LDAP Feature for the Remote Console Switch : Configuring the LDAP Authentication Parameters

Configuring the LDAP Authentication Parameters
The Authentication panel allow you to configure your authentication and authorization configuration parameters. You can send the username, password, and other information to the Remote Console Switch, which then uses LDAP to retrieve data from the Directory Service in order to determine what permissions the user has. Permissions can be used to control access to the AMP as well as controlling console redirection and preemption. Access controls for the AMP can restrict a user’s ability to view or change configuration parameters for the Remote Console Switch.
Enabling LDAP Authentication
The Authentication Settings field allows you to choose Local or LDAP Authentication. Click the Use LDAP Authentication checkbox to authenticate against the LDAP-enabled directory service.
Once LDAP is enabled, the RCS and Root Domains should be designated in the provided fields.
Entering Authentication Parameters
If you plan to install the Dell Extended Schema, enter only the RCS and Root Domains that will be used.
If you elect not to use the Dell Extended Schema, the RCS Switches and access controlled SIPs in your installation will be configured as Computer Objects within Active Directory. To do this, you will first need to configure an Organizational Unit to hold group objects that relate users to access controlled Remote Console Switches and their attached SIPs. This can be a previously created OU, or one created specifically for this purpose but it must be unique among all OU objects in the Group Container domain.
Next, choose an attribute within the LDAP directory to be used to contain discretionary access control information. This should be a previously unused attribute that is capable of storing a string value. (The default is the "info" attribute of the Group Object.)
Finally, you will need to enter the location for the Group Container, the Group Container Domain and the Access Control Attribute in the blanks provided in the Global - Authentication window.
For more detailed descriptions of the Authentication panel fields, see Table 9‑1.
To access the Authentication panel in the Remote Console Switch Software:
In the AMP, click the Settings tab, then click Global - Authentication.
Figure 9 2. Remote Console Switch Software - Authentication Panel Local/LDAP and Parameters
Table 9 1. Authentication Panel Field Descriptions
A read-only field, displaying the name of the appliance as read from the sysName object of the appliance Management Information Base (MIB).
Radio Button to indicate which Active Directory (AD) object classes are used to store information related to authorization. For the default Standard schema, Microsoft Active Directory objects are used. When using the Extended schema, the extra Dell object classes are added.
The RCS Domain field contains the name of the Active Directory Domain chosen to hold all objects that represent Remote Console Switches and SIPs.
This field, available when the standard schema is selected, contains part of the Distinguished Name of an Organizational Unit (OU) object in Active Directory. The OU is used to hold group objects that relate users to access controlled Remote Console Switches and their attached SIPs.
For example, suppose the Distinguished Name of the chosen OU is: ou=KVM-AccessControls,dc=MyCom,dc=com. In this case, the Group Container field should be set to "KVM-AccessControls." The name entered into the Group Container field must be unique among all OU objects in the Group Container domain. You may choose to use a previously created OU for the Group Container, or create one specifically for this purpose.
Group Container Domain (Standard schema set only)
This field, available when the Standard schema is selected, is the DNS name of the Active Directory domain where the group container resides.
Access Control Attribute (Standard schema set only)
The value of this field specifies which attribute in the LDAP directory is to be used to contain discretionary access control information and is only enabled when Standard Schema is selected.
The Access Control Attribute is chosen from among the attributes in the LDAP directory object representing the group whose membership includes both the user and the appliance or attached computer that you are trying to access.
When using the Standard schema, it is necessary for Group objects in the Group Container to have an attribute that is chosen to contain the permission level associated with the Group. The Access Control Attribute field, available when the Standard schema is selected, contains the name of the chosen attribute. The chosen attribute must be capable of storing a character string value; for example, the default attribute is "info" which is an attribute accessible via the Active Directory Users and Computers (ADUC) snap-in. Using ADUC, the value of the info attribute is set by accessing the "Notes" property of the Group object.