Managing User Accounts

C H A P T E R 4

Topics
Description	Links
Configure user accounts	Configure Single Sign On Set the Session Time-Out Add User Accounts and Assign Roles Configure a User Account Delete a User Account View User Sessions





Configure SSH user key	Add an SSH Key Delete an SSH Key
Configure SSH user key	Add an SSH Key Delete an SSH Key
Configure Active Directory settings	View and Configure Active Directory Settings Configure Active Directory Tables Troubleshoot Active Directory Authentication and Authorization


Configure LDAP settings	Configure the LDAP Server Configure ILOM for LDAP
Configure LDAP settings	Configure the LDAP Server Configure ILOM for LDAP
Configure LDAP/SSL settings	View and Configure LDAP/SSL Settings Configure LDAP/SSL Tables Troubleshoot LDAP/SSL Authentication and Authorization


Configure RADIUS settings	Configure RADIUS Settings

Related Topics
For ILOM	Chapter or Section	Guide
Concepts	User Account Management Guidelines for Managing User Accounts	Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide (820-6410)
CLI	Managing User Accounts	Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide (820-6412)
SNMP	Managing User Accounts	Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide (820-6413)
The ILOM 3.0 Documentation Collection is available at: `http://docs.sun.com/app/docs/prod/int.lights.mgr30#hic`

Configuring User Accounts

Topics
Description	Links	Platform Feature Support
Configure user accounts	Configure Single Sign On Set the Session Time-Out Add User Accounts and Assign Roles Configure a User Account Delete a User Account View User Sessions	x86 system server SP SPARC system server SP CMM

Before You Begin

To set properties for Single Sign On and Session Time-Out, you need the Admin (a) role enabled.

To set properties for User Management (user accounts and roles), you need the User Management (u) role enabled.

Configure Single Sign On

1. Log in to the ILOM SP web interface or the CMM ILOM web interface.

2. Select User Management --> User Accounts.

The User Account Settings page is displayed.

3. Click the check box next to Enable Single Sign On to enable the feature, or deselect the check box to disable the feature.

Set the Session Time-Out

Note - The session time-out setting controls the amount of time an ILOM session will remain idle before logging out. The session time-out setting does not persist after you log out of the current ILOM session. You must reset the session time-out each time you log in to the ILOM web interface.

1. Log in to the ILOM SP web interface or the CMM ILOM web interface.

2. Select System Information --> Session Time-Out.

The Session Time-Out page appears.

3. Select your preferred time increment from the drop-down list.

4. Click the Apply button to save your change.

Add User Accounts and Assign Roles

Note - Only accounts with the User Management (u) role are allowed to add, modify, or delete user accounts. However, you need only the Read Only (o) role to modify your own password. If a new user is assigned the User Management (u) role, those privileges are also automatically granted for the command-line interface (CLI) and Intelligent Platform Management Interface (IPMI) to ILOM.

1. Log in to the ILOM SP web interface or the CMM ILOM web interface.

2. Select User Management --> User Accounts.

The User Account Settings page appears.

3. In the Users table, click Add.

The Add User dialog appears.

Add User dialog box

4. Complete the following information:

a. Type a user name in the User Name field.

b. Choose a role. Options include:

Advanced Role for all new ILOM 3.0 installations. Choosing Advanced Role gives you the option of selecting Admin (a), Console (c), Read Only (o), User Management (u), Reset and Host Control (r), and Service (s). For a description of the roles and privileges assigned to user accounts, see “Roles for ILOM User Accounts” in the Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide.

Administrator or Operator for customers who are upgrading from ILOM 2.0 to ILOM 3.0.

None

c. Select the appropriate roles.

d. Type a password in the Password field.

The password must be at least 8 characters and no more than 16 characters. The password is case-sensitive. Use alphabetical, numeric, and special characters for better security. You can use any character except a colon. Do not include spaces in passwords.

e. Retype the password in the Confirm Password field to confirm the password.

f. When you are done entering the new user’s information, click Save.

The User Account Settings page is redisplayed. The new user account and associated information is listed on the User Account Settings page.

Configure a User Account

Note - You can modify a user account by changing the user’s password, and the user’s network and serial privileges. To add, modify, or delete user accounts you need the User Management (u) role enabled.

