Login or Register to Ask a Question and Join Our Community


Solaris

LDAP Problem during Kerberos setting for Win server 03 Active Directory

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Operating Systems Solaris LDAP Problem during Kerberos setting for Win server 03 Active Directory
# 1  
Old 03-31-2011
Question LDAP Problem during Kerberos setting for Win server 03 Active Directory
Hi, FYI, I'm new in Solaris

I'm trying to use Kerberos on authenticating LDAP Client with the Active Directory on Windows Server 2003 on both Solaris 10 5/08 and Solaris 10 9/10 by referring to the pdf file kerberos_s10.pdf available at sun official site.

Code:
http://www.sun.com/bigadmin/features/articles/kerberos_s10.pdf

everything runs fine, i can even do ldap search for the user created at Active Directory. The following are the result:

Code:
# ldapsearch -h w2k3adsoltest.adsol.test.com -b "cn=users,dc=adsol,dc=test,dc=com" -o mech=gssapi -o authzid='' "cn=just a test"

version: 1
dn: CN=just a test,CN=Users,DC=ADSOL,DC=TEST,DC=COM
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: just a test
sn: test
givenName: just a
distinguishedName: CN=just a test,CN=Users,DC=ADSOL,DC=TEST,DC=COM
instanceType: 4
whenCreated: 20110331013253.0Z
whenChanged: 20110331013254.0Z
displayName: just a test
uSNCreated: 28689
uSNChanged: 28695
name: just a test
objectGUID:: M0SbXPO8Z0yqgXWUjLE2wA==
userAccountControl: 66048
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
lastLogon: 0
pwdLastSet: 129460087738281250
primaryGroupID: 513
objectSid:: AQUAAAAAAAUVAAAANtggK1yqWWT5N+pNWwQAAA==
accountExpires: 9223372036854775807
logonCount: 0
sAMAccountName: test
sAMAccountType: 805306368
userPrincipalName: test@ADSOL.TEST.COM
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=ADSOL,DC=TEST,DC=COM
uidNumber: 10002
gidNumber: 10000
unixHomeDirectory: /export/home/test
loginShell: /bin/bash

if referred to page 17 of the mentioned manual,

this command able to run and get the expected result

Code:
# dig w2k3adsoltest.adsol.test.com +short
192.168.1.1

but

Code:
# dig -x 192.168.1.1 +short
;; connection timed out; no servers could be reached

after that I tried to manually configure the client profile manually:

Code:
# ldapclient -v manual \
-a credentialLevel=self \
-a authenticationMethod=sasl/gssapi \
-a defaultSearchBase=dc=adsol,dc=test,dc=com \
-a domainName=adsol.test.com \
-a defaultServerList=192.168.1.1 \
-a attributeMap=group:userpassword=msSFU30Password \
-a attributeMap=group:memberuid=msSFU30MemberUid \
-a attributeMap=group:gidnumber=msSFU30GidNumber \
-a attributeMap=passwd:gecos=msSFU30Gecos \
-a attributeMap=passwd:gidnumber=msSFU30GidNumber \
-a attributeMap=passwd:uidnumber=msSFU30UidNumber \
-a attributeMap=passwd:uid=sAMAccountName \
-a attributeMap=passwd:homedirectory=msSFU30HomeDirectory \
-a attributeMap=passwd:loginshell=msSFU30LoginShell \
-a attributeMap=shadow:shadowflag=msSFU30ShadowFlag \
-a attributeMap=shadow:userpassword=msSFU30Password \
-a attributeMap=shadow:uid=sAMAccountName \
-a objectClassMap=group:posixGroup=group \
-a objectClassMap=passwd:posixAccount=user \
-a objectClassMap=shadow:shadowAccount=user \
-a serviceSearchDescriptor=passwd:cn=users,DC=adsol,DC=test,DC=com?one \
-a serviceSearchDescriptor=group:cn=users,DC=adsol,DC=test,DC=com?one

the output:

