Users Guide

racadm sslcertdownload -t 0x1 -f <RAC SSL certificate>
2. On the domain controller, open an MMC Console window and select Certificates → Trusted Root Certification Authorities.
3. Right-click Certificates, select All Tasks and click Import.
4. Click Next and browse to the SSL certificate file.
5. Install iDRAC SSL Certificate in each domain controller’s Trusted Root Certification Authority.
If you have installed your own certificate, make sure that the CA signing your certificate is in the Trusted Root Certification
Authority list. If the Authority is not in the list, you must install it on all your domain controllers.
6. Click Next and select whether you want Windows to automatically select the certificate store based on the type of certificate,
or browse to a store of your choice.
7. Click Finish and click OK. The iDRAC firmware SSL certificate is imported to all domain controller trusted certificate lists.
Supported Active Directory authentication mechanisms
You can use Active Directory to define iDRAC user access using two methods:
• Standard schema solution, which uses Microsoft’s default Active Directory group objects only.
• Extended schema solution, which has customized Active Directory objects. All the access control objects are maintained in
Active Directory. It provides maximum flexibility to configure user access on different iDRACs with varying privilege levels.
Related links
Standard schema Active Directory overview
Extended schema Active Directory overview
Standard schema Active Directory overview
As shown in the following figure, using standard schema for Active Directory integration requires configuration on both Active
Directory and iDRAC.
Figure 1. Configuration of iDRAC with active directory standard schema
In Active Directory, a standard group object is used as a role group. A user who has iDRAC access is a member of the role group. To
give this user access to a specific iDRAC, the role group name and its domain name need to be configured on the specific iDRAC.
The role and the privilege level are defined on each iDRAC and not in the Active Directory. You can configure up to five role groups
in each iDRAC. Table reference no shows the default role group privileges.
Table 21. Default role group privileges
Role Groups Default Privilege Level Permissions Granted Bit Mask
Role Group 1 None Log in to iDRAC, Configure
iDRAC, Configure Users, Clear
Logs, Execute Server Control
0x000001ff
125