C H A P T E R 3

User Account Management

Topics
Description | Links
--- | ---
Learn about managing user accounts and roles | Guidelines for Managing User Accounts User Account Roles and Privileges
Learn about Single Sign On | Single Sign On
Learn about SSH authentication | SSH User Key-Based Authentication
Learn about Active Directory | Active Directory
Learn about LDAP | Lightweight Directory Access Protocol LDAP/SSL
Learn about RADIUS | RADIUS

Related Topics
For ILOM | Chapter or Section | Guide
--- | --- | ---
Getting started | Initial ILOM Setup Procedures Using the Web Interface Initial ILOM Setup Procedures Using the CLI | Oracle Integrated Lights Out Manager (ILOM) 3.0 Getting Started Guide (820-5523-10)
CLI | Managing User Accounts | Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide (820-6412)
Web interface | Managing User Accounts | Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide (820-6411)
SNMP and IPMI hosts | Managing User Accounts Using SNMP SNMP Command Reference | Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide (820-6413)
The ILOM 3.0 Documentation Collection is available at: `http://docs.sun.com/app/docs/prod/int.lights.mgr30#hic`

##

Guidelines for Managing User Accounts

Apply the following general guidelines when you manage user accounts:

- ILOM supports a maximum of 10 active user sessions per service processor (SP). Some SPARC systems support a maximum of only 5 active user sessions per SP.

- The user name of an account must be at least four characters and no more than 16 characters. User names are case sensitive and must start with an alphabetical character. You can use alphabetical characters, numerals, hyphens, and underscores. Do not include spaces in user names.

- Each user account is assigned one or more advanced roles, which determine the privileges of the user account. Depending on the roles assigned to your user account, you can use the ILOM web interface, command-line interface (CLI), or SNMP to view account information and perform various administrative functions.

- You can either configure local accounts or you can have ILOM authenticate accounts against a remote user database, such as Active Directory, LDAP, LDAP/SSL, or RADIUS. With remote authentication, you can use a centralized user database rather than configuring local accounts on each ILOM instance.

For more information and procedures for managing user accounts, see one of the following guides:

- Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide

- Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide

- Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide

##

User Account Roles and Privileges

For ILOM 3.0, user roles are implemented to control user privileges. However, for backward compatibility, ILOM 2.x style user accounts (which have either Administrator or Operator privileges) are still supported.

### ILOM 3.0 User Account Roles

ILOM 3.0 user accounts have defined roles that determine ILOM user access and rights. You can manage user accounts using the ILOM web interface or the CLI. The roles assigned to ILOM accounts are listed in TABLE 3-1.

TABLE 3-1 ILOM 3.0 User Account Roles
Roles | Definition | Privileges
--- | --- | ---
`a` | Admin | A user who is assigned the Admin (`a`) role is authorized to view and change the state of ILOM configuration variables. With the exception of tasks that require Admin users to have User Management, Reset and Host Control and Console roles enabled.
`u` | User Management | A user who is assigned the User Management (`u`) role is authorized to create and delete user accounts, change user passwords, change roles assigned to other users, and enable/disable the physical-access requirement for the `default` user account. This role also includes authorization to set up LDAP, LDAP/SSL, RADIUS, and Active Directory.
`c` | Console | A user who is assigned the Console (`c`) role is authorized to access the ILOM Remote Console and the SP console and to view and change the state of the ILOM console configuration variables.
`r` | Reset and Host Control | A user who is assigned the Reset and Host Control (`r`) role is authorized to operate the system, which includes power control, reset, hot-plug, enabling and disabling components, and fault management. This role maps very closely to the ILOM 2.0 user with Operator privileges. For more information about backward compatibility of ILOM 2.0 user roles, see Support for ILOM 2.x User Accounts.
`o` | Read Only | A user who is assigned the Read Only (`o`) role is authorized to view the state of the ILOM configuration variables but cannot make any changes. Users assigned this role can also change the password and the Session Time-Out setting for their own user account.
`s` | Service | A user who is assigned the Service (`s`) role can assist Sun service engineers in the event that on-site service is required.

##

Single Sign On

Single Sign On (SSO) is a convenient authentication service that enables you to log in to ILOM once to establish your credentials, thus reducing the number of times you need to enter your password to gain access to ILOM. Single Sign On is enabled by default. As with any authentication service, authentication credentials are passed over the network. If this is not desirable, consider disabling the SSO authentication service.

##

SSH User Key-Based Authentication

Tradition ally, automation of password authentication is made possible by SSH key-based authentication. Prior to the implementation of the SSH key-based authentication feature, users who logged in to the ILOM SP using SSH were required to supply a password interactively. An automatic mechanism for password authentication is most beneficial when you have multiple systems that require a similar update.

The primary capabilities afforded by SSH key-based authentication are as follows:

- Users are able to write scripts that automatically copy log files off of a service processor (SP) for archival and analysis.

- Users are able to write scripts that automatically and/or regularly execute SP commands over a network-based SSH connection from a remote system.

