HP Integrity iLO 2 Operations Guide

Figure 71 Restricting General Use
Alternatively, the directory administrator could create a role that grants the login right and restrict
it to the corporate network, create another role that grants only the server reset right and restrict
it to after-hours operation. This configuration is easier to manage but more dangerous because
ongoing administration can create another role that grants users from addresses outside the
corporate network the login right, which could unintentionally grant the iLO 2 administrators in
the server reset role the ability to reset the server from anywhere, provided they satisfy the time
constraints of that role.
The previous configuration satisfies corporate security policy. However, adding another role that
grants the login right can inadvertently grant server reset privileges from outside the corporate
subnet after hours. A more manageable solution would be to restrict the reset role, as well as the
general use role.
Figure 72 Restricting the Reset Role
Directory Services Schema (LDAP)
A directory schema specifies the types of objects that a directory can have and the mandatory and
optional attributes of each object type. The following sections describe both the HP management
core, and the LDAP object identifier classes and attributes that are specific to iLO 2.
HP Management Core LDAP Object Identifier Classes and Attributes
Object identifiers (OIDs) are unique numbers that are used by LDAP to identify object class, attribute,
syntaxes (data types), matching rules, protocol mechanisms, controls, extended operation and
supported features.
Directory Services Schema (LDAP) 201