> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# HP iLO local account rotation

> Learn how to automatically rotate HP iLO local account passwords.

Rotate the password of a local account on HP Integrated Lights-Out (iLO), the management interface of HP servers, on a schedule. Infisical generates a new password, sets it on the iLO, and stores the account's username and password in the Infisical secrets you choose.

The rotation works with either of two app connections: an [HPE iLO connection](https://infisical.com/docs/integrations/app-connections/hpe-ilo.md), which changes the password through the iLO's Redfish API over HTTPS, or an [SSH connection](https://infisical.com/docs/integrations/app-connections/ssh.md), which runs iLO commands over SSH. To decide which one to use, see [Choose an app connection](#choose-an-app-connection).

> [!NOTE]
>
> **Rotation Type: [Single-Phase](https://infisical.com/docs/documentation/platform/secret-rotation/overview)**
>
> This rotation updates one set of credentials in place, so the previous password stops working as soon as the rotation finishes. Clients that still use the previous password can't sign in until they read the new password from Infisical. An iLO account has only one password, so Infisical can't keep the previous password valid during a rotation.

> [!WARNING]
>
> **iLO password length**
>
> HP iLO accepts passwords of at most 39 characters. The default password requirements for this rotation (39 characters, no symbols) fit that limit. If you change the password requirements, keep **Password Length** at 39 or lower.

## Choose an app connection

If your server has iLO 7, use an HPE iLO connection, because Infisical can't rotate iLO 7 passwords over SSH.

> [tab] SSH connection
>
> Infisical signs in to the iLO over SSH and runs the iLO command that sets the target account's password. **Rotation Method** decides which account signs in:
>
> * **Login As Root**: Infisical signs in with the SSH connection's credentials and changes the target account's password
> * **Login As Target**: Infisical signs in as the target account with the account's current password, and the account changes its own password
>
> After the change, Infisical signs in over SSH as the target account with the new password to check that the password works, then saves the username and password to the mapped secrets.

> [tab] HPE iLO connection (Redfish API)
>
> Infisical signs in to the iLO's Redfish API with the HPE iLO connection's username and password, finds the account named in **Target Username**, and sets a new password on the account.
>
> After the change, Infisical signs in to the Redfish API as the target account with the new password to check that the password works, then saves the username and password to the mapped secrets.

## Prerequisites

* A [project with secrets configured](https://infisical.com/docs/documentation/platform/secrets-mgmt/quick-starts/deliver-first-secret.md)
* An iLO local account for the app connection, separate from the account you rotate
* Permission for the app connection's account to change the rotated account's password (not needed if you use an SSH connection with **Login As Target**)
* Network access from Infisical to the iLO, directly or through a [Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md), if network restrictions apply: HTTPS for an HPE iLO connection, or SSH for an SSH connection

