Using centralized user management

Use the IBM® Flex System Manager management software to change centralized management settings for a chassis.

The option to manage a chassis with the centralized management node user registry is available when you first select a chassis for management on the Management Domain page in the IBM Flex System Manager management software web interface (see Selecting chassis for management).
Important: To centrally manage a chassis that is on a different subnet from the IBM Flex System Manager, make sure that you enable multicast SLP forwarding on the top-of-rack switches as well as the router or routers in your environment. Some top-of-rack switches disable multicast SLP forwarding by default. See the documentation that was provided with your specific switch or router to determine whether multicast SLP forwarding is disabled by default and to find procedures for enabling it.
Note: If your chassis is already managed, and you want to change the chassis user management mode, make sure that you follow the applicable instructions in Changing the user management mode of a managed chassis.

When you use the management software to place a chassis under centralized management, the Chassis Management Module (CMM) is configured to use the registry that is stored on the management node. The local user accounts in the CMM registry are disabled, and the new user account RECOVERY_ID is created on the CMM for future authentication to the CMM (as long as it is configured to use the centralized user registry on the management node).

If you make changes to the disabled local CMM accounts (for example, if you change a password), the changes have no effect on the RECOVERY_ID account. In centralized user management mode, the RECOVERY_ID account is the only CMM account that is activated and operational.
Note: The first time you log in to the CMM with the RECOVERY_ID account, you are prompted to change the password. The RECOVERY_ID password can be changed only on the CMM.

After the CMM detects the management node user registry, it uses the management node registry configuration to provision all of the managed resources in the chassis (except for network switches) so that they also use the central management node user registry.

After a chassis is managed in centralized user management mode, the management node becomes the account manager for the chassis; you can log in to the CMM using accounts from the management node user registry. If a chassis is in centralized management mode, and the management node fails, you can use the RECOVERY_ID account to log in to the CMM to take recovery actions to restore account-management functions on the CMM until the management node is restored or replaced. See Recovering chassis management with a CMM after a management node failure for more information.
Important: After you centrally manage a chassis that contains an IBM Flex System® V7000 Storage Node, you must create a new user group on the IBM Flex System V7000 Storage Node for users with operator access. Otherwise, those users will not be able to log in to the IBM Flex System V7000 Storage Node.
For example, to create a new user group on the IBM Flex System V7000 Storage node, log in to the storage node and use the command-line interface to enter the following command:
mkusergrp -name smdefault -role CopyOperator -remote

For information about creating user groups on the IBM Flex System V7000 Storage Node through the command-line interface, see Creating and working with user groups using the CLI

For information about changing the management network IP address when the management node is managing chassis in centralized user management mode, see Changing an IBM Flex System Manager management node IP address.

For centralized user management troubleshooting, see Centralized user management problems.