Skip to content
Grant Curell's Projects

idrac with LDAP

Version Info

Section titled “Version Info”
Fedora release 33 (Thirty Three)
NAME=Fedora
VERSION="33 (Workstation Edition)"
ID=fedora
VERSION_ID=33
VERSION_CODENAME=""
PLATFORM_ID="platform:f33"
PRETTY_NAME="Fedora 33 (Workstation Edition)"
ANSI_COLOR="0;38;2;60;110;180"
LOGO=fedora-logo-icon
CPE_NAME="cpe:/o:fedoraproject:fedora:33"
HOME_URL="https://fedoraproject.org/"
DOCUMENTATION_URL="https://docs.fedoraproject.org/en-US/fedora/f33/system-administrators-guide/"
SUPPORT_URL="https://fedoraproject.org/wiki/Communicating_and_getting_help"
BUG_REPORT_URL="https://bugzilla.redhat.com/"
REDHAT_BUGZILLA_PRODUCT="Fedora"
REDHAT_BUGZILLA_PRODUCT_VERSION=33
REDHAT_SUPPORT_PRODUCT="Fedora"
REDHAT_SUPPORT_PRODUCT_VERSION=33
PRIVACY_POLICY_URL="https://fedoraproject.org/wiki/Legal:PrivacyPolicy"
VARIANT="Workstation Edition"
VARIANT_ID=workstation
Fedora release 33 (Thirty Three)
Fedora release 33 (Thirty Three)

Setup FreeIPA

Section titled “Setup FreeIPA”
  1. Install Fedora
  2. Change hostname 1.hostname freeipa.grant.lan && hostnamectl set-hostname freeipa.grant.lan 2.Change in /etc/hostname 3.Configure DNS to return for this hostname. Double check with dig +short freeipa.grant.lan A && dig +short -x 192.168.1.95
  3. Follow RHEL’s instructions 1.I used Chapter 5 for primary installation 2.Make sure you add the requested DNS entries at the end
  4. Run firewall-cmd --permanent --add-port={80/tcp,443/tcp,389/tcp,636/tcp,88/tcp,464/tcp,88/udp,464/udp,123/udp} && firewall-cmd --reload to allow the appropriate ports
  5. Run kinit admin - this allows you to use the command line tools otherwise they’ll complain about kerberos.
  6. Log into FreeIPA server at https://<your_hostname>. In my case, Windows popped up a username and password prompt. That prompt didn’t work - I had to exit it and then log into the webGUI.
    1. Add a user other than administrator.
  7. Create a new user and new group in the UI and assign the new user to the new group.
    1. WARNING I had to actually add the user to a new group. The group could not be admins or it wouldn’t work. When I dumped ldapsearch -x -H ldap://localhost -b "cn=admins,cn=groups,cn=accounts,dc=grant,dc=lan" -D "uid=grant,cn=users,cn=accounts,dc=grant,dc=lan" -w PASSWORD | less my user actually didn’t show in the admins group. When I created my own group and checked it worked fine.

Helpful Commands

Section titled “Helpful Commands”

To start the IPA service use ipactl start|stop|restart. You can check the status with ipactl status.

Test LDAP credentials: ldapwhoami -vvv -h 192.168.1.95 -p 389 -D 'uid=grant,cn=users,cn=accounts,dc=grant,dc=lan' -x -w <PASSWORD>

Dump the structure of FreeIPA: ldapsearch -x -H ldap://localhost -b "cn=accounts,dc=grant,dc=lan" -D "uid=grant,cn=users,cn=accounts,dc=grant,dc=lan" -w <YOUR_USERS_PASSWORD> | less You can also use this to check to see if a user is a member of a group by changing the base path to search (-b). Change it to what you think the FQDN of the group is. The user in question should show up.

Setup idrac

Section titled “Setup idrac”

Go into the idrac and click the directories prompt.

  1. I ran without certs

  2. I used the following values:

     Generic LDAP: Enabled
     Use Distinguished Name to Search Group Membership: Enabled
     LDAP Server Address: freeipa.grant.lan
     LDAP Server Port: 636
     Bind DN: uid=grant,cn=users,cn=accounts,dc=grant,dc=lan
     Bind Password: Your password
     Base DN to Search: cn=accounts,dc=grant,dc=lan
     Attribute of User Login: uid
     Attribute of Group Membership: member

  3. Click next and for Group DN I used cn=grantgroup,cn=groups,cn=accounts,dc=grant,dc=lan where grantgroup was the name of the user group I added

  4. I ran the test with the following results: 

     # Test Results
     Ping Directory Server  Not Run
     Directory Server DNS Name  Passed
     LDAP connection to the Directory Server  Passed
     User DN existence  Passed
     Certificate Validation  Disabled
     User Authentication  Passed
     User Authorization  Passed
    

     # Test Log
     16:49:14  Initiating Directory Services Settings Diagnostics:
     16:49:14  trying LDAP server freeipa.grant.lan:636
     16:49:14  Server Address freeipa.grant.lan resolved to 192.168.1.95
     16:49:14  connect to 192.168.1.95:636 passed
     16:49:14  Connecting to ldaps://[freeipa.grant.lan]:636...
     16:49:14  Test user authenticated user=uid=grant,cn=users,cn=accounts,dc=grant,dc=lan host=freeipa.grant.lan
     16:49:14  Search command:
       Bind DN: uid=grant,cn=users,cn=accounts,dc=grant,dc=lan
       Scope: subtree
       Base DN: cn=accounts,dc=grant,dc=lan
       Search filter: (uid=grant)
       Attribute list:
       objectClass
       memberOf
       dn
       uid
       objectCategory
       defaultNamingContext
       namingContexts
       ldapServiceName
       supportedControl
       supportedExtension
     16:49:14  Connecting to ldaps://[freeipa.grant.lan]:636...
     16:49:14  Test user authenticated user=uid=grant,cn=users,cn=accounts,dc=grant,dc=lan host=freeipa.grant.lan
     16:49:15  Connecting to ldaps://[freeipa.grant.lan]:636...
     16:49:15  Test user authenticated user=uid=grant,cn=users,cn=accounts,dc=grant,dc=lan host=freeipa.grant.lan
     16:49:15  Search command:
       Bind DN: uid=grant,cn=users,cn=accounts,dc=grant,dc=lan
       Scope: base
       Base DN: cn=grantgroup,cn=groups,cn=accounts,dc=grant,dc=lan
       Search filter: (member=uid=grant,cn=users,cn=accounts,dc=grant,dc=lan)
       Attribute list:
       objectClass
       memberOf
       dn
       uid
       objectCategory
       defaultNamingContext
       namingContexts
       ldapServiceName
       supportedControl
       supportedExtension
     16:49:15  Privileges gained from role group 'cn=grantgroup,cn=groups,cn=accounts,dc=grant,dc=lan':
       Login
       Config iDRAC
       Config User
       Clear Logs
       Server Control
       Virtual Console
       Virtual Media
       Test Alerts
       Diagnostic Command
     16:49:15  Test user grant authorized
    

     16:49:15  Cumulative privileges gained:
       Login
       Config iDRAC
       Config User
       Clear Logs
       Server Control
       Virtual Console
       Virtual Media
       Test Alerts
       Diagnostic Command

YouTube Video of Login

Section titled “YouTube Video of Login”

See: https://youtu.be/-fHlHhF9vH4