Device onboarding not working with LDAP account

Um, yep, that was it, it checks the local user list only.  I've added a local user with the same username (dellomesvc), supplied it with admin privileges and set a random password (not the same password as the domain account) and disabled it.

This seems to be doing the trick - I can now onboard devices.

So flow is:

discovery against idrac using dellomesvc > local user list shows dellomesvc as disabled user > idrac attempts ldap auth (bit surprised by this, you'd think it would stop here) > ldap auth successful > discovery complete.

Onboarding against idrac using dellomesvc > local user list shows dellomesvc as disabled user > idrac attempts ldap auth > ldap auth successful > OME does "something" to query the local admin user list, if no match is found, onboarding fails, if administrator is found with matching username (even a disabled account), onboarding completes.

Hope that helps someone.  And hope this is fixed in a later release.

Hey MikeyDeeBee

Nice work around, I'm going to use this in our environment, thankfully I can use puppet to add a local user via IPMI.  Alternatively I guess a bash script with ipmitool in a loop would be an ok alternative to do this at scale.

something like:

ldapUser=user
ldapPassword=Password

for i in `seq 1 10`; do
  # This will equate to 192.168.0.1-192.168.0.10
  ip=192.168.0.$i
  ipmitool -I lanplus -H $ip -U $ldapUser -P $ldapPassword ipmitool user set name 3 $ldapUser         
  ipmitool -I lanplus -H $ip -U $ldapUser -P $ldapPassword ipmitool user disable  3                   
done

I've not got access test the above at the moment, so check the ipmitool man page, but should be a good starter.

Hi,

Thanks for your question. When using AD credentials for performing discovery, there is no direct way to figure out the privileges of a user from idrac as the privileges are stored in AD. Which is why, OME is designed to assume that user has admin privilege on the server which is discovered.

You will be able to run all the operations from OME on the server. If the user does not have enough privilege for any operation, then the task would fail with the error message that user does not have enough privilege to perform the operation. I hope this answers your question.

Yep, I called the racadm tool from powershell (this was a while ago now):

$Logtextfile = ".\updatedraclog_$((Get-Date).ToString('yyyy-MM-dd')).txt"

$dracs = import-csv c:\scripts\idracs\insertcsvhere.csv
$env:Path = $env:Path + ";C:\Program Files\Dell\SysMgt\rac5\"
$binddn = "SecretDN"
$bindpw = "Secretpassword"
$admingrpdn = "SecretDN"

foreach ($drac in $dracs){
$drac.hostname,$drac.username,$drac.password,$drac.dns1,$drac.dns2,$drac.binddn,$drac.bindpw,$drac.admingrpdn | out-null
write-host "starting job for $($drac.hostname)"
"starting job for $($drac.hostname)`n" | Out-File $Logtextfile -Append
$hostname = $drac.hostname
$username = $drac.username
$password = $drac.password
$dns1 = $drac.dns1
$dns2 = $drac.dns2
try {
racadm.exe -r $hostname -u $username -p $password sslcertupload -t 2 -f c:\scripts\idracs\CA.cer | Out-File $Logtextfile -Append
racadm.exe -r $hostname -u $username -p $password config -g cfgldap -o cfgLdapCertValidationenable 1 | Out-File $Logtextfile -Append
racadm.exe -r $hostname -u $username -p $password config -g cfgldap -o cfgLdapEnable 1 | Out-File $Logtextfile -Append
racadm.exe -r $hostname -u $username -p $password config -g cfgldap -o cfgLdapServer ldap.secret.com | Out-File $Logtextfile -Append
racadm.exe -r $hostname -u $username -p $password config -g cfgldap -o cfgLdapPort 636 | Out-File $Logtextfile -Append
racadm.exe -r $hostname -u $username -p $password config -g cfgldap -o cfgLdapBaseDN """SecretDN""" | Out-File $Logtextfile -Append
racadm.exe -r $hostname -u $username -p $password config -g cfgldap -o cfgLdapBindDN $binddn | Out-File $Logtextfile -Append
racadm.exe -r $hostname -u $username -p $password config -g cfgldap -o cfgLdapBindpassword $bindpw | Out-File $Logtextfile -Append
racadm.exe -r $hostname -u $username -p $password config -g cfgldap -o cfgLdapCertValidationenable 0 | Out-File $Logtextfile -Append
racadm.exe -r $hostname -u $username -p $password config -g cfgldap -o cfgLdapGroupAttribute """member""" | Out-File $Logtextfile -Append
racadm.exe -r $hostname -u $username -p $password config -g cfgldap -o cfgLdapUserAttribute """samaccountname""" | Out-File $Logtextfile -Append
racadm.exe -r $hostname -u $username -p $password config -g cfgldaprolegroup -i 1 -ocfgLdapRoleGroupDN $admingrpdn | Out-File $Logtextfile -Append
racadm.exe -r $hostname -u $username -p $password config -g cfgldaprolegroup -i 1 -ocfgLdapRoleGroupPrivilege 0x1ff | Out-File $Logtextfile -Append
racadm.exe -r $hostname -u $username -p $password config -g cfgLanNetworking -o cfgDNSServer1 $dns1 | Out-File $Logtextfile -Append
racadm.exe -r $hostname -u $username -p $password config -g cfgLanNetworking -o cfgDNSServer2 $dns2 | Out-File $Logtextfile -Append
#racadm.exe -r $hostname -u $username -p $password config -g cfgUserAdmin -i 2 -o cfgUserAdminUserName dellomesvc | Out-File $Logtextfile -Append
racadm.exe -r $hostname -u $username -p $password config -g cfgUserAdmin -i 3 -o cfgUserAdminUserName dellomesvc | Out-File $Logtextfile -Append
racadm.exe -r $hostname -u $username -p $password config -g cfgUserAdmin -i 3 -o cfgUserAdminPassword "SecretPW" | Out-File $Logtextfile -Append
racadm.exe -r $hostname -u $username -p $password config -g cfgUserAdmin -i 3 -o cfgUserAdminPrivilege 0x1ff | Out-File $Logtextfile -Append
racadm.exe -r $hostname -u $username -p $password config -g cfgUserAdmin -i 3 -o cfgUserAdminEnable 0 | Out-File $Logtextfile -Append
racadm.exe -r $hostname -u $username -p $password ping 8.8.8.8 | Out-File $Logtextfile -Append
#DRAC will reset after these:
racadm.exe -r $hostname -u $username -p $password sslkeyupload -t 1 -f c:\scripts\idracs\star.key | Out-File $Logtextfile -Append
racadm.exe -r $hostname -u $username -p $password sslcertupload -t 1 -f c:\scripts\idracs\star.pem | Out-File $Logtextfile -Append
}
catch{
"unable to connect to $($drac.hostname)" | Out-File $Logtextfile -Append
$_.Exception.Message | Out-File $Logtextfile -Append
}

}

My guess is that part of the onboarding process checks that the user has admin by checking in the local users table only, which is accessible via wsman, where as it should probably check the local users and I’d AD/LDAP is enabled check the resulting set of privileges for the user.