Thus, SSH key-based authentication enables you to accomplish both of the above activities through the use of scripts that execute without manual intervention and that do not include embedded passwords.

Regarding the use and handling of SSH keys, ILOM enables users to add generated keys to individual user accounts on the SP.

For more information and procedures for adding and deleting SSH keys, see one of the following guides:

- Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide

- Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide

##

Active Directory

ILOM supports Active Directory, the distributed directory service included with Microsoft Windows Server operating systems. Like an LDAP directory service implementation, Active Directory is used to authenticate user credentials.

Note - The service processor (SP) expects to communicate with the Active Directory server using a secure channel. To ensure security, the Active Directory server should be loaded with a certificate that can be presented during the SP user authentication process so that protocol negotiations can allow a private channel to be set up.

### User Authentication and Authorization

Active Directory provides both authentication of user credentials and authorization of user access levels to networked resources. Active Directory uses authentication to verify the identity of a user before that user can access system resources. Active Directory uses authorization to grant specific access privileges to a user in order to control a user’s rights to access networked resources. User access levels are configured or learned from the server based on the user’s group membership in a network domain, which is a group of hosts identified by a specific Internet name. A user can belong to more than one group. Active Directory authenticates users in the order in which the user’s domains were configured.

### User Authorization Levels

Once authenticated, the user’s authorization level can be determined in the following ways:

- In the simplest case, the user authorization of either Operator, Administrator, or Advanced Roles (see User Account Roles and Privileges) is learned directly through the Active Directory’s configuration of the SP. Access and authorization levels are dictated by the `defaultrole` property. Setting up users in the Active Directory database requires only a password with no regard to group membership. On the SP, the `defaultrole` will be set to either Administrator, Operator, or the Advanced Role settings `a/u/c/r/o/s`. All users authenticated through Active Directory are assigned the privileges associated with the Administrator, Operator, or Advanced Roles based solely on this configuration.

- A more integrated approach is also available by querying the server. For configuration, the SP Administrator Group Tables, Operator Group Tables, or Custom Group Tables must be configured with the corresponding group names from the Active Directory server that will be used to determine access levels. Up to five Active Directory groups can be entered to designate an Administrator; another five can be used to assign Operator privileges; and up to five groups can be assigned to Custom Groups, which contain Advanced Roles (see User Account Roles and Privileges). Group membership of the user is used to identify the proper access level of either Administrator, Operator, or Advanced Roles by looking up each group name in the configured Active Directory tables on the SP. If the user’s group list is not in either of the defined SP user groups, then access is denied. A user assigned to more than one group will receive the sum of all privileges.

For more information and procedures for configuring Active Directory settings, see one of the following guides:

- Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide

- Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide

- Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide

##

Lightweight Directory Access Protocol

ILOM supports Lightweight Directory Access Protocol (LDAP) authentication for users, based on the OpenLDAP software. LDAP is a general-purpose directory service. A directory service is a centralized database for distributed applications designed to manage the entries in a directory. Thus, multiple applications can share a single user database. For more detailed information about LDAP, go to:

`http://www.openldap.org/`

For more information and procedures for configuring LDAP settings, see one of the following guides:

- Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide

- Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide

- Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide

##

LDAP/SSL

LDAP/SSL offers enhanced security to LDAP users by way of Secure Socket Layer (SSL) technology. To configure LDAP/SSL in a SP, you need to enter basic data--such as primary server, port number, and certificate mode--and optional data such as alternate server or event or severity levels. You can enter this data using the LDAP/SSL configuration page of the ILOM web interface, the CLI, or SNMP.

For more information and procedures for configuring LDAP/SSL settings, see one of the following guides:

- Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide

- Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide

- Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide

##

RADIUS

ILOM supports Remote Authentication Dial-In User Service (RADIUS) authentication. RADIUS is an authentication protocol that facilitates centralized user administration. RADIUS provides many servers shared access to user data in a central database, providing better security and easier administration. A RADIUS server can work in conjunction with multiple RADIUS servers and other types of authentication servers.

RADIUS is based on a client-server model. The RADIUS server provides the user authentication data and can grant or deny access, and the clients send user data to the server and receive an “accept” or “deny” response. In the RADIUS client-server model, the client sends an Access-Request query to the RADIUS server. When the server receives an Access-Request message from a client, it searches the database for that user's authentication information. If the user's information is not found, the server sends an Access-Reject message and the user is denied access to the requested service. If the user's information is found, the server responds with an Access-Accept message. The Access-Accept message confirms the user's authentication data and grants the user access to the requested service.

All transactions between the RADIUS client and server are authenticated by the use of a specific text string password known as a shared secret. The client and server must each know the shared secret because it is never passed over the network. You must know the shared secret to configure RADIUS authentication for ILOM.

In order to use RADIUS authentication with ILOM, you must configure ILOM as a RADIUS client.

For more information and procedures for configuring RADIUS settings, see one of the following guides:

- Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide

- Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide

- Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide

Copyright © 2010, Oracle and/or its affiliates. All rights reserved.