1. Log in to the ILOM SP web interface or the CMM ILOM web interface.

2. Select User Management --> User Accounts.

The User Account Settings page appears.

3. In the Users table, select a radio button next to the user account you want to modify and click Edit.

A dialog appears listing the role assigned.

4. Modify the role assigned to a user.

Note that when the Advanced Role is selected, a user can select any of the six available roles. However, if you chose Administrator or Operator, ILOM will automatically assign the roles. For example, the two following figures identify the roles assigned by ILOM for Administrator and Operator.

Roles available when Administrator is selected

Roles available when Operator is selected

5. Type a new password in the New Password field.

The password must be between 8 and 16 characters. The password is case-sensitive. Use alphabetical, numeric, and special characters for better security. You can use any character except a colon. Do not include spaces in passwords.

6. Retype the password in the Confirm New Password field to confirm the password.

7. After you have modified the account information, click Save for your changes to take effect, or click Close to return to the previous settings.

The User Account Settings page is redisplayed with your changes.

Delete a User Account

Note - To add, modify, or delete user accounts you need the User Management (u) role enabled.

1. Log in to the ILOM SP web interface or the CMM ILOM web interface.

2. Select User Management --> User Accounts.

The User Account Settings page appears.

3. Select the radio button next to the user account you want to delete.

4. In the Users table, click Delete.

A confirmation dialog opens.

5. Click OK to delete the account or click Cancel to stop the process.

The User Account Settings page refreshes with the user account you deleted no longer listed.

View User Sessions

1. Log in to the ILOM SP web interface or the CMM ILOM web interface.

2. Select User Management --> Active Sessions.

The Active Sessions page appears. You can find the user name, the date and time that the user initiated the session, the types of session of the users currently logged in to ILOM, and the mode. If you are using ILOM 3.0.4 or a later version of ILOM, you can also view each user’s assigned role.

Configuring SSH Keys

Topics
Description	Links	Platform Feature Support
Configure SSH user key	Add an SSH Key Delete an SSH Key	x86 system server SP SPARC system server SP CMM
Configure SSH user key	Add an SSH Key Delete an SSH Key	x86 system server SP SPARC system server SP CMM

Before You Begin

To change other user SSH Keys, you need the User Management (u) role enabled. However, you can configure your own SSH Key with the Read Only (o) role enabled.

The SSH keys enable you to automate password authentication. Use the following procedures in this section to add or delete SSH keys.

Add an SSH Key

1. Log in to the ILOM SP web interface or the CMM ILOM web interface.

2. Select User Management --> User Accounts

The User Accounts Setting page appears.

3. In the User Account Settings page, scroll down to the SSH table and click Add.

The SSH key add screen appears.

SSH key add screen

4. Select the user from the User drop-down list.

5. Select a transfer method from the Transfer Method drop-down list.

The following transfer methods are available:

Browser

TFTP

SFTP

HTTP

HTTPS

6. If you select the Browser transfer method, click Browse and browse to the location of the SSH key. Proceed to Step 9.

7. If you select the TFTP transfer method, the prompts shown in the following figure appear and you must provide the following information, then proceed to Step 9:

Host - Enter the remote host IP address or, if you have DNS configured, the name of the remote host.

Filepath - Enter the path to which to save the configuration file in the format: directoryPath/filename.

Graphic showing SSH Key TFTP transfer methods prompts.SSH Key TFTP transfer method prompts

8. If you select the SCP, FTP, SFTP, HTTP, or HTTPS transfer method, the prompts shown in the next figure appear and you must provide the following information, then proceed to Step 9:

Host - Enter the remote host IP address or, if you have DNS configured, the name of the remote host.

Filepath - Enter the path to which to save the configuration file in the format: directoryPath/filename.

Username - Enter the user name of your account on the remote system.

Password - Enter the password for your account on the remote system.

Graphic showing SSH Key SCP transfer methods prompts.SSH Key SCP transfer method prompts

9. To add the SSH key to the selected user account, click Load.

The SSH key is added to the user account.

Delete an SSH Key

1. Log in to the ILOM SP web interface or the CMM ILOM web interface.

2. Select User Management--> User Accounts

The User Account Settings page appears.

3. Scroll down to the SSH Keys section at the bottom of the page, select a user, and click Delete.

A confirmation dialog box appears.

