openbmc-tools/openbmctool/README.md

23 Important: After disabling local users, an LDAP user will need to be used for
106 ### Update LDAP client certificate
109 openbmctool <connection options> certificate update client ldap -f <File>
114 ### Update LDAP root certificate
117 openbmctool <connection options> certificate update authority ldap -f <File>
131 ### Delete LDAP client certificate
134 openbmctool <connection options> certificate delete client ldap
137 ### Delete LDAP root certificate
140 openbmctool <connection options> certificate delete authority ldap
143 Deleting the root certificate can cause an LDAP service outage. Please refer to
144 the LDAP documentation before using this command.
146 ## BMC LDAP Configuration
148 In BMC, LDAP is used for remote authentication. BMC doesn't support remote
151 BMC supports secure/non-secure LDAP configuration.
153 ### Create LDAP Configuration
158 openbmctool.py <connection options> ldap enable --uri="ldap://<ldap server IP/hostname>" --bindDN=<…
170 openbmctool.py <connection options> ldap enable --uri="ldaps://<ldap server IP/hostname>" --bindDN=…
178 This error means that the BMC client needs to verify that the LDAP server's
182 To upload the CA certificate to the BMC, refer to the "Update LDAP root
185 b) openbmctool doesn't support individual LDAP config property update, To update
186 a single property user need to recreate the LDAP config with the changed values.
188 ### Delete/Erase LDAP Configuration
191 openbmctool.py <connection options> ldap disable
205 openbmctool.py <connection options> ldap privilege-mapper create --groupName=<groupName> --privileg…
211 openbmctool.py <connection options> ldap privilege-mapper delete --groupName=<groupName>
217 openbmctool.py <connection options> ldap privilege-mapper list
220 The normal workflow for LDAP configuration would be as shown below
223 - Configure LDAP. a) Configure CA certificate if secure LDAP server is being
224   configured. b) Create LDAP Configuration with local user.
229 a) If a user tries to login with LDAP credentials and has not added the
230 privilege mapping for the LDAP credentials then the user will get the following
233 403, 'LDAP group privilege mapping does not exist'.
243 c) Once LDAP is set up, openbmctool connection options work with both LDAP and