Users Guide

RSA SecurID 2FA
iDRAC can be configured to authenticate with a single RSA AM server at a time. The global settings on RSA AM server apply to all iDRAC
local users, AD, and LDAP users.
NOTE: RSA SecurID 2FA feature is available only on Datacenter license.
Following are the pre-requisites before you configure iDRAC to enable RSA SecurID:
● Configure Microsoft Active Directory server.
● If you try to enable RSA SecurID on all AD users, add the AD server to the RSA AM server as an Identity Source.
● Ensure you have a generic LDAP server.
● For all LDAP users, the Identity Source to the LDAP server must be added in RSA AM server.
To enable RSA SecurID on iDRAC, the following attributes from the RSA AM server are required:
1. RSA Authentication API URL — The URL syntax is: https://<rsa-am-server-hostname>:<port>/mfa/v1_1, and by
default the port is 5555.
2. RSA Client-ID — By default, the RSA client ID is the same as the RSA AM server hostname. Find the RSA client ID at RSA AM
server's authentication agent configuration page.
3. RSA Access Key — The Access Key can be retreived on RSA AM by navigating to Setup > System Settings > RSA SecurID >
Authentication APIsection, which is usually displayed as
l98cv5x195fdi86u43jw0q069byt0x37umlfwxc2gnp4s0xk11ve2lffum4s8302. To configure the settings through iDRAC
GUI:
● Go to iDRAC Settings > Users.
● From Local Users section, select an existing local user and click Edit.
● Scroll down to the bottom of the Configuration page.
● In RSA SecurID section, Click the link RSA SecurID Configuration to view or edit these settings.
You can also configure the settings as follows:
● Go to iDRAC Settings > Users.
● From Directory Services section, select Microsoft Active Service or Generic LDAP Directory Service, and click Edit.
● In RSA SecurID section, Click the link RSA SecurID Configuration to view or edit these settings.
4. RSA AM server certificate (chain)
You can login to iDRAC using RSA SecurID token via iDRAC GUI and SSH.
RSA SecurID Token App
You need to install RSA SecurID Token app on you system or on smart phone. When you try to log in to iDRAC, you are asked to input the
passcode shown in the app.
If a wrong passcode is entered, the RSA AM server challenges the user to provide the "Next Token." This may happen even though the
user may have entered the correct passcode. This entry proves that the user owns the right Token that generates the right passcode.
You get the Next Token from RSA SecurID Token app by clicking on Options. Check Next Token, and the next passcode is available.
Time is critical in this step. Otherwise, iDRAC may fail the verification of the next token. If the iDRAC user login session times out, it
requires another attempt to log in
If a wrong passcode is entered, the RSA AM server will challenge the user to provide the "Next Token." This challenge happens even
though the user may have later entered the correct passcode. This entry proves that the user owns the right Token that generates the
right passcodes.
To get the next token from RSA SecurID Token app, click on Options and check Next Token. A new token is generated. Time is critical in
this step. Otherwise, iDRAC may fail the verification of the next token. If the iDRAC user login session times out, it requires another
attempt to log in.
查看系统运行状况
在执行任务或触发事件之前，您可以使用 RACADM 以检查系统是否处于适当的状态。要从 RACADM 查看远程服务状态，请使用
getremoteservicesstatus 命令。
38 登录 iDRAC