4. Click OK.

The SSH key is deleted.

Configuring Active Directory

Topics
Description	Links	Platform Feature Support
Configure Active Directory settings	View and Configure Active Directory Settings Configure Active Directory Tables Troubleshoot Active Directory Authentication and Authorization	x86 system server SP SPARC system server SP CMM

Before You Begin

To configure Active Directory settings, you need the User Management (u) role enabled.

To configure the Expanded Search Mode property, you must be using ILOM 3.0.4 or later.

To configure the Strict Credential Error Mode property, must be using ILOM 3.0.10 or later.

View and Configure Active Directory Settings

1. Log in to the ILOM SP web interface or the CMM ILOM web interface.

2. Select User Management --> Active Directory.

The Active Directory page appears. There are three sections to the Active Directory page, as shown in the following figures.

The top section, which includes targets and properties.

Active Directory page targets and properties

The middle section, which includes the primary certificate information.

Active Directory page primary certificate information

The bottom section, which includes the Active Directory tables.

Active Directory page tables

3. Configure the Active Directory settings displayed in the top section of the Active Directory Settings page.

See the following table for a description of the Active Directory settings.

Property	Default	Description
State	Disabled	Enabled \| Disabled
Roles	(none)	Administrator \| Operator \| Advanced \| none Access role granted to all authenticated Active Directory users. This property supports the legacy roles of Administrator or Operator, or any of the individual role ID combinations of ’`a`’, ’`u`’, ’`c`’, ’`r`’, ’`o`’ and ’`s`’. For example, `aucros`, where `a`=Admin, `u`=User Management, `c`=Console, `r`=Reset and Host Control, `o`=Read-Only, and `s`=Service. If you do not configure a role, the Active Directory server is used to determine the role.
Address	0.0.0.0	IP address or DNS name of the Active Directory server. If DNS name is used, then DNS must be configured and operational.
Port	0	Port used to communicate with the server. If `autoselect` is selected, the port is set to 0. Available in the unlikely event of a non-standard TCP port being used.
Timeout	4	Timeout value in seconds. Number of seconds to wait for individual transactions to complete. The value does not represent the total time of all transactions because the number of transactions can differ depending on the configuration. This property allows for tuning the time to wait when a server is not responding or is unreachable.
Strict Certificate Mode	Disabled	Enabled \| Disabled If enabled, the server certificate contents are verified by digital signatures at the time of authentication. Certificate must be loaded before Strict Certificate Mode can be set to enabled.
DNS Locator Mode	Disabled	Enabled \| Disabled If enabled, an attempt to locate the Active Directory server is performed, based on the DNS locator queries that are configured.
Expanded Search Mode	Disabled	Enabled \| Disabled As of ILOM 3.0.4, an expanded search mode is available. If enabled, an expanded search mode is used to control the search for user entries. Different searches are attempted if the more specific userPrincipleName search does not immediately succeed If disabled, the userPrincipleName is expected to have a fully qualified domain name (FQDN) suffix.
Strict Credential Error Mode	Disabled	Enabled \| Disabled As of ILOM 3.0.10, the Strict Credential Error Mode is available. If the mode is set to disabled (clear checkbox), user-credential errors are retried on other servers that are available (either configured via alternate-server table or found by DNS queries). The disabled state allows users from separate, disjoint domains to log in to ILOM as long as that domain authentication server is available. If the mode is set to enabled (checked checkbox), a credential error reported from any server fails those user credentials after the first authenication attempt showing the user-credential error.
Log Detail	None	None \| High \| Medium \| Low Specifies the amount of diagnostics that go into the event log.

4. Click Save in the top section of the Active Directory settings page for your settings to take effect.

5. View the Active Directory certificate information in the middle section of the Active Directory settings page.

See the following table for a description of Active Directory certificate settings.

Property	Displays	Description
Certificate File Status	`certificate not present`	Read-only indicator of whether a certificate exists.
Certificate File Status	`certificate present (details)`	Click on “details” for information about issuer, subject, serial number, valid_from, valid_to, and version.

6. Complete the “Certificate File Upload” section by selecting a transfer method for uploading the certificate file and the requested parameters.

