Hello, and welcome back. In this video we'll be taking a look at the Directory
Services integration feature of the iDRAC. To get started let's cover a
couple of prerequisites. We aren't going to be covering how to configure these processes,
but we want to make sure to cover the requirements needed in order to use this feature.
First will be LDAPS. For current and future versions this will be a requirement due
to security concerns. To enable LDAPS you will need to acquire a root CA certificate
and install this to each domain controller you will be enabling LDAPS on. Please review the
documentation provided by Microsoft for more info on this configuration. Additionally for
communication to work we will want port 636 and 3269 open from the iDRAC to the DC. The next thing
that must be done on the domain controller is the configuration of the security groups.
The groups we set up on the iDRAC must match a group in active directory. The user accounts we
will be using to log into the iDRAC must be associated to this active directory group.
As an example review the picture on this slide this shows the active directory
group and associated user that we will be utilizing in this video. Once logged into
our iDRAC we will then need to click on the 'iDRAC Settings' button then click 'Users'.
Click on 'Directory Services', highlight the 'Microsoft Active Directory' option
and then click 'Enable'. Click edit to start the wizard.
For basic setup certificate validation is not required.
This is separate from the certificate requirement for LDAPS, which is a requirement. We will not be
covering single sign-on or key tab in this video so simply click next to continue.
Here we will click 'Add' and type our user domain name. Next we need to configure the
domain controllers to use. You can choose to utilize DNS, but I will be using a single IP
for this demonstration. Here you can choose between standard and extended schema.
The standard option is fine for a basic setup, as all the necessary object classes are provided
by default. As stated in the highlighted text above if you wish to use the extended schema
you must first run the Dell EMC utility programs that will add new object classes to the schema,
as well as functionality to the active directory
users and computers snap in. This is not something that we'll be covering in this video.
Next we will provide the global catalogue.
You can use DNS if you wish, I will again be using the IP address.
Scroll down and we will configure a role group for our users. Here we must provide
the exact name of the group from active directory as well as the domain name.
The role groups have pre-configured levels of access,
however we can customize this further by changing which boxes are selected.
After configuring your role groups click 'Save' to finish setup.
Next we should click the 'Test' button and confirm our settings.
This is a very helpful tool if directory services is not working.
After typing the user's UPN and password click 'Test'. Scrolling down we see that many tests
have passed including user authentication, however the authorization test has failed.
When we look at the test log we can see that the user is not a member of the configured group.
What you have just witnessed is an example of having the
incorrect group name in the role groups.
To rectify this let's go back and edit that group name.
Here I will remove the 'i' in the name, as the group is actually called 'DRAC Admins'. After
saving and going back to the 'Test' section we can see that the test will pass correctly this time.
Once a user passes the final authorization test
we can see the privileges they gain for managing the iDRAC.
As a final step we will confirm our login works by
changing the domain selection and entering our credentials.
This will now conclude our tutorial on Directory Services Integration thank you for watching