Directory services feature in SIM 5.1

[NJK-Work]

I know SIM 5.1 in brand new (OK - it was released today), so I am actually hoping someone from HP can answer this question:

What exactly would I use the Directory services feature of SIM 5.1 for. I can already add users from AD as named users to login into SIM. Is this just for using Groups instead of user accounts? For example I can now add "Domain Admins"? If so, why do I have to setup LDAP and all that jazz when I could already search the directory for users in the past without having to do so. So I am thinking this must be for something else. All I could find in the documentation is this:

The Directory Service Groups tool is used to determine a system's membership in a Windows domain, organizational unit (OU), or group. You must first configure the directory server parameters on the Directory Server Configuration page. After you configure the directory server, the Directory Groups tool must be configured with the distinguished name (DN) of the desired container objects in the directory.

OK...but that does not really tell me WHY I would want to do this. What do I get from this? Again, I could already specify AD user accounts in the past without having to setup all this stuff. So why do I have to do it now? Or is this for Netware...

Thanks
Nelson

[Rob Buxton]

Not finished downloading yet, but here's a guess as it might be similar to ILO.

You'd no longer need to set up users directly in HPSIM?

At the moment HPSIM just uses the AD for password authentication. With the integration all control is handed to AD. That allows for a consistent User Administration regime.

It's very useful for ILO's as there's a lot of them and user maintenance with AD integration is a pain.

[Rob Buxton]

That last line should be user maintenance WITHOUT AD integration is a pain.... Saying that you're not likely to have too many HPSIM installations, but if you have a live and DR it still might make some of the admin a bit easier.

[NJK-Work]

OK. Thanks.

I guess I was getting thrown by the use of the word "system" in the following statement from the help file:

The Directory Service Groups tool is used to determine a system's membership in a Windows domain, organizational unit (OU), or group.

I was thinking (hoping) that it might be able to do a system discovery based on an AD OU contents. For example, if we have an OU just for Servers, have SIM scan the OU and import all devices it finds there.

Thanks
Nelson

[Aravindh Rajaram · Accepted solution]

When the tool is run against managed nodes that are part of an OU, its system attribute gets updated in SIM.

Now, you can create a collection based on these attributes, associate it with user's authorization and opt for automatic track change of updates to collection. So, when a system enters or leaves the collection (OU), the authorization in SIM gets updated automatically.

This will let SIM user's manage systems only from Specific OU, Domain etc.

[NJK-Work]

Kewl! Thanks!

Nelson

[NJK-Work]

Answer provided in previous comments.

[jameskrolak]

This is really useful information. I thought the LDAP stuff was needed just in order to tie authentication to LDAP groups, but that doesn't appear to even be necessary. This is apparently more for grouping your servers based upon AD OUs or groups.