Note - This section is only required if Strict Certificate Mode is going to be enabled. If Strict Certificate Mode is disabled, data will still be protected but a certificate will not be needed.

The following table describes the required parameters for each transfer method:

Transfer Method	Required Parameters
Browser	File Name
TFTP	Host Filepath
FTP	Host Filepath Username Password
SCP	Host Filepath Username Password

7. Click the Load Certificate button or Remove Certificate button.

8. If a certificate is loaded, click on the “details” link to show the following information.

Item	Description
`Issuer`	Certificate Authority who issued the certificate.
Subject	Server or domain for which the certificate is intended.
Valid From	Date when the certificate becomes valid.
Valid Until	Date when the certificate becomes invalid.
`Serial Number`	Serial number of the certificate.
Version	Version number of the certificate.

Configure Active Directory Tables

1. Log in to the ILOM SP web interface or the CMM ILOM web interface.

2. Select User Management --> Active Directory.

The Active Directory page appears.

3. At the bottom of the Active Directory page, click the link to access the category of table you want to configure:

Admin Groups

Operator Groups

Custom Groups

User Domains

Alternate Servers

DNS Locator Queries

4. Select the radio button of the individual table, then click Edit.

5. Enter the required data into the tables.

In the following tables, default data shows the expected format of the Active Directory data.

Admin Groups Table:

The Admin Groups table contains the names of the Microsoft Active Directory groups in the Distinguished Name (DN) format, Simple Name format, or NT-Style Name.

ID	Name
1	`CN=SpSuperAdmin,OU=Groups,DC=sales,DC=east,DC=oracle,DC=com`
2

Operator Groups Table:

The Operator Groups table contains the names of the Microsoft Active Directory groups in the Distinguished Name (DN) format, Simple Name format, or NT-Style Name.

ID	Name
1	`CN=SpSuperOper,OU=Groups,DC=sales,DC=east,DC=oracle,DC=com`
2

Custom Groups Table:

The Custom Groups table contains the names of the Microsoft Active Directory groups in the Distinguished Name (DN) format, Simple Name format, or NT-Style Name. The associated roles for the entry are also configured.

ID	Name	Roles
1	`custom_group_1`	`Admin, User Management, Console, Reset and Host Control, Read Only (aucro)`

User Domains Table:

User Domains are the authentication domains used to authenticate a user. When the user logs in, the name used is formatted in the specific domain name format. User authentication is attempted based on the user name that is entered and the configured user domains.

In the example below, the domain listed in entry 1 shows the principle format that is used in the first attempt to authenticate the user. Entry 2 shows the complete Distinguished Name, which Active Directory would use if the attempt to authenticate with the first entry failed.

Note - In the example below, <USERNAME> will be replaced with the user’s login name. During authentication, the user’s login name replaces <USERNAME>.

ID	Domain
1	`<USERNAME>@sales.east.oracle.com`
2	`CN=<USERNAME>,CN=Users,DC=sales,DC=east,DC=oracle,DC=com`

Alternate Servers Table:

The Alternate Servers table provides redundancy as well as a choice of different servers if required due to isolated domains. If a certificate is not supplied, but is required, the top-level primary certificate is used. The alternate servers have the same rules and requirements as the top-level certificate mode. Each server has its own certificate status, and its own certificate command to retrieve the certificate if it is needed.

ID	Address	Port	Certificate Status
1	`-`	0	`certificate not present`
2	`10.8.136.165`	0	`certificate present (details)`

The following image shows an Alternate Servers table with a certificate present in ID 2:

Alternate servers table

The following certificate information is displayed when you click on the “details” link:

Item	Description
`Issuer`	Certificate Authority who issued the certificate.
Subject	Server or domain for which the certificate is intended.
Valid From	Date when the certificate becomes valid.
Valid Until	Date when the certificate becomes invalid.
`Serial Number`	Serial number of the certificate.
Version	Version number of the certificate.

DNS Locator Queries Table:

The DNS Locator Queries table queries DNS servers to learn about the hosts to use for authentication.

The DNS Locator service query identifies the named DNS service. The port ID is generally part of the record, but it can be overridden by using the format <PORT:636>. Also, named services specific for the domain being authenticated can be specified by using the <DOMAIN> substitution marker.