## Create an HP iLO local account rotation

> [tab] Infisical UI
>
> **Step 1**
>
> In your Secrets Management project, open the dashboard and select **Add Secret Rotation** from the actions dropdown.
>
> ![Add Secret Rotation](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/generic/add-secret-rotation.png)
>
> Then, select the **HP iLO Local Account** option.
>
> ![Select HP iLO Local Account](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/hp-ilo-local-account/select-hp-ilo-local-account-option.png)
>
> **Step 2**
>
> Under **Configuration**, choose the app connection and when the rotation runs:
>
> * **Environment**: The project environment the rotated secrets are stored in
> * **Connection**: The HPE iLO connection or SSH connection the rotation uses (the dropdown groups the connections by type)
> * **Rotation Interval (In Days)**: The number of days between rotations
> * **Rotate At (Local Time)**: The time of day the rotation runs
> * **Auto-Rotation Enabled**: When enabled, the password rotates on the schedule; turn it off to rotate manually only
>
> To create a new connection, select **Create HPE iLO Connection** or **Create SSH Connection** in the **Connection** dropdown, then fill in the form as described in [HPE iLO connection](https://infisical.com/docs/integrations/app-connections/hpe-ilo.md) or [SSH connection](https://infisical.com/docs/integrations/app-connections/ssh.md). Infisical returns you to the rotation form with the new connection selected.
>
> ![Rotation Configuration](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/hp-ilo-local-account/hp-ilo-local-account-configuration.png)
>
> > [!NOTE]
> >
> > Because this rotation changes a single password, an automatic rotation can interrupt clients that use the previous password. If you need to avoid interruptions, turn off **Auto-Rotation Enabled** and rotate manually.
>
> Then select **Continue**.
>
> **Step 3**
>
> Under **Parameters**, choose the iLO account to rotate. The fields depend on the type of connection you selected:
>
> > [tab] HPE iLO connection
> >
> > * **Target Username**: The iLO username of the account whose password Infisical rotates
> >
> >   ![Rotation Parameters for an HPE iLO connection](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/hp-ilo-local-account/hp-ilo-local-account-parameters-hpe-ilo.png)
>
> > [tab] SSH connection
> >
> > * **Rotation Method**: Which account signs in to change the password ([Choose an app connection](#choose-an-app-connection) describes both methods)
> > * **Target Username**: The iLO username of the account whose password Infisical rotates
> > * **Current Password**: The target account's current password (shown only for **Login As Target**)
> >
> >   ![Rotation Parameters for an SSH connection](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/hp-ilo-local-account/hp-ilo-local-account-parameters.png)
>
> Under **Password Requirements**, set the rules for generated passwords:
>
> * **Password Length**: The length of the generated password (39 at most)
> * **Digit Count**: The minimum number of digits
> * **Lowercase Character Count**: The minimum number of lowercase characters
> * **Uppercase Character Count**: The minimum number of uppercase characters
> * **Symbol Count**: The minimum number of symbols
> * **Allowed Symbols**: The symbols a generated password can contain
>
> Then select **Continue**.
>
> **Step 4**
>
> Under **Mappings**, choose the names of the Infisical secrets that hold the rotated values:
>
> * **Username**: The name of the secret that holds the iLO username
> * **Password**: The name of the secret that holds the rotated password
>
>   ![Secret Mapping](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/hp-ilo-local-account/hp-ilo-local-account-secrets-mapping.png)
>
> Then select **Continue**.
>
> **Step 5**
>
> Give the rotation a **Name** and an optional **Description**. The name must be slug-friendly.
>
> ![Rotation Details](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/hp-ilo-local-account/hp-ilo-local-account-details.png)
>
> Then select **Continue**.
>
> **Step 6**
>
> Review your HP iLO Local Account Rotation configuration, then select **Create secret rotation**.
>
> ![Review and Create](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/hp-ilo-local-account/hp-ilo-local-account-confirm.png)
>
> > [!TIP]
> >
> > The rotated credentials are now available through the mapped secrets. If auto-rotation is enabled, the password rotates on your configured schedule.
>
> ![Rotation Created](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/hp-ilo-local-account/hp-ilo-local-account-created.png)

