Back to Contents Page

Using the DRAC 5 With Microsoft Active Directory

Dell™ Remote Access Controller 5 Firmware Version 1.0 User's Guide

  Active Directory Schema Extensions

  Overview of the RAC Schema Extensions

  Active Directory Object Overview

  Configuring Active Directory to Access Your DRAC 5

  Extending the Active Directory Schema

  Installing the Dell Extension to the Active Directory Users and Computers Snap-In

  Adding DRAC 5 Users and Privileges to Active Directory

  Enabling SSL on a Domain Controller

  Configuring the DRAC 5

  Using Active Directory to Log In To the DRAC 5

  Frequently Asked Questions

A directory service maintains a common database of all information needed for controlling users, computers, printers, etc. on a network. If your company uses the Microsoft® Active Directory® service software, you can configure the software to provide access to the DRAC 5, allowing you to add and control DRAC 5 user privileges to your existing users in your Active Directory software.

NOTE: Using Active Directory to recognize DRAC 5 users is supported on the Microsoft Windows 2000 and Windows Server 2003 operating systems.

Active Directory Schema Extensions

The Active Directory data is a distributed database of Attributes and Classes. The Active Directory schema includes the rules that determine the type of data that can be added or included in the database. The user class is one example of a Class that is stored in the database. Some example user class attributes can include the user's first name, last name, phone number, and so on. Companies can extend the Active Directory database by adding their own unique Attributes and Classes to solve environment-specific needs. Dell has extended the schema to include the necessary changes to support remote management Authentication and Authorization.

Each Attribute or Class that is added to an existing Active Directory Schema must be defined with a unique ID. To maintain unique IDs across the industry, Microsoft maintains a database of Active Directory Object Identifiers (OIDs) so that when companies add extensions to the schema, they can be guaranteed to be unique and not to conflict with each other. To extend the schema in Microsoft's Active Directory, Dell received unique OIDs, unique name extensions, and uniquely linked attribute IDs for our attributes and classes that are added into the directory service.

Dell extension is: dell

Dell base OID is: 1.2.840.113556.1.8000.1280

RAC LinkID range is: 12070 to 12079

The Active Directory OID database maintained by Microsoft can be viewed at http://msdn.microsoft.com/certification/ADAcctInfo.asp by entering our extension Dell.

Overview of the RAC Schema Extensions

To provide the greatest flexibility in the multitude of customer environments, Dell provides a group of properties that can be configured by the user depending on the desired results. Dell has extended the schema to include an Association, Device, and Privilege property. The Association property is used to link together the users or groups with a specific set of privileges to one or more RAC devices. This model provides an Administrator maximum flexibility over the different combinations of users, RAC privileges, and RAC devices on the network without adding too much complexity.

Active Directory Object Overview

For each of the physical RACs on the network that you want to integrate with Active Directory for Authentication and Authorization, create at least one Association Object and one RAC Device Object. You can create multiple Association Objects, and each Association Object can be linked to as many users, groups of users, or RAC Device Objects as required. The users and RAC Device Objects can be members of any domain in the enterprise.

However, each Association Object can be linked (or, may link users, groups of users, or RAC Device Objects) to only one Privilege Object. This example allows an Administrator to control each user's privileges on specific RACs.

The RAC Device object is the link to the RAC firmware for querying Active Directory for authentication and authorization. When a RAC is added to the network, the Administrator must configure the RAC and its device object with its Active Directory name so users can perform authentication and authorization with Active Directory. Additionally, the Administrator must add the RAC to at least one Association Object in order for users to authenticate.

Figure 6-1 illustrates that the Association Object provides the connection that is needed for all of the Authentication and Authorization.

Figure 6-1. Typical Setup for Active Directory Objects

NOTE: The RAC privilege object applies to both DRAC 4 and DRAC 5.

You can create as many or as few association objects as required. However, you must create at least one Association Object, and you must have one RAC Device Object for each RAC (DRAC 5) on the network that you want to integrate with Active Directory for Authentication and Authorization with the RAC (DRAC 5).