Name	Domain
1	`_ldap._tcp.gc._msdcs.<DOMAIN>.<PORT:3269>`
2	`_ldap._tcp.dc._msdcs.<DOMAIN>.<PORT:636>`

Note - DNS and DNS Locator Mode must be enabled for DNS Locator Queries to work.

6. Click Save for your changes to take effect.

Troubleshoot Active Directory Authentication and Authorization

1. Log in to the ILOM SP web interface or the CMM ILOM web interface.

2. Select User Management --> Active Directory.

The Active Directory page appears.

3. In the Log Detail drop-down list, select the level of detail that you would like the event log to capture.

Choices are None, High, Medium, Low, and Trace.

4. Click Save to save your changes.

5. Attempt an authentication to generate events. Follow these steps:

a. From the System Monitoring tab select Event Logs.

b. In the Filter drop-down list, select Custom Filter.

Event log custom filter

c. In the Event Class drop-down list, select ActDir.

d. Click OK.

All Active Directory events will appear in the event log.

Event log

Configuring Lightweight Directory Access Protocol

Topics
Description	Links	Platform Feature Support
Configure LDAP settings	Configure the LDAP Server Configure ILOM for LDAP	x86 system server SP SPARC system server SP CMM
Configure LDAP settings	Configure the LDAP Server Configure ILOM for LDAP	x86 system server SP SPARC system server SP CMM

Before You Begin

To configure LDAP settings, you need the User Management (u) role enabled.

Configure the LDAP Server

1. Ensure that all users authenticating to ILOM have passwords stored in "crypt" format or the GNU extension to crypt, commonly referred to as "MD5 crypt."

ILOM only supports LDAP authentication for passwords stored in these two variations of the crypt format.

For example:

userPassword: {CRYPT}ajCa2He4PJhNo

userPassword: {CRYPT}$1$pzKng1$du1Bf0NWBjh9t3FbUgf46.

2. Add object classes posixAccount and shadowAccount, and populate the required property values for this schema (RFC 2307). See the following table for a description of the required property values.

Required Property	Description
uid	User name for logging in to ILOM
uidNumber	Any unique number
gidNumber	Any unique number
userPassword	Password
homeDirectory	Any value (this property is ignored by ILOM)
loginShell	Any value (this property is ignored by ILOM)

3. Configure the LDAP server to enable LDAP server access to ILOM user accounts.

Either enable your LDAP server to accept anonymous binds, or create a proxy user on your LDAP server that has read-only access to all user accounts that will authenticate through ILOM.

See your LDAP server documentation for more details.

Configure ILOM for LDAP

1. Log in to the ILOM SP web interface or the CMM ILOM web interface.

2. Select User Management --> LDAP.

The LDAP Settings page appears.

3. Enter the following values:

State - Select the Enabled check box to authenticate LDAP users.

Role - The default role of LDAP users.

Address - Either the IP address or DNS name of the LDAP server.

Port - The port number on the LDAP server. The default port is 389.

Searchbase - Type the branch of your LDAP server to search for users.

Bind DN - Type the Distinguished Name (DN) of a read-only proxy user on the LDAP server. ILOM must have read-only access to your LDAP server to search for and authenticate users.

Bind Password - Type the password of the read-only user.

4. Click Save for your changes to take effect.

5. To verify that LDAP authentication works, log in to ILOM using an LDAP user name and password.

Note - ILOM searches local users before LDAP users. If an LDAP user name exists as a local user, ILOM uses the local account for authentication.

Configuring LDAP/SSL Settings

Topics
Description	Links	Platform Feature Support
Configure LDAP/SSL settings	View and Configure LDAP/SSL Settings Configure LDAP/SSL Tables Troubleshoot LDAP/SSL Authentication and Authorization	x86 system server SP SPARC system server SP CMM

Before You Begin

To configure LDAP/SSL settings, you need the User Management (u) role enabled.

To view authentication and authorization events, you need the Read Only (o) role enabled.

To configure the Optional User Mapping property, you must be using ILOM 3.0.4 or a later version of ILOM.

View and Configure LDAP/SSL Settings

Follow these steps to view and configure LDAP/SSL settings:

1. Log in to the ILOM SP web interface or the CMM ILOM web interface.

2. Select User Management --> LDAP/SSL.

The LDAP/SSL page appears. There are three sections to the LDAP/SSL page.

