SIN RESOLVER
IDM iDRAC9 integration
Hello,
I'm trying to connect iDRAC9 and IDM(LDAP), all test I tried fail.
The last error message is: ERROR: The user is not a member of any role group that allows access to iDRAC.
From OS ldapsearch command the system shown that user is a member of role that allow access to iDRAC
I tested with several changes, trying to have luck, but nothing fix my problem.
TEST FROM iDRAC9
Test Results
Test Description Result
--------------------------------------------------------------------------------
Ping Directory Server Not Run
Directory Server DNS Name Passed
LDAP connection to the Directory Server Passed
Certificate Validation Disabled
User DN existence Passed
User Authentication Passed
User Authorization Failed
Test Results
--------------------------------------------------------------------------------
Test User Name hserna
Test User Password ****
Test Log
--------------------------------------------------------------------------------
11:10:20 Initiating Directory Services Settings Diagnostics:
11:10:20 trying LDAP server 172.22.194.81:636
11:10:20 Server Address 172.22.194.81 resolved to 172.22.194.81
11:10:20 connect to 172.22.194.81:636 passed
11:10:20 Connecting to ldaps://[172.22.194.81]:636...
11:10:20 Test user authenticated user=uid=idrac,cn=users,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es host=172.22.194.81
11:10:20 Search command:
Bind DN: uid=idrac,cn=users,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es
Scope: subtree
Base DN: cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es
Search filter: (uid=hserna)
Attribute list:
objectClass
memberOf
dn
uid
objectCategory
defaultNamingContext
namingContexts
ldapServiceName
supportedControl
supportedExtension
11:10:20 Connecting to ldaps://[172.22.194.81]:636...
11:10:20 Test user authenticated user=uid=hserna,cn=users,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es host=172.22.194.81
11:10:20 Connecting to ldaps://[172.22.194.81]:636...
11:10:20 Test user authenticated user=uid=hserna,cn=users,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es host=172.22.194.81
11:10:20 Search command:
Bind DN: uid=hserna,cn=users,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es
Scope: base
Base DN: cn=admon_idrac,cn=groups,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es
Search filter: (memberOf=uid=hserna,cn=users,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es)
Attribute list:
objectClass
memberOf
dn
uid
objectCategory
defaultNamingContext
namingContexts
ldapServiceName
supportedControl
supportedExtension
11:10:20 ERROR: The user is not a member of any role group that allows access to iDRAC.
TEST FROM OS COMMAND LINE
ldapsearch -H ldap://172.22.194.81 -b "uid=hserna,cn=users,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es" -D "uid=idrac,cn=users,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es" -W
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# hserna, users, accounts, corona.dev.atm.indra.es
dn: uid=hserna,cn=users,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es
memberOf: cn=ipausers,cn=groups,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es
memberOf: cn=admon_rhv,cn=groups,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es
memberOf: cn=admon_idrac,cn=groups,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es
mail: hserna@indra.es
krbPasswordExpiration: 20211020075254Z
krbLastPwdChange: 20210722075254Z
displayName: Hugo Serna
uid: hserna
krbCanonicalName: hserna@CORONA.DEV.ATM.INDRA.ES
objectClass: top
objectClass: person
objectClass: organizationalperson
objectClass: inetorgperson
objectClass: inetuser
objectClass: posixaccount
objectClass: krbprincipalaux
objectClass: krbticketpolicyaux
objectClass: ipaobject
objectClass: ipasshuser
objectClass: ipaSshGroupOfPubKeys
objectClass: mepOriginEntry
loginShell: /bin/sh
initials: HS
gecos: Hugo Serna
sn: Serna
homeDirectory: /home/hserna
krbPrincipalName: hserna@CORONA.DEV.ATM.INDRA.ES
givenName: Hugo
cn: Hugo Serna
ipaUniqueID: 60fae560-dfe1-11eb-b8ec-566f594d000f
uidNumber: 1626200003
gidNumber: 1626200003
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
Thanks for your assistance and your time
Test Results
Test Description Result
--------------------------------------------------------------------------------
Ping Directory Server Not Run
Directory Server DNS Name Passed
LDAP connection to the Directory Server Passed
Certificate Validation Disabled
User DN existence Passed
User Authentication Passed
User Authorization Failed
Test Results
--------------------------------------------------------------------------------
Test User Name hserna
Test User Password ****
Test Log
--------------------------------------------------------------------------------
11:10:20 Initiating Directory Services Settings Diagnostics:
11:10:20 trying LDAP server 172.22.194.81:636
11:10:20 Server Address 172.22.194.81 resolved to 172.22.194.81
11:10:20 connect to 172.22.194.81:636 passed
11:10:20 Connecting to ldaps://[172.22.194.81]:636...
11:10:20 Test user authenticated user=uid=idrac,cn=users,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es host=172.22.194.81
11:10:20 Search command:
Bind DN: uid=idrac,cn=users,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es
Scope: subtree
Base DN: cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es
Search filter: (uid=hserna)
Attribute list:
objectClass
memberOf
dn
uid
objectCategory
defaultNamingContext
namingContexts
ldapServiceName
supportedControl
supportedExtension
11:10:20 Connecting to ldaps://[172.22.194.81]:636...
11:10:20 Test user authenticated user=uid=hserna,cn=users,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es host=172.22.194.81
11:10:20 Connecting to ldaps://[172.22.194.81]:636...
11:10:20 Test user authenticated user=uid=hserna,cn=users,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es host=172.22.194.81
11:10:20 Search command:
Bind DN: uid=hserna,cn=users,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es
Scope: base
Base DN: cn=admon_idrac,cn=groups,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es
Search filter: (memberOf=uid=hserna,cn=users,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es)
Attribute list:
objectClass
memberOf
dn
uid
objectCategory
defaultNamingContext
namingContexts
ldapServiceName
supportedControl
supportedExtension
11:10:20 ERROR: The user is not a member of any role group that allows access to iDRAC.
TEST FROM OS COMMAND LINE
ldapsearch -H ldap://172.22.194.81 -b "uid=hserna,cn=users,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es" -D "uid=idrac,cn=users,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es" -W
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# hserna, users, accounts, corona.dev.atm.indra.es
dn: uid=hserna,cn=users,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es
memberOf: cn=ipausers,cn=groups,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es
memberOf: cn=admon_rhv,cn=groups,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es
memberOf: cn=admon_idrac,cn=groups,cn=accounts,dc=corona,dc=dev,dc=atm,dc=indra,dc=es
mail: hserna@indra.es
krbPasswordExpiration: 20211020075254Z
krbLastPwdChange: 20210722075254Z
displayName: Hugo Serna
uid: hserna
krbCanonicalName: hserna@CORONA.DEV.ATM.INDRA.ES
objectClass: top
objectClass: person
objectClass: organizationalperson
objectClass: inetorgperson
objectClass: inetuser
objectClass: posixaccount
objectClass: krbprincipalaux
objectClass: krbticketpolicyaux
objectClass: ipaobject
objectClass: ipasshuser
objectClass: ipaSshGroupOfPubKeys
objectClass: mepOriginEntry
loginShell: /bin/sh
initials: HS
gecos: Hugo Serna
sn: Serna
homeDirectory: /home/hserna
krbPrincipalName: hserna@CORONA.DEV.ATM.INDRA.ES
givenName: Hugo
cn: Hugo Serna
ipaUniqueID: 60fae560-dfe1-11eb-b8ec-566f594d000f
uidNumber: 1626200003
gidNumber: 1626200003
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
Thanks for your assistance and your time