The Association Object allows for as many or as few users and/or groups as well as RAC Device Objects. However, the Association Object only includes one Privilege Object per Association Object. The Association Object connects the "Users" who have "Privileges" on the RACs (DRAC 5s).

Additionally, you can configure Active Directory objects in a single domain or in multiple domains. For example, you have two DRAC 5 cards (RAC1 and RAC2) and three existing Active Directory users (user1, user2, and user3). You want to give user1 and user2 an administrator privilege to both DRAC 5 cards and give user3 a login privilege to the RAC2 card. Figure 6-2 shows how you set up the Active Directory objects in this scenario.

When adding Universal Groups from separate domains, create an Association Object with Universal Scope. The Default Association objects created by the Dell Schema Extender Utility are Domain Local Groups and will not work with Universal Groups from other domains.

Figure 6-2. Setting Up Active Directory Objects in a Single Domain

To configure the objects for the single domain scenario, perform the following tasks:

1. Create two Association Objects.
   
   
2. Create two RAC Device Objects, RAC1 and RAC2, to represent the two DRAC 5 cards.
   
   
3. Create two Privilege Objects, Priv1 and Priv2, in which Priv1 has all privileges (administrator) and Priv2 has login privileges.
   
   
4. Group user1 and user2 into Group1.
   
   
5. Add Group1 as Members in Association Object 1 (AO1), Priv1 as Privilege Objects in AO1, and RAC1, RAC2 as RAC Devices in AO1.
   
   
6. Add User3 as Members in Association Object 2 (AO2), Priv2 as Privilege Objects in AO2, and RAC2 as RAC Devices in AO2.
   
   

See "Adding DRAC 5 Users and Privileges to Active Directory" for detailed instructions.

Figure 6-3 provides an example of Active Directory objects in multiple domains. In this scenario, you have two DRAC 5 cards (RAC1 and RAC2) and three existing Active Directory users (user1, user2, and user3). User1 is in Domain1, and user2 and user 3 are in Domain2. In this scenario, configure user1 and user 2 with administrator privileges to both DRAC 5 cards and configure user3 with login privileges to the RAC2 card.

Figure 6-3. Setting Up Active Directory Objects in Multiple Domains

To configure the objects for the multiple domain scenario, perform the following tasks:

1. Ensure that the domain forest function is in Native or Windows 2003 mode.
   
   
2. Create two Association Objects, AO1 (of Universal scope) and AO2, in any domain.
   
   

Figure 6-3 shows the objects in Domain2.

3. Create two RAC Device Objects, RAC1 and RAC2, to represent the two DRAC 5 cards.
   
   
4. Create two Privilege Objects, Priv1 and Priv2, in which Priv1 has all privileges (administrator) and Priv2 has login privileges.
   
   
5. Group user1 and user2 into Group1. The group scope of Group1 must be Universal.
   
   
6. Add Group1 as Members in Association Object 1 (AO1), Priv1 as Privilege Objects in AO1, and RAC1, RAC2 as RAC Devices in AO1.
   
   
7. Add User3 as Members in Association Object 2 (AO2), Priv2 as Privilege Objects in AO2, and RAC2 as RAC Devices in AO2.
   
   

Configuring Active Directory to Access Your DRAC 5

Before using Active Directory to access your DRAC 5, configure the Active Directory software and the DRAC 5 by performing the following steps in order:

1. Extend the Active Directory schema (see "Extending the Active Directory Schema").
   
   
2. Extend the Active Directory Users and Computers Snap-in (see "Installing the Dell Extension to the Active Directory Users and Computers Snap-In").
   
   
3. Add DRAC 5 users and their privileges to Active Directory (see "Adding DRAC 5 Users and Privileges to Active Directory").
   
   
4. Enable SSL on each of your domain controllers (see "Enabling SSL on a Domain Controller").
   
   
5. Configure the DRAC 5 Active Directory properties using either the DRAC 5 Web-based interface or the RACADM (see "Configuring the DRAC 5").
   
