Controlling access for authorized users

Access to the appliance is controlled by roles, which describe what an authenticated user is permitted to do on the appliance. Each user must be associated with at least one role.

Specifying user accounts and roles

User login accounts on the appliance must be assigned a role, which determines what the user has permission to do.

For information on each role, and the capabilities these roles provide, see About user roles.

Mapping of SSO roles for iLO and OA

The appliance enables SSO (single sign-on) to iLO and OA (Onboard Administrator) without storing user-created iLO or OA credentials. The following table describes the mapping of roles between the appliance, iLO, and OA.

Appliance role	SSO to iLO roles	SSO to OA roles
Infrastructure administrator	Admin	Admin
Server administrator	Admin	Admin
Network administrator	User	User
Read only	User	User
Backup administrator	None	None
Storage administrator	User	User

Appliance roles

See About user roles.

iLO roles

Administrator privileges enable assigning all administrative rights for server reset, remote console, and login tasks.
User privileges have access restrictions, based on IP address, DNS name, or time.

OA roles

Administrator privileges enable creating or editing all user accounts on an enclosure.
Operator privileges enable full information access and control of bays to which you have permitted access to.

NOTE: SSO cannot configure permitted bays.
User privileges enable full information access but no control capability.

Mapping appliance interactions with iLO, OA, and iPDU

The appliance performs configurations on the iLO, OA, and iPDU. The following table summarizes how the appliance interacts with these devices.

For firewall information, see Ports required for HPE OneView.

Protocol or interaction	Description	iLO		OA		iPDU
Protocol or interaction	Description	Use	Configure	Use	Configure	Use	Configure
NTP	Configures NTP		✓		✓
SNMP	Enables and configures SNMP to collect information	✓	✓	✓	✓	✓	✓
SNMP traps	Enables and configures SNMP traps sent to appliance	✓	✓	✓	✓	✓	✓
HTTPS (RIBCL/SOAP/JSON)^[a]	Collects information (the specific protocol varies, but all use SSL)	✓		✓		✓
Remote Console	Links from the UI to the iLO Remote Console	✓
SSH	Not used
Telnet	Not used
XML reply	Collects generic system information	✓		✓
SSO	Enables and configures an SSO certificate for UI access. See Mapping of SSO roles for iLO and OA for the privileges that are granted.	✓	✓	✓	✓
Appliance user account (_HPOneViewAdmin)	Configures and manages the system using an administrator-level user account (and randomly generated password)	✓	✓			✓	✓
^[a] SSL encrypts traffic on the network, but does not authenticate the remote system's certificate.

prev	up	next
Authentication for appliance access	home	Protecting credentials


	NOTE: SSO cannot configure permitted bays.