Prerequisites For Active Directory Sso And Smart Card Authentication - Dell IDRAC6 User Manual

Prerequisites for Active Directory SSO and Smart
Card Authentication
The pre-requisites for both Active Directory SSO and Smart Card
authentication are:
• Configure the iDRAC6 for Active Directory login. For more information,
see "Using the iDRAC6 Directory Service" on page 143.
• Register the iDRAC6 as a computer in the Active Directory root domain.
To do this:
Click Remote Access Network/Security tab Network subtab.
a
Provide a valid Preferred/Alternate DNS Server IP address. This value
b
is the IP address of the DNS that is part of the root domain,
which authenticates the Active Directory accounts of the users.
Select Register iDRAC on DNS.
c
Provide a valid DNS Domain Name.
d
See the iDRAC6 Online Help for more information.
• To support the two new types of authentication mechanisms, iDRAC6
supports the configuration to enable itself as a kerberized service on a
Windows Kerberos network. The Kerberos configuration on iDRAC6
involves the same steps as configuring a non–Windows Server Kerberos
service as a security principal in Windows Server Active Directory.
The Microsoft tool ktpass (supplied by Microsoft as part of the server
installation CD/DVD) is used to create the Service Principal Name (SPN)
bindings to a user account and export the trust information into a
MIT–style Kerberos keytab file, which enables a trust relation between an
external user or system and the Key Distribution Centre (KDC). The
keytab file contains a cryptographic key, which is used to encrypt the
information between the server and the KDC. The ktpass tool allows
UNIX–based services that support Kerberos authentication to use the
interoperability features provided by a Windows Server Kerberos KDC
service.
The keytab obtained from the ktpass utility is made available to the
iDRAC6 as a file upload and is enabled to be a kerberized service on the
network.
188
Configuring iDRAC6 for Single Sign-On or Smart Card Login