Kerberos
Function Description
On the Kerberos page, you can view and configure Kerberos basic settings and user group information.
The iBMC provides an access interface for Kerberos users. Using a Kerberos user account to log in to the iBMC improves system security. You can log in to the iBMC WebUI as a Kerberos user.
Parameter Description
Parameter |
Description |
|---|---|
Kerberos |
Setting of the Kerberos login.
NOTE:
The security policies (password complexity check, password validity period, minimum password age, previous passwords disallowed, and inactive timelimit, and user lockout policy) configured on the authentication server apply to the Kerberos users attempting to log in to the iBMC. |
Basic Settings NOTE:
Parameters with asterisks (*) are mandatory. |
|
Realm |
Kerberos realm. Value: a string of up to 255 characters The value can contain digits, uppercase letter, and special characters (including spaces). |
Kerberos Server Address |
Address of the Kerberos server. If Kerberos is enabled, enter the FQDN (Host name.Domain name) of the Kerberos server, and configure DNS on the iBMC Settings > Network Settings page. Format: an IPv4 or IPv6 address or a domain name The domain name must meet the following requirements:
|
Kerberos Port |
Port number of the Kerberos service. Value range: 1 to 65535 Default value: 88 |
Key Table |
Kerberos key table to be uploaded. The key table must be in the .keytab format. It is left blank by default. NOTE:
|
Current User Password |
Password of the user for logging in to the iBMC. |
Kerberos User Group |
Displays information about all Kerberos user groups. The iBMC supports a maximum of five Kerberos user groups. |
Group Name |
Name of the group to which the Kerberos user belongs. Value range: a string of 255 bytes (64 to 255 characters). The specific length varies with the number of bytes of each character. |
SID |
Security identifier used for Kerberos and user group authorization. For example, S-1-5-21-310440588-250036847-580389505-500. Value range: a string of 255 bytes (64 to 255 characters). The specific length varies with the number of bytes of each character. |
Role |
Role of the Kerberos user group.
|
Login Interfaces |
Interfaces through which the Kerberos group members can log in to the iBMC. Currently, only WebUI login is supported. If Web is selected, users can user a web browser to log in to the iBMC WebUI. |
Group Folder |
Name of the user folder on the Kerberos server. Format: "CN=xxx" or "OU=xxx" When there are multiple levels of nodes, the upper-level node follows the lower-level node with a comma in between. For example, if the user group grouptest is in \testgroups\part1 on the Kerberos server, enter OU=part1,OU=testgroups. NOTE:
For details about the difference between CN and OU, see the description of the Kerberos protocol. In Windows AD, for example, it is:
Value range: a string of 255 bytes (64 to 255 characters). The specific length varies with the number of bytes of each character. |
Login Rules |
Login rules that apply to the Kerberos group. |
: enables Kerberos.
: disables Kerberos.Enabling Kerberos and Configuring the Domain Server
- Set Kerberos to
.
- Set the domain server. For details about the parameters, see Table 3-47.
- Click Save.
Importing a Key Table
- Click
and select the key table to be imported.
- Click Open.
After the key table is uploaded, "File uploaded successfully" is displayed.
- Enter the password of the current user.
The Kerberos user who logs in using SSO does not need to enter the password.
- Click Save.
and select the key table to be imported.
Adding a Kerberos User Group
A maximum of five Kerberos user groups can be added to the iBMC system.
- In the Kerberos User Group area, click Add.
The Add Group page is displayed.
Table 3-48 Adding a Kerberos user groupParameter
Description
Group Name
Name of the Kerberos user group to be added.
Value range: a string of 255 bytes (64 to 255 characters). The specific length varies with the number of bytes of each character.
Group Folder
Name of the user folder on the Kerberos server.
Format: "CN=xxx" or "OU=xxx"
When there are multiple levels of nodes, the upper-level node follows the lower-level node with a comma in between.
For example, if the user group grouptest is in \testgroups\part1 on the Kerberos server, enter OU=part1,OU=testgroups.
NOTE:For details about the difference between CN and OU, see the description of the Kerberos protocol.
In Windows AD, for example, it is:
- CN if Type is Container.
- OU if Type is Organizational Unit.
Value range: a string of 255 bytes (64 to 255 characters). The specific length varies with the number of bytes of each character.
SID
Security identifier used for Kerberos and user group authorization.
Value range: a string of 255 bytes (64 to 255 characters). The specific length varies with the number of bytes of each character.
Role
Operation permission assigned to an Kerberos group on the iBMC.
Value: Administrator, Operator, Common User, and Custom Role 1 to 4
Login Rules
Login rules that apply to the Kerberos group.
Login Interfaces
Interfaces through which the Kerberos group members can log in to the iBMC.
Current User Password
Password of the user for logging in to the iBMC.
NOTE:The Kerberos user who logs in using SSO does not need to enter the password.
- Set the Kerberos user group parameters. For details, see Table 3-48.
- Click Save.
The Kerberos user group is displayed.
Deleting a Kerberos User Group
- In the Kerberos User Group area, locate the Kerberos user group to be deleted and click
.
A Confirm dialog box is displayed, asking you to enter the current user password.
The Kerberos user who logs in using SSO does not need to enter the password.
- Enter the current user password.
- Click OK.
.Modifying a Kerberos User Group
- In the Kerberos User Group area, locate the Kerberos user group to be modified and click
.
- Modify parameters. For details about the parameters, see Table 3-48.
- Click Save.
.