> [tab] API
>
> To create an HP iLO Local Account Rotation, make an API request to the [Create HP iLO Local Account Rotation](https://infisical.com/docs/api-reference/endpoints/secret-rotations/hp-ilo-local-account/create.md) endpoint.
>
> Set `connectionId` to the ID of an HPE iLO connection or an SSH connection. `parameters.rotationMethod` applies only to SSH connections: leave it out for an HPE iLO connection, because Infisical rejects `login-as-target` for HPE iLO connections. For `login-as-target`, also send the target account's current password in `temporaryParameters.password`.
>
> ### Sample request
>
> The following request creates a rotation that uses an SSH connection with **Login As Root**.
>
> ```bash Request theme={"dark"}
> curl --request POST \
> --url https://us.infisical.com/api/v2/secret-rotations/hp-ilo-local-account \
> --header 'Content-Type: application/json' \
> --data '{
>     "name": "my-hp-ilo-rotation",
>     "projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
>     "description": "my HP iLO local account rotation",
>     "connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
>     "environment": "dev",
>     "secretPath": "/",
>     "isAutoRotationEnabled": false,
>     "rotationInterval": 30,
>     "rotateAtUtc": {
>         "hours": 0,
>         "minutes": 0
>     },
>     "parameters": {
>         "rotationMethod": "login-as-root",
>         "username": "ilouser",
>         "passwordRequirements": {
>             "length": 39,
>             "required": {
>                 "digits": 2,
>                 "lowercase": 2,
>                 "uppercase": 2,
>                 "symbols": 2
>             },
>             "allowedSymbols": "-_.~!*"
>         }
>     },
>     "secretsMapping": {
>         "username": "ILO_USERNAME",
>         "password": "ILO_PASSWORD"
>     }
> }'
> ```
>
> > [!NOTE]
> >
> > Because this rotation changes a single password, an automatic rotation can interrupt clients that use the previous password. If you need to avoid interruptions, set `isAutoRotationEnabled` to `false` and rotate manually.
>
> ### Sample response
>
> In the response, `connection.app` is `hpe-ilo` for an HPE iLO connection and `ssh` for an SSH connection.
>
> ```bash Response theme={"dark"}
> {
>     "secretRotation": {
>         "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
>         "name": "my-hp-ilo-rotation",
>         "description": "my HP iLO local account rotation",
>         "secretsMapping": {
>             "username": "ILO_USERNAME",
>             "password": "ILO_PASSWORD"
>         },
>         "isAutoRotationEnabled": false,
>         "activeIndex": 0,
>         "folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
>         "connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
>         "createdAt": "2023-11-07T05:31:56Z",
>         "updatedAt": "2023-11-07T05:31:56Z",
>         "rotationInterval": 30,
>         "rotationStatus": "success",
>         "lastRotationAttemptedAt": "2023-11-07T05:31:56Z",
>         "lastRotatedAt": "2023-11-07T05:31:56Z",
>         "lastRotationJobId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
>         "nextRotationAt": "2023-11-07T05:31:56Z",
>         "connection": {
>             "app": "ssh",
>             "name": "my-ssh-connection",
>             "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
>         },
>         "environment": {
>             "slug": "dev",
>             "name": "Development",
>             "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
>         },
>         "projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
>         "folder": {
>             "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
>             "path": "/"
>         },
>         "rotateAtUtc": {
>             "hours": 0,
>             "minutes": 0
>         },
>         "lastRotationMessage": null,
>         "type": "hp-ilo-local-account",
>         "parameters": {
>             "rotationMethod": "login-as-root",
>             "username": "ilouser",
>             "passwordRequirements": {
>                 "length": 39,
>                 "required": {
>                     "digits": 2,
>                     "lowercase": 2,
>                     "uppercase": 2,
>                     "symbols": 2
>                 },
>                 "allowedSymbols": "-_.~!*"
>             }
>         }
>     }
> }
> ```

## Recover after an outside password change

If a rotation uses an SSH connection with **Login As Target** and someone changes the target account's password outside Infisical, the next rotation can't sign in as the target account. To get the rotation working again, reconcile it:

**Step 1**

In your project's dashboard, select **Reconcile Secret** on the rotation.

![Reconcile Option](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/hp-ilo-local-account/hp-ilo-local-account-reconcile.png)

**Step 2**

In the confirmation dialog, select **Reconcile**.

![Reconcile Confirmation](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/hp-ilo-local-account/hp-ilo-local-account-reconcile-confirm.png)

Infisical signs in with the SSH connection's credentials, sets a new password on the target account, and saves the password to the mapped secrets.

A rotation that uses an HPE iLO connection or **Login As Root** always signs in with the connection's account, so a password change outside Infisical doesn't stop the next rotation.

## Next steps

> [card] [HPE iLO](https://infisical.com/docs/integrations/app-connections/hpe-ilo.md)
>
> Create an HPE iLO connection for Redfish-based rotations.

> [card] [Overview](https://infisical.com/docs/documentation/platform/secret-rotation/overview)
>
> Learn how secret rotation schedules and rotation types work.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.