The top section, which includes targets and properties.

LDAP/SSL targets and properties

The middle section, which includes certificate information.

LDAP/SSL certificate information

The bottom section, which includes the LDAP/SSL tables.

LDAP/SSL Admin Groups table

3. Configure the LDAP/SSL settings displayed in the top section of the LDAP/SSL Settings page.

See the following table for a description of the LDAP/SSL settings.

Property (Web)	Default	Description
State	Disabled	Enabled \| Disabled
Roles	(none)	Administrator \| Operator \| Advanced \| (none) Access role granted to all authenticated LDAP/SSL users. This property supports the legacy roles of Administrator or Operator, or any of the individual role ID combinations of ’`a`’, ’`u`’, ’`c`’, ’`r`’, ’`o`’ and ’`s`’. For example, `aucros`, where `a`=Admin, `u`=User Management, `c`=Console, `r`=Reset and Host Control, `o`=Read-Only, and `s`=Service. If you do not configure a role, the LDAP/SSL server is used to determine the role.
Address	0.0.0.0	IP address or DNS name of the LDAP/SSL server.
Port	0	Port used to communicate with the server. If `autoselect` is enabled, then the port is set to 0. Available in the unlikely event of a non-standard TCP port being used.
Timeout	4	Timeout value in seconds. Number of seconds to wait for individual transactions to complete. The value does not represent the total time of all transactions because the number of transactions can differ depending on the configuration. This property allows for tuning the time to wait when a server is not responding or is unreachable.
Strict Certificate Mode	Disabled	Enabled \| Disabled If enabled, the server certificate contents are verified by digital signatures at the time of authentication. Certificate must be loaded before Strict Certificate Mode can be set to enabled.
Optional User Mapping	Disabled	Enabled \| Disabled As of ILOM 3.0.4, optional user mapping is available. If enabled, alternative attributes other than the Distinguished Name (DN) can be used for user credential authentication. Use this property to convert a simple user login name to the DN for user credential validation. Click edit to enable and modify the User Attribute Mapping Parameters dialog, then click Save.
Log Detail	None	None \| High \| Medium \| Low Specifies the amount of diagnostics that go into the event log.

4. Click Save in the top section of the LDAP/SSL settings page to save any changes made to this section.

5. View the LDAP/SSL certificate information in the middle section of the LDAP/SSL settings page.

See the following table for a description of LDAP/SSL certificate settings.

Property	Displays	Description
Certificate File Status	`certificate not present`	Read-only indicator of whether a certificate exists.
Certificate File Status	`certificatepresent (details)`	Click on “details” for information about issuer, subject, serial number, valid_from, valid_to, and version.

6. Complete the “Certificate File Upload” section by selecting a transfer method for uploading the certificate file.

Note - This section is only required if Strict Certificate Mode is used. If Strict Certificate Mode is disabled, data will still be protected but a certificate will not be needed.

The following table describes the required parameters for each transfer method:

Transfer Method	Required Parameters
Browser	File Name
TFTP	Host Filepath
FTP	Host Filepath Username Password
SCP	Host Filepath Username Password

7. Click the Load Certificate button or Remove Certificate button.

8. If a certificate was loaded, click on the “details” link in the web interface to show the following information.

Item	Description
`Issuer`	Certificate Authority who issued the certificate.
`Subject`	Server or domain for which the certificate is intended.
`Valid From`	Date when the certificate becomes valid.
`Valid Until`	Date when the certificate becomes invalid.
`Serial Number`	Serial number of the certificate.
`Version`	Version number of the certificate.

Configure LDAP/SSL Tables

1. Log in to the ILOM SP web interface or the CMM ILOM web interface.

2. Select User Management --> LDAP/SSL.

The LDAP/SSL page appears.

3. At the bottom of the LDAP/SSL page, click the link to access the category of table you want to configure:

Admin Groups

Operator Groups

Custom Groups

User Domains

Alternate Servers

4. Select the radio button of the individual table, then click Edit.

5. Enter the required data in the tables.

In the following tables, default data shows the expected format of the LDAP/SSL data.

Admin Groups Table:

The Admin Groups table contains the names of the LDAP/SSL groups in the Distinguished Name (DN) format.