   

Extending the Active Directory Schema

Extending your Active Directory schema adds a Dell organizational unit, schema classes and attributes, and example privileges and association objects to the Active Directory schema. Before you extend the schema, ensure that you have Schema Admin privileges on the Schema Master Flexible Single Master Operation (FSMO) Role Owner of the domain forest.

You can extend your schema using one of the following methods:

• Dell Schema Extender utility
  
  
• LDIF script file
  
  

If you use the LDIF script file, the Dell organizational unit will not be added to the schema.

The LDIF files and Dell Schema Extender are located on your Dell Systems Management Consoles CD in the following respective directories:

• CD drive:\support\OMActiveDirectory Tools\RAC4-5\LDIF_Files
  
  
• CD drive:\support\OMActiveDirectory Tools\RAC4-5\Schema_Extender
  
  

To use the LDIF files, see the instructions in the readme included in the LDIF_Files directory. To use the Dell Schema Extender to extend the Active Directory Schema, see "Using the Dell Schema Extender."

You can copy and run the Schema Extender or LDIF files from any location.

Using the Dell Schema Extender

NOTICE: The Dell Schema Extender uses the SchemaExtenderOem.ini file. To ensure that the Dell Schema Extender utility functions properly, do not modify the name of this file.

1. In the Welcome screen, click Next.
   
   
2. Read and understand the warning and click Next.
   
   
3. Select Use Current Log In Credentials or enter a user name and password with schema administrator rights.
   
   
4. Click Next to run the Dell Schema Extender.
   
   
5. Click Finish.
   
   

The schema is extended. To verify the schema extension, use the Microsoft Management Console (MMC) and the Active Directory Schema snap-in to verify that the following exist:

• Classes (see Table 6-1 through Table 6-6 )
  
  
• Attributes (Table 6-7)
  
  

See your Microsoft documentation for more information on how to enable and use the Active Directory Schema snap-in the MMC.

Table 6-1. Class Definitions for Classes Added to the Active Directory Schema

Table 6-2. dellRacDevice Class

Table 6-3. dellAssociationObject Class

Table 6-4. dellRAC4Privileges Class

Table 6-5. dellPrivileges Class

Table 6-6. dellProduct Class

Table 6-7. List of Attributes Added to the Active Directory Schema 

Installing the Dell Extension to the Active Directory Users and Computers Snap-In

When you extend the schema in Active Directory, you must also extend the Active Directory Users and Computers snap-in so the administrator can manage RAC (DRAC 5) devices, Users and User Groups, RAC Associations, and RAC Privileges.

When you install your systems management software using the Dell Systems Management Consoles CD, you can extend the snap-in by selecting the Dell Extension to the Active Directory User's and Computers Snap-In option during the installation procedure. See the Dell OpenManage Software Quick Installation Guide for additional instructions about installing systems management software.

For more information about the Active Directory User's and Computers snap-in, see your Microsoft documentation.

Installing the Administrator Pack

You must install the Administrator Pack on each system that is managing the Active Directory DRAC 5 Objects. If you do not install the Administrator Pack, you cannot view the Dell RAC Object in the container.

See "Opening the Active Directory Users and Computers Snap-In" for more information.

Opening the Active Directory Users and Computers Snap-In

To open the Active Directory Users and Computers snap-in, perform the following steps:

1. If you are logged into the domain controller, click Start Admin Tools® Active Directory Users and Computers.
   

If you are not logged into the domain controller, you must have the appropriate Microsoft Administrator Pack installed on your local system. To install this Administrator Pack, click Start® Run, type MMC, and press Enter.

The Microsoft Management Console (MMC) appears.

