Users Guide

Configuring Active Directory users
If your company uses the Microsoft Active Directory software, you can configure the software to provide access to iDRAC,
allowing you to add and control iDRAC user privileges to your existing users in your directory service. This is a licensed feature.
You can configure user authentication through Active Directory to log in to the iDRAC. You can also provide role-based
authority, which enables an administrator to configure specific privileges for each user.
NOTE: For any deployment done via MX Template and CA validation is enabled within template, the user must upload CA
certificates at first login or before changing Authentication Service from LDAP to Active Directory or vice versa.
Prerequisites for using Active Directory authentication for iDRAC
To use the Active Directory authentication feature of iDRAC, make sure that you have:
● Deployed an Active Directory infrastructure. See the Microsoft website for more information.
● Integrated PKI into the Active Directory infrastructure. iDRAC uses the standard Public Key Infrastructure (PKI) mechanism
to authenticate securely into the Active Directory. See the Microsoft website for more information.
● Enabled the Secure Socket Layer (SSL) on all domain controllers that iDRAC connects to for authenticating to all the domain
controllers.
Enabling SSL on domain controller
When iDRAC authenticates users with an Active Directory domain controller, it starts an SSL session with the domain controller.
At this time, the domain controller must publish a certificate signed by the Certificate Authority (CA)—the root certificate of
which is also uploaded into iDRAC. For iDRAC to authenticate to any domain controller—whether it is the root or the child
domain controller—that domain controller must have an SSL-enabled certificate signed by the domain’s CA.
If you are using Microsoft Enterprise Root CA to automatically assign all your domain controllers to an SSL certificate, you must:
1. Install the SSL certificate on each domain controller.
2. Export the Domain Controller Root CA Certificate to iDRAC.
3. Import iDRAC Firmware SSL Certificate.
Installing SSL certificate for each domain controller
To install the SSL certificate for each controller:
1. Click Start > Administrative Tools > Domain Security Policy.
2. Expand the Public Key Policies folder, right-click Automatic Certificate Request Settings and click Automatic
Certificate Request.
The Automatic Certificate Request Setup Wizard is displayed.
3. Click Next and select Domain Controller.
4. Click Next and click Finish. The SSL certificate is installed.
Exporting domain controller root CA certificate to iDRAC
To export the domain controller root CA certificate to iDRAC:
1. Locate the domain controller that is running the Microsoft Enterprise CA service.
2. Click Start > Run.
3. Enter mmc and click OK.
4. In the Console 1 (MMC) window, click File (or Console ) and select Add/Remove Snap-in.
5. In the Add/Remove Snap-In window, click Add.
6. In the Standalone Snap-In window, select Certificates and click Add.
7. Select Computer and click Next.
8. Select Local Computer, click Finish, and click OK.
9. In the Console 1 window, go to Certificates Personal Certificates folder.
146
Configuring user accounts and privileges