1

I have been working with some new HP DL360 Gen9 server. I'm attempting to configure these for LDAP authentication against our OpenLDAP directory and not having much luck.

First, all of our Distinguished Names for user accounts start with "uid=" and not "cn=". Our LDAP groups naturally follow the same convention.

So, a user account is uid=,ou=People,dc=domain,dc=com

And a group contains these listed in it as members.

This is almost how all LDAP directories that work with Linux/Unix clients are configured. I've been able to successfully integrate several other supposed "AD only systems", but this one eludes me.

Reading the info I can find, HP is looking for the cn attribute, which while cute, is not going to work in this case. I am beginning to suspect that there is no way to do this with HP - a huge shortcoming on their part for sure.

Has anyone here successfully done this and gotten things to work, or should I just throw in the towel?

Thanks again!

1
  • I never configure ILO for directory services. From small organizations to large, I've rarely seen it done. However, when it's done, it's usually via Active Directory.
    – ewwhite
    Aug 7, 2015 at 11:12

2 Answers 2

2

Standard OpenLDAP overlays do include support for "memberOf", even enabled by default in recent distributions.

iLO 4 firmware v2.54 download site (hpe.com) added support for OpenLDAP, including using the "uid" attribute for user logins using short names with a search context, and support for proper LDAP-standard Group member attributes instead of the User's memberOf attribute.

1

Yes there are definitely a few shortcomings when it comes to support for non-AD LDAP servers.

If you leave out the "Directory User Context" fields out, then at least your users can login with their full DN, i.e. uid=joe,ou=people,dc=example,dc=com but obviously that's not a great solution.

As far as looking at group memberships, not sure if OpenLDAP supports this, but many other (especially OpenDJ based ones) support virtual attributes where you can simulate a virtual memberOf attribute for the user record which will contain the DNs of the ou=groups records. I have gotten this to work from a regular ldapsearch perspective based on the searches I see iLO make, but don't have it fully working yet. I'll post here if I'm successful.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .