the ILO devices. In this OU I've create a role using the snap in. In step 4 I specify the OU and the created role. When I click on update directory I get the following error:

There is no such object on the server.

What am I doing wrong here ?

Franc.

[FrancWest]

Never mind my last post. I made a typo. The object is correctly created in the specified OU. However, when configuring the ILO itself I keep getting the error 'BAD login'.

Franc.

[acartes]

5) "Configure lights out processors"
This step uses the credentials specified in step 1 to apply the settings to the selected processors. If the credentials do not have "configure iLO" or "configure local device settings" privilege, then they will be rejected.

Where do I set these privileges ? If it can query the current status using the credentials, why can't it update the settings ?

Any valid iLO credentials can query the iLO information gathered in the discovery step. However, changing iLO settings must be performed with an account with appropriate rights on iLO.

You can view the account rights by logging-in to one of the iLOs using the credentials from step 1. Navigate to the Administration/User Administration tab. Select the account and click view/modify. You can view the user account and see what privileges are allowed.

[FrancWest]

Hi,

I'm using the administrator account specified in ILO. This is the only account that's defined in the ILO config and has full privileges. I've specified the credentials for this account in step 1. So it's the right account.

Franc.

[FrancWest]

Hi,

after upgrading the firmware to 1.80 (just released) the tools is working fine now. Must be an issue with 1.75.

Franc.