Idrac 9 and openldap

Can you confirm whether iDRAC Privilege is set for group "Group DN cn=test-servers,ou=Groups,dc=domain,dc=com"

Can you perform ldapsearch on domain and check what attribute is mentioned to add users to group. E.g. in below example uniqueMember attribute is used to capture user information on the group. The same attribute  need to be configured for "Attribute of Group Membership" field in iDRAC

ldapsearch -x -b 'dc=domain,dc=com' '(cn=ldapgroup)'

dn: cn=ldapgroup,ou=test,dc=domain,dc=com
objectClass: groupOfUniqueNames
cn: ldapgroup
uniqueMember: cn=ldapuser,ou=test,dc=domain,dc=com

instead of posixGroup can you create a group with objectClass of groupOfUniqueNames and add members DN with uniqueMember (As shown below) and try to configure this group in iDRAC

dn: cn=ldapgroup,ou=test,dc=domain,dc=com
objectClass: groupOfUniqueNames
cn: ldapgroup
uniqueMember: cn=ldapuser,ou=test,dc=domain,dc=com

I can successfully configure an iDRAC 9 with OpenLDAP. The "Test" function works fine when I enter an authorized user and password:

17:03:31  Initiating Directory Services Settings Diagnostics:
17:03:31  trying LDAP server ldap.x.x.x:636
17:03:31  Server Address ldap.x.x.x resolved to y.y.y.y
17:03:31  connect to y.y.y.y:636 passed
17:03:31  Connecting to ldaps://ldap.x.x.x.x]:636...
17:03:31  Test user authenticated user= host=ldap.x.x.x.x
17:03:31  Search command:
   Bind DN: [Anonymous]
   Scope: subtree
   Base DN: dc=example,dc=com
   Search filter: (&(uid=user)(objectClass=posixAccount))
   Attribute list:
   objectClass
   memberOf
   dn
   uid
   objectCategory
   defaultNamingContext
   namingContexts
   ldapServiceName
   supportedControl
   supportedExtension
17:03:31  Connecting to ldaps://[ldap.x.x.x.x]:636...
17:03:31  Test user authenticated user=uid=user,ou=admins,ou=People,dc=example,dc=com host=ldap.x.x.x.x
17:03:31  Connecting to ldaps://[ldap.x.x.x.x]:636...
17:03:31  Test user authenticated user=uid=user,ou=admins,ou=People,dc=example,dc=com host=ldap.x.x.x.x
17:03:31  Search command:
   Bind DN: uid=user,ou=admins,ou=People,dc=example,dc=com
   Scope: base
   Base DN: cn=group,ou=Group,dc=example,dc=com
   Search filter: (memberUid=user)
   Attribute list:
   objectClass
   memberOf
   dn
   uid
   objectCategory
   defaultNamingContext
   namingContexts
   ldapServiceName
   supportedControl
   supportedExtension
17:03:31  Privileges gained from role group 'cn=group,ou=Group,dc=example,dc=com':
   Login
   Config iDRAC
   Clear Logs
   Server Control
   Virtual Console
   Virtual Media
   Test Alerts
   Diagnostic Command
17:03:31  Test user user authorized

17:03:31  Cumulative privileges gained:
   Login
   Config iDRAC
   Clear Logs
   Server Control
   Virtual Console
   Virtual Media
   Test Alerts
   Diagnostic Command

However, when I actually try and log in as that user, I get the following error:

I cannot figure out why this is happening. Any help?

Hello,

What firmware are you running on the iDRAC? In theory, it should "just work," but I've run into a couple of cases where it didn't and running a racadm resetcfg resolved the issue. One thing to note, that would clear your configuration on the iDRAC, too. If trying that command is something you want to consider, make sure you can reconfigure the iDRAC.

Hi thanks for the suggestion. Doing a full reset on the iDRAC and reconfiguring it solved the problem. Weird. In case you need to know, the RAC details are:

Thanks!