iDRAC10 Active Directory Smart Card Authentication Failure Certificate Attribute Matching

Summary: iDRAC10 Active Directory (AD) Smart Card Authentication enforces strict matching rules between certificate attributes and AD User object attributes. These requirements can cause authentication failures in environments where certificate naming conventions differ from Active Directory object attributes. This behavior differs from iDRAC9 and may impact deployments using standard enterprise certificate templates. A design change is planned in iDRAC10 firmware version 1.30.60.50 to align behavior with iDRAC9 and improve compatibility. ...

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

User is unable to login to iDRAC10 with AD Smart Card. The same configuration may be working on iDRAC9 systems.

AD SmartCard authentication error RAC0782

The iiam.log from a debug supportassist collection shows the following error. 

time="2026-04-20T11:35:39.473+02:00" level=error msg="incorrect COMMON_NAME for cacpiv certificate" correlationID=3a6854f2-d2bb-4352-81c2-70e9d8e8ec5c file=cacpivClient.go line=344 prog="ciam service"

Cause

The iDRAC10 implementation prior to Firmware 1.30.60.50 enforces strict attribute matching rules that may not align with enterprise certificate configurations.

Authentication requires:

  1. User Certificate Subject CN must exactly match the AD user CN
  2. Certificate UPN prefix must match the AD user CN

 

Example 1 - Certificate CN to AD Object CN mismatch

AD User Object 
cn: admin-user
userPrincipalName: admin-user@example.com

Certificate 
Subject: CN=admin-user@example.com
SAN: UPN=admin-user@example.com

 

Example 2 - SAN UPN Prefix to AD Object CN mismatch

AD User Object
cn: admin user
userPrincipalName: admin_user@example.com

Certificate
Subject: CN=admin user
SAN: UPN=admin_user@example.com

Resolution

The iDRAC10 Firmware Version 1.30.60.50 has redesigned the authentication logic to align with iDRAC9 behavior. The new behavior will:

  1. Extract the UPN from the certificate SAN extensions (first UPN entry)
  2. Use UPN to query Active Directory user.
  3. Validate authentication by comparing it against the user's userCertificate attribute.

Affected Products

iDRAC10 - 1.20.xx Series, iDRAC10 - 1.30.xx Series
Article Properties
Article Number: 000474629
Article Type: Solution
Last Modified: 16 Jun 2026
Version:  1
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.