ID	Name
1	`CN=SpSuperAdmin,OU=Groups,DC=sales,DC=east,DC=oracle,DC=com`
2

Operator Groups Table:

The Operator Groups table contains the names of the LDAP/SSL groups in the Distinguished Name (DN) format.

ID	Name
1	`CN=SpSuperOper,OU=Groups,DC=sales,DC=east,DC=oracle,DC=com`
2

Custom Groups Table:

The Custom Groups table contains the names of the LDAP/SSL groups in the Distinguished Name (DN) format, Simple Name format, or NT-Style Name. The associated roles for the entry are also configured. The name listed in entry 1 uses the Simple Name format.

ID	Name	Roles
1	`custom_group_1`	`Admin, User Management, Console, Reset and Host Control, Read Only (aucro)`

User Domains Table:

Entry 1 shows the complete Distinguished Name, which LDAP/SSL would use if the attempt to authenticate the first entry failed.

Note - <USERNAME> will be replaced with the user’s login name during authentication. Either the principle or Distinguished Name format is supported.

ID	Domain
1	`UID=<USERNAME>,OU=people,DC=oracle,DC=com`
2

Alternate Servers Table:

The Alternate Servers table provides redundancy for authentication. If a certificate is not supplied, but is required, the top-level primary certificate is used. The alternate servers have the same rules and requirements as the top-level certificate mode. Each server has its own certificate status, and its own certificate command to retrieve the certificate if it is needed.

ID	Address	Certificate Status
1	`-`	`certificate not present`
2	`-`	`certificate not present`
3	`10.7.143.246`	`certificate present (details)`

The following image shows an Alternate Servers table with a certificate present in ID 2:

Alternate servers screen

The following information is displayed when you click on the “details” link:

Item	Description
`Issuer`	Certificate Authority who issued the certificate.
`Subject`	Server or domain for which the certificate is intended.
`Valid From`	Date when the certificate becomes valid.
`Valid Until`	Date when the certificate becomes invalid.
`Serial Number`	Serial number of the certificate.
`Version`	Version number of the certificate.

Troubleshoot LDAP/SSL Authentication and Authorization

1. Log in to the ILOM SP web interface or the CMM ILOM web interface.

2. Select User Management --> LDAP/SSL.

The LDAP/SSL page appears.

3. In the Log Detail drop-down list, select the level of detail that you would like the event log to capture.

Choices are None, High, Medium, Low, and Trace.

4. Click Save to save your changes.

5. Attempt an authentication to generate events:

a. Select System Monitoring --> Event Logs.

b. In the Filter drop-down list, select Custom Filter.

Event log custom filter

c. In the Event Class drop-down list, select LdapSsl.

d. Click OK for your changes to take effect.

All LDAP/SSL events will appear in the event log.

Event log.

Configuring RADIUS

Topics
Description	Links	Platform Feature Support
Configure RADIUS settings	Configure RADIUS Settings	x86 system server SP SPARC system server SP CMM

Before You Begin

To configure RADIUS settings, you need the User Management (u) role enabled.

Configure RADIUS Settings

1. Log in to the ILOM SP web interface or the CMM ILOM web interface.

2. Select User Management --> RADIUS.

The RADIUS Settings page appears.

RADIUS Settings page

3. Complete the settings.

Property (Web)	Default	Description
State	Disabled	Enabled \| Disabled Specifies whether the RADIUS client is enabled or disabled.
Role	Operator	Administrator \| Operator \| Advanced Roles Access role granted to all authenticated RADIUS users. This property supports the legacy roles of Administrator or Operator, or any of the individual role ID combinations of ’`a`’, ’`u`’, ’`c`’, ’`r`’, ‘o’, and ’`s`’. For example, `aucrs`, where `a`=Admin, `u`=User Management, `c`=Console, `r`=Reset and Host Control, `o`=Read Only, and `s`=Service.
Address	0.0.0.0	IP address or DNS name of the RADIUS server. If the DNS name is used, DNS must be configured and functional.
Port	1812	Specifies the port number used to communicate with the RADIUS server. The default port is 1812.
Shared Secret	(none)	Specifies the shared secret that is used to protect sensitive data and to ensure that the client and server recognize each other.

4. Click Save for your changes to take effect.