Code:
Parsing credentialLevel=self
Parsing authenticationMethod=sasl/gssapi
Parsing defaultSearchBase=dc=adsol,dc=test,dc=com
Parsing domainName=adsol.test.com
Parsing defaultServerList=192.168.1.1
Parsing attributeMap=group:userpassword=msSFU30Password
Parsing attributeMap=group:memberuid=msSFU30MemberUid
Parsing attributeMap=group:gidnumber=msSFU30GidNumber
Parsing attributeMap=passwd:gecos=msSFU30Gecos
Parsing attributeMap=passwd:gidnumber=msSFU30GidNumber
Parsing attributeMap=passwd:uidnumber=msSFU30UidNumber
Parsing attributeMap=passwd:uid=sAMAccountName
Parsing attributeMap=passwd:homedirectory=msSFU30HomeDirectory
Parsing attributeMap=passwd:loginshell=msSFU30LoginShell
Parsing attributeMap=shadow:shadowflag=msSFU30ShadowFlag
Parsing attributeMap=shadow:userpassword=msSFU30Password
Parsing attributeMap=shadow:uid=sAMAccountName
Parsing objectClassMap=group:posixGroup=group
Parsing objectClassMap=passwd:posixAccount=user
Parsing objectClassMap=shadow:shadowAccount=user
Parsing serviceSearchDescriptor=passwd:cn=users,DC=adsol,DC=test,DC=com?one
Parsing serviceSearchDescriptor=group:cn=users,DC=adsol,DC=test,DC=com?one
Arguments parsed:
authenticationMethod: sasl/gssapi
defaultSearchBase: dc=adsol,dc=test,dc=com
credentialLevel: self
domainName: adsol.test.com
objectclassMap:
arg[0]: group:posixGroup=group
arg[1]: passwd:posixAccount=user
arg[2]: shadow:shadowAccount=user
attributeMap:
arg[0]: group:userpassword=msSFU30Password
arg[1]: group:memberuid=msSFU30MemberUid
arg[2]: group:gidnumber=msSFU30GidNumber
arg[3]: passwd:gecos=msSFU30Gecos
arg[4]: passwd:gidnumber=msSFU30GidNumber
arg[5]: passwd:uidnumber=msSFU30UidNumber
arg[6]: passwd:uid=sAMAccountName
arg[7]: passwd:homedirectory=msSFU30HomeDirectory
arg[8]: passwd:loginshell=msSFU30LoginShell
arg[9]: shadow:shadowflag=msSFU30ShadowFlag
arg[10]: shadow:userpassword=msSFU30Password
arg[11]: shadow:uid=sAMAccountName
serviceSearchDescriptor:
arg[0]: passwd:cn=users,DC=adsol,DC=test,DC=com?one
arg[1]: group:cn=users,DC=adsol,DC=test,DC=com?one
defaultServerList: 192.168.1.1
Handling manual option
Proxy DN: NULL
Proxy password: NULL
Credential level: 2
Authentication method: 2
No proxyDN/proxyPassword required
About to modify this machines configuration by writing the files
Stopping network services
sendmail not running
nscd not running
autofs not running
ldap not running
nisd not running
nis(yp) not running
file_backup: stat(/etc/nsswitch.conf)=0
file_backup: (/etc/nsswitch.conf -> /var/ldap/restore/nsswitch.conf)
file_backup: stat(/etc/defaultdomain)=0
file_backup: (/etc/defaultdomain -> /var/ldap/restore/defaultdomain)
file_backup: stat(/var/nis/NIS_COLD_START)=-1
file_backup: No /var/nis/NIS_COLD_START file.
file_backup: nis domain is "adsol.test.com"
file_backup: stat(/var/yp/binding/adsol.test.com)=-1
file_backup: No /var/yp/binding/adsol.test.com directory.
file_backup: stat(/var/ldap/ldap_client_file)=-1
file_backup: No /var/ldap/ldap_client_file file.
Starting network services
start: /usr/bin/domainname adsol.test.com... success
start: DNS client is enabled
start: sleep 100000 microseconds
start: sleep 200000 microseconds
start: network/ldap/client:default... success
start: Error: sasl/GSSAPI bind is not working. Abort.
restart: sleep 100000 microseconds
restart: sleep 200000 microseconds
restart: sleep 400000 microