Users Guide

4. Click Apply to save the settings.
NOTE: You must apply the settings before continuing. If you do not apply the settings, the settings are lost when
you navigate to the next page.
5. In the Extended Schema Settings section, type the CMC device name and the domain name.
6. If you have enabled certicate validation, you must upload the domain forest root certicate authority-signed certicate to
CMC. In the
Manage Certicates section, type the le path of the certicate or browse to the certicate le. Click Upload to
upload the le to CMC.
NOTE: The File Path value displays the relative le path of the certicate you are uploading. You must type the
absolute le path, which includes the full path and the complete le name and le extension.
The SSL certicates for the domain controllers must be signed by the root certicate authority-signed certicate. The root
certicate authority-signed certicate must be available on the management station accessing CMC.
CAUTION: SSL certicate validation is required by default. Disabling this certicate is not recommended.
7. If you have enabled Single Sign-On (SSO), in the Kerberos Keytab section, click Browse, specify the keytab le and click
Upload. When the upload is complete, a message is displayed indicating a successful or failed upload.
8. Click Apply.
The CMC web server automatically restarts after you click Apply.
9. Log in to the CMC Web interface.
10. Select Chassis in the system tree, click the Network tab, and then click the Network subtab. The Network Conguration page
is displayed.
11. If Use DHCP for CMC Network Interface IP Address is enabled, do one of the following:
• Select Use DHCP to Obtain DNS Server Addresses to enable the DHCP server to obtain the DNS server addresses
automatically.
• Manually congure a DNS server IP address by leaving the Use DHCP to Obtain DNS Server Addresses check box
unchecked and then typing your primary and alternate DNS server IP addresses in the elds provided.
12. Click Apply Changes.
The Active Directory settings for extended schema is congured.
Conguring Active Directory With Extended Schema Using RACADM
To congure a CMC Active Directory with Extended Schema by using the RACADM commands, oen a command prompt and enter
the following commands at the command prompt:
racadm config -g cfgActiveDirectory -o cfgADEnable 1
racadm config -g cfgActiveDirectory -o cfgADType 1
racadm config -g cfgActiveDirectory -o cfgADRacName <RAC common name>
racadm config -g cfgActiveDirectory -o cfgADRacDomain < fully qualified rac domain name >
racadm config -g cfgActiveDirectory -o cfgADDomainController1 < fully qualified domain name
or IP Address of the domain controller >
racadm config -g cfgActiveDirectory -o cfgADDomainController2 < fully qualified domain name
or IP Address of the domain controller >
racadm config -g cfgActiveDirectory -o cfgADDomainController3 < fully qualified domain name
or IP Address of the domain controller >
NOTE: You must congure at least one of the three addresses. CMC attempts to connect to each of the congured
addresses one-by-one until it makes a successful connection. With Extended Schema, these are the FQDN or IP
addresses of the domain controllers where this CMC device is located.
To disable the certicate validation during an handshake (optional):
racadm config -g cfgActiveDirectory -o cfgADCertValidationEnable 0
NOTE: In this case, you do not have to upload a CA certicate.
To enforce the certicate validation during SSL handshake (optional):
racadm config -g cfgActiveDirectory -o cfgADCertValidationEnable 1
In this case, you must upload a CA certicate:
racadm sslcertupload -t 0x2 -f < ADS root CA certificate >
127