Still no joy. Although I don't profess to be a schema changing expert.

Compat plugin was already enabled. Ipa version is 3.0.0-37.el6

So I modified /etc/dirsrv/slapd-MYDOMAIN-COM/dse.ldif...

dn: cn=users,cn=Schema Compatibility,cn=plugins,cn=config
I set the following...
schema-compat-entry-attribute: cn=%{cn}
schema-compat-entry-rdn: cn=%{cn}

Left the rest as default.
When I ldapsearch against the compat tree, I see it working the way I want 
(i.e. dn starts with cn instead of uid).
ldapsearch -x -b "cn=compat,dc=mydomain,dc=com" "cn=Les Stott"
# Les Stott, users, compat,
dn: cn=Les Stott,cn=users,cn=compat,dc=mydomain,dc=com

ILO Search context was set as: cn=users,cn=compat,dc=mydomain,dc=com

So it looks good, but when I test from ILO it fails still.
Les Stott
...It cant bind

[14/Jan/2014:21:52:31 -0500] conn=47 op=0 BIND dn="CN=Les 
Stott,cn=users,cn=compat,dc=mydomain,dc=com" method=128 version=2
[14/Jan/2014:21:52:31 -0500] conn=47 op=0 RESULT err=49 tag=97 nentries=0 
[14/Jan/2014:21:52:31 -0500] conn=47 op=1 UNBIND
[14/Jan/2014:21:52:31 -0500] conn=48 op=0 BIND dn="Les Stott" authzid="(null)", 
invalid bind dn
[14/Jan/2014:21:52:31 -0500] conn=48 op=0 RESULT err=34 tag=97 nentries=0 
[14/Jan/2014:21:52:31 -0500] conn=48 op=1 BIND dn="CN=Les 
Stott,cn=users,cn=compat,dc=mydomain,dc=com" method=128 version=2
[14/Jan/2014:21:52:31 -0500] conn=48 op=1 RESULT err=49 tag=97 nentries=0 
[14/Jan/2014:21:52:31 -0500] conn=48 op=2 UNBIND
[14/Jan/2014:21:52:31 -0500] conn=50 op=0 BIND dn="CN=Les 
Stott,cn=users,cn=compat,dc=mydomain,dc=com" method=128 version=2
[14/Jan/2014:21:52:31 -0500] conn=50 op=0 RESULT err=49 tag=97 nentries=0 
[14/Jan/2014:21:52:31 -0500] conn=50 op=1 UNBIND

Is it just not supporting to bind against the compat tree in or am I 
doing something wrong?



From: Dmitri Pal []
Sent: Wednesday, 15 January 2014 8:36 AM
To: Les Stott
Subject: Re: [Freeipa-users] HP ILO Authentication via LDAP (or even kerberos)

On 01/14/2014 04:01 PM, Les Stott wrote:
I had seen that thread...

all it says is...

On 11/05/2013 02:51 PM, KodaK wrote:
If I use the whole connection string:


I can authenticate.
Which i can do successfully, but its not great to have to tell everyone your 
username for ilo is uid=blah,cn=users,cn=accounts..etc

There is also mentioned in that thread...

"The HP iLO documentation doesn't list using the uid value as a supported form 
of specifying the login.  You can use the CN value or the full DN.  They say 
that "DOMAIN\user" and "user domain" forms are also accepted, but that likely 
only works against Active Directory."

CN doesn't work. full DN does.

I don't see any reference to a workaround via compat plugin in that thread.

Have you got any more info on the compat workaround?

You can create a compat tree using compat plugin of IPA. It is used for NIS, 
support of Solaris clients and for AD trusts in latest IPA.
As a simple test you can enable the plugin:

ipa-compat-manage enable

That will expose the tree on the cn=compat hive but using 2307 schema.

You can then change the configuration of the plugin to use uid value instead of 
CN in this view, i.e expose CN as uid.

Then you can point your HP ILO to that tree.

AFAIU in the past it was not possible because we did not allow bind against 
compat tree but now we allow it so it should work with the latest IPA 3.3.x 

Details on how to change compat configuration can be found in the plugin 
configuration here:

I am not sure that would 100% work but IMO worth a shot.


[<>] on 
behalf of Dmitri Pal [<>]
Sent: Wednesday, January 15, 2014 3:30 AM
Subject: Re: [Freeipa-users] HP ILO Authentication via LDAP (or even kerberos)
On 01/13/2014 10:44 PM, Les Stott wrote:
Been banging my head against the wall on this one for a few days, trying to get 
a workable configuration for HP ILO to authenticate via FreeIPA.

I have a standard rhel6 environment (64 bit 6.4) with freeipa server 

The following works for me......

HP ILO4 Firmware 1.22
Default Directory Schema
Directory Server Address: fqdn_of_myfreeipaserver
Directory Server LDAP Port: 636
Directory User Context 1: cn=users,cn=accounts,dc=mydomain,dc=com
Directory Groups: cn=sys_admins,cn=groups,cn=accounts,dc=mydomain,dc=com

....but only if I login with my full dn....

Username: uid=less,cn=users,cn=accounts,dc=mydomain,dc=com

The test settings button in the ILO works only with the full dn.

It doesn't work if I use the uid (less), or the cn (Les Stott).

I can then login to ILO with ....
Username: uid=less,cn=users,cn=accounts,dc=mydomain,dc=com

If I try to login with the cn, Les Stott I see an error in the logs...

[13/Jan/2014:22:36:29 -0500] ipalockout_postop - [file ipa_lockout.c, line 
473]: Failed to retrieve entry "CN=Les 
Stott,cn=users,cn=accounts,dc=mydomain,dc=com": 32

I've read a lot of things about getting this to work. Apparently there are 
issues with HP ILO requiring the username in cn format but its in uid format in 
freeipa. You should also be able to login with your cn, but that doesn't work.

I had a crack at trying Kerberos authentication as well, but it doesn't work 
and errors with "Additional Pre-authentication required".

Has anyone successfully been able to get HP ILO to work with FreeIPA such that 
you can login with just the username (i.e. "less") or the CN (i.e. "Les Stott")?

Are schema changes required?

Alternatively has anyone been able to get HP ILO to work with Kerberos auth to 

Any help would be greatly appreciated.




Freeipa-users mailing list<>
Have you searched freeipa-users archives? The issue sounds familiar and I 
vaguely recalled there was a workaround.
This is the thread

I think you can use compat plugin on the IPA to expose the tree in the way HP 
ILO expects.


Thank you,

Dmitri Pal

Sr. Engineering Manager for IdM portfolio

Red Hat Inc.


Looking to carve out IT costs?<>


Thank you,

Dmitri Pal

Sr. Engineering Manager for IdM portfolio

Red Hat Inc.


Looking to carve out IT costs?<>

Freeipa-users mailing list

Reply via email to