2. In the Console 1 window, click File (or Console on systems running Windows 2000).
   
   
3. Click Add/Remove Snap-in.
   
   
4. Select the Active Directory Users and Computers snap-in and click Add.
   
   
5. Click Close and click OK.
   
   

Adding DRAC 5 Users and Privileges to Active Directory

Using the Dell-extended Active Directory Users and Computers snap-in, you can add DRAC 5 users and privileges by creating RAC, Association, and Privilege objects. To add each object type, perform the following procedures:

• Create a RAC device Object
  
  
• Create a Privilege Object
  
  
• Create an Association Object
  
  
• Add objects to an Association Object
  
  

Creating a RAC Device Object

1. In the MMC Console Root window, right-click a container.
   
   
2. Select New® Dell RAC Object.
   

The New Object window appears.

3. Type a name for the new object. The name must be identical to the DRAC 5 Name that you will type in step 7 of "Configuring the DRAC 5."
   
   
4. Select RAC Device Object.
   
   
5. Click OK.
   
   

Creating a Privilege Object

NOTE: A Privilege Object must be created in the same domain as the related Association Object.

1. In the Console Root (MMC) window, right-click a container.
   
   
2. Select New® Dell RAC Object.
   

The New Object window appears.

3. Type a name for the new object.
   
   
4. Select Privilege Object.
   
   
5. Click OK.
   
   
6. Right-click the privilege object that you created, and select Properties.
   
   
7. Click the RAC Privileges tab and select the privileges that you want the user to have (for more information, see Table 4-8).
   
   

Creating an Association Object

The Association Object is derived from a Group and must contain a Group Type. The Association Scope specifies the Security Group Type for the Association Object. When you create an Association Object, choose the Association Scope that applies to the type of objects you intend to add.

For example, if you select Universal, the association objects are only available when the Active Directory Domain is functioning in Native Mode or above.

1. In the Console Root (MMC) window, right-click a container.
   
   
2. Select New® Dell RAC Object.
   

This opens the New Object window.

3. Type a name for the new object.
   
   
4. Select Association Object.
   
   
5. Select the scope for the Association Object.
   
   
6. Click OK.
   
   

Adding Objects to an Association Object

Using the Association Object Properties window, you can associate users or user groups, privilege objects, and RAC devices or RAC device groups. If your system is running Windows 2000 mode or higher, use Universal Groups to span domains with your user or RAC objects.

You can add groups of Users and RAC devices. The procedure for creating Dell-related groups and non-Dell-related groups is identical.

Adding Users or User Groups

1. Right-click the Association Object and select Properties.
   
   
2. Select the Users tab and click Add.
   
   
3. Type the user or User Group name and click OK.
   
   

Click the Privilege Object tab to add the privilege object to the association that defines the user's or user group's privileges when authenticating to a RAC device. Only one privilege object can be added to an Association Object.

Adding Privileges

1. Select the Privileges Object tab and click Add.
   
   
2. Type the Privilege Object name and click OK.
   
   

Click the Products tab to add one or more RAC devices to the association. The associated devices specify the RAC devices connected to the network that are available for the defined users or user groups. Multiple RAC devices can be added to an Association Object.

Adding RAC Devices or RAC Device Groups

To add RAC devices or RAC device groups:

1. Select the Products tab and click Add.
   
   
2. Type the RAC device or RAC device group name and click OK.
   
   
3. In the Properties window, click Apply and click OK.
   
   

Enabling SSL on a Domain Controller

If you are using Microsoft Enterprise Root CA to automatically assign all your domain controllers to an SSL certificate, perform the following steps to enable SSL on each domain controller.

1. Install a Microsoft Enterprise Root CA on a Domain Controller.
   
   
   1. Select Start® Control Panel® Add or Remove Programs.
      
      
   2. Select Add/Remove Windows Components.
      
      
   3. In the Windows Components Wizard, select the Certificate Services check box.
      
      
   4. Select Enterprise root CA as CA Type and click Next.
      
      
   5. Enter Common name for this CA, click Next, and click Finish.
      
      
2. Enable SSL on each of your domain controllers by installing the SSL certificate for each controller.
   
   
   1. Click Start® Administrative Tools® Domain Security Policy.
      
      
   2. Expand the Public Key Policies folder, right-click Automatic Certificate Request Settings and click Automatic Certificate Request.
      
      
   3. In the Automatic Certificate Request Setup Wizard, click Next and select Domain Controller.
      
      
   4. Click Next and click Finish.
      
      

Exporting the Domain Controller Root CA Certificate

NOTE: If your system is running Windows 2000, the following steps may vary.

1. Locate the domain controller that is running the Microsoft Enterprise CA service.
   
   
2. Click Start® Run.
   
   
3. In the Run field, type mmc and click OK.
   
   
4. In the Console 1 (MMC) window, click File (or Console on Windows 2000 machines) and select Add/Remove Snap-in.
   
   
5. In the Add/Remove Snap-In window, click Add.
   
   
6. In the Standalone Snap-In window, select Certificates and click Add.
   
   
7. Select Computer account and click Next.
   
   
8. Select Local Computer and click Finish.
   
   
9. Click OK.
   
   
10. In the Console 1 window, expand the Certificates folder, expand the Personal folder, and click the Certificates folder.
    
    
11. Locate and right-click the root CA certificate, select All Tasks, and click Export... .
    
    
12. In the Certificate Export Wizard, click Next, and select No do not export the private key.
    
    
13. Click Next and select Base-64 encoded X.509 (.cer) as the format.
    
    
14. Click Next and save the certificate to a directory on your system.
    
    
15. Upload the certificate you saved in step 14 to the DRAC 5.
    

To upload the certificate using RACADM, see "Configuring the DRAC 5 Active Directory Settings Using RACADM"

To upload the certificate using the Web-based interface, perform the following procedure:

1. Open a supported Web browser window.
   
   
2. Log in to the DRAC 5 Web-based interface.
   
   
3. Expand the System tree and click Remote Access.
   
   
4. Click the Configuration tab, and then click Security.
   
   
5. In the Security Certificate Main Menu page, select Upload Server Certificate and click Apply.
   
   
6. In the Certificate Upload screen, perform one of the following procedures:
   
   
   • Click Browse and select the certificate
     
     
   • In the Value field, type the path to the certificate.
     
     
7. Click Apply.
   
   

Importing the DRAC 5 Firmware SSL Certificate

Use the following procedure to import the DRAC 5 firmware SSL certificate to all domain controller trusted certificate lists.

NOTE: If your system is running Windows 2000, the following steps may vary.

NOTE: If the DRAC 5 firmware SSL certificate is signed by a well-known CA, you are not required to perform the steps in this section.

The DRAC 5 SSL certificate is the identical certificate used for the DRAC 5 Web server. All DRAC 5 controllers are shipped with a default self-signed certificate.

To access the certificate using the DRAC 5 Web-based interface, select Configuration® Active Directory® Download DRAC 5 Server Certificate.

1. On the domain controller, open an MMC Console window and select Certificates® Trusted Root Certification Authorities.
   
   
2. Right-click Certificates, select All Tasks and click Import.
   
   
3. Click Next and browse to the SSL certificate file.
   
   
4. Install the RAC SSL Certificate in each domain controller's Trusted Root Certification Authority.
   

If you have installed your own certificate, ensure that the CA signing your certificate is in the Trusted Root Certification Authority list. If the Authority is not in the list, you must install it on all your Domain Controllers.

5. Click Next and select whether you would like Windows to automatically select the certificate store based on the type of certificate, or browse to a store of your choice.
   
   
6. Click Finish and click OK.
   
   

Configuring the DRAC 5

1. Open a supported Web browser window.
   
   
2. Log in to the DRAC 5 Web-based interface.
   
   
3. Expand the System tree and click Remote Access.
   
   
4. Click the Configuration tab and select Active Directory.
   
   
5. In the Active Directory Main Menu page, select Configure Active Directory and click Next.
   
   
6. Select the Enable Active Directory check box.
   
   
7. Type the DRAC Name. This name must be the same as the common name of the RAC object you created in your Domain Controller (see step 3 of "Creating a RAC Device Object").
   
   
8. Type the Root Domain Name. The Root Domain Name is the fully qualified root domain name for the forest.
   
   
9. Type the DRAC Domain Name (for example, drac5.com). Do not use the NetBIOS name. The DRAC Domain Name is the fully qualified domain name of the sub-domain where the RAC Device Object is located.
   
   
10. Type the Timeout time in seconds.
    
    
11. Click Apply to save the Active Directory settings.
    
    
12. Click Go Back To Active Directory Main Menu.
    
    
13. Upload your domain forest Root CA certificate into the DRAC 5.
    
    
    1. Select the Upload Active Directory CA Certificate checkbox and then click Next.
       
       
    2. In the Certificate Upload page, type the file path of the certificate or browse to the certificate file, and click Apply.
       
       

NOTE: The File Path value displays the relative file path of the certificate you are uploading. You must type the absolute file path, which includes the full path and the complete file name and file extension.

Your domain forest domain controllers' SSL certificates need to have signed this root CA certificate. Have the root CA certificate available on your local system (see "Exporting the Domain Controller Root CA Certificate").

The DRAC 5 Web server automatically restarts after you click Apply.

14. Log out and then log in to the DRAC 5 to complete the DRAC 5 Active Directory feature configuration.
    
    
15. In the System tree, click Remote Access.
    
    
16. Click the Configuration tab and then click Network.
    

The Network Configuration page appears.

17. If Use DHCP (for NIC IP Address) is selected under Network Settings, then select Use DHCP to obtain DNS server address.
    

To manually input a DNS server IP address, deselect Use DHCP to obtain DNS server addresses and type your primary and alternate DNS Server IP addresses.

18. Click Apply Changes.
    

This completes the DRAC 5 Active Directory feature configuration.

Configuring the DRAC 5 Active Directory Settings Using RACADM

Using the following commands to configure the DRAC 5 Active Directory Feature using the RACADM instead of the Web-based interface.

1. Open a command prompt and type the following RACADM commands:
   

racadm config -g cfgActiveDirectory -o cfgADEnable 1

racadm config -g cfgActiveDirectory -o cfgADRacDomain <fully qualified rac domain name>

racadm config -g cfgActiveDirectory -o cfgADRootDomain <fully qualified root domain name>

racadm config -g cfgActiveDirectory -o cfgADRacName <RAC common name>

racadm sslcertupload -t 0x2 -f <ADS root CA certificate>

racadm sslcertdownload -t 0x1 -f <RAC SSL certificate>

2. If DHCP is enabled on the DRAC 5 and you want to use the DNS provided by the DHCP server, type the following:
   

racadm config -g cfgLanNetworking -o cfgDNSServersFromDHCP 1

3. If DHCP is disabled on the DRAC 5 or you want manually to input your DNS IP address, type the following:
   

racadm config -g cfgLanNetworking -o cfgDNSServersFromDHCP 0

racadm config -g cfgLanNetworking -o cfgDNSServer1 <primary DNS IP address>

racadm config -g cfgLanNetworking -o cfgDNSServer2 <secondary DNS IP address>

4. Press Enter to complete the DRAC 5 Active Directory feature configuration.
   
   

Using Active Directory to Log In To the DRAC 5

You can use Active Directory to log in to the DRAC 5 using one of the following methods:

• Web-based interface
  
  
• Remote RACADM
  
  
• Serial or telnet console.
  
  

The login syntax is consistent for all three methods:

<username@domain>

or

<domain>\<username> or <domain>/<username>

where username is an ASCII string of 1–256 bytes.

White space and special characters (such as \, /, or @) cannot be used in the user name or the domain name.

NOTE: You cannot specify NetBIOS domain names, such as Americas, as these names cannot be resolved.

Frequently Asked Questions

Table 6-8 lists frequently asked questions and answers.

Table 6-8. Using the DRAC 5 With Active Directory: Frequently Asked Questions 

Back to Contents Page