How to set OpenBMC to link with Windows AD Server
Ex: AD Server informaiton
Secret Username: Administrator
Secret Password: abcd!1234
AD Server User Domain Name: gary.qt
AD Server IP: 192.168.20.93
Server URI ldap://192.168.20.93 (AD Server IP)
Bind DN=CN=Administrator,CN=Users,DC=gary,DC=qt (AD Server Admin)
Bind password=abcd!1234 (Administrator password)
Base DN=DC=gary,DC=qt
User ID attribute - (optional)=sAMAccountName (optional)
Group ID attribute - (optional)=primaryGroupID (optional)
Role groups:
Group name=Domain Users
Group privilege=(Test what you need)
After setup link external user service, login with the AD-user who is in Group(Domain Users)
=======================================================================
Get CA Certificate and sign "HTTPS/LDAP - CSR" for OpenBMC
(Setup CA Environment, please refer "More detail" at end of blog.)
----------------------------------------------------------------------------------------------------
Export the "Domain CA" from the Certificate Export Wizard.
Server Manager -> Tools -> "Certificate Authority"
, In "Certificate Authority": Choose "your Doman" -> "Issued Certificates"
-> Choose "Domain Controller" by check column "Cerificate Template"
-> double left click it (or right click "Open") -> change "Details" page
-> select "Copy to File" to open "Certificate Export Wizard"
In "Certificate Export Wizard":
-> Format "Base-64 encoded X.509 (.CER)"
-> Save to file. (ex: "Domain Certificate CA Certificate.CER")
----------------------------------------------------------------------------------
Then load "Domain Certificate CA Certificate.CER" to OpenBMC WebUI CA Certificate
======================================================================================
4. Sign CSR with windows CA:
On OpenBMC WebUI, generate CSR for LDAP(AD) and download it.
Note: During build CSR, CN(Common Name)={openBmc hostname}
-> OpenBMC-CSR-certificate.txt
CMD: certreq -submit -attrib “CertificateTemplate:SubCA” OpenBMC-CSR-certificate.txt
Then select your CA in pop-window.
And Save certificate as “LDAP_certificate_after_sign.cer”.
----------------------------------------------------------------------------------
Then set Server URI ldap://hostname-of-ad-server (AD Server hostname)
load “LDAP_certificate_after_sign.cer” to OpenBMC WebUI CA Certificate
More detail, please refer:
https://virtuallythere.blog/2018/04/24/making-things-a-bit-more-secure-part-1/
https://www.youtube.com/watch?v=h3sxduUt5a8
你好： Openbmc使用Windows AD Server 域賬號登錄，我這邊測試沒問題，但是使用證書卻一直不成功。 已經按您說的步驟，在win Server端創建了CA證書，下載CA證書後在OB測上傳了CA證書，同時OB端生成了ldap的cert req，在win server端生成LDAP_certificate_after_sign.cer後，在OB測上傳了LDAP_certificate_after_sign.cer證書，但目前開啟證書後還是無法登錄。 請問： 1. ob端的cert req設置上有什麽要求麽，可以貼下你那邊的參數配置麽? 2. win server那側不需要相應的證書添加到賬戶中麽。 3. 有沒有其他地方還需要註意或修改的地方呢？ 非常感謝~
OpenBMC這端僅產生CSR，並未產生證書。 你的DNS設定是正確的嗎？確定有照步驟做？你的CA是來自於AD Server的CA檔？
您好： 是的，OpenBMC側沒有產生證書，只是生成CSR，再到AD server那邊通過CA證書簽署CSR生成證書。CA是來自於AD Server的CA檔，也是按您提供的參考文檔https://virtuallythere.blog/2018/04/24/making-things-a-bit-more-secure-part-1創建的CA證書。 當前我的OB端生成的CSR：OpenBMC-CSR-certificate.txt配置如下： Certificate Type：LDAP Country/Region：China State：SC City：CD Company name：Lon Company unit：bmc Common name：test（其中test為AD server端創建的域用戶。這裏該用AD server域用戶名還是AD Server的計算機名？？？因為在同一個局域網環境，當前AD Server並沒有配置域名） Key pair algorithm：RSA Key bit length：2048 AD Server端通過您提供的cmd生成的LDAP_certificate_after_sign.cer： certreq -submit -attrib 「CertificateTemplate:SubCA」 OpenBMC-CSR-certificate.txt 您指的DNS設定是哪個地方的設定呢，CSR的Common name還是AD server的DNS？ AD Server的DNS我用的默認值沒有單獨配置過DNS。當前的bmc和AD Server處於 同一個局域網環境，同時我將AD Server的計算機名：WIN-NQFAGH51FEA，添加到了 BMC的/etc/hosts中。 請問我哪裏操作有不對的地方嗎？ 非常感謝~
謝謝！已經找到原因了，web配置中的AD的URL不能直接使用ip，必須要使用AD Server的計算機全名hostname方式，OB的後臺報了TLS: hostname does not match name in peer certificate，URL改用hostname就ok了
順便再請教博主一個問題，ob的手冊上說ssh也是支持ldap賬戶登錄的， (https://github.com/openbmc/docs/blob/master/architecture/user-management.md#ldap) 但是在實測中我這邊無法使用ldap賬戶ssh登錄bmc，博主您那邊ok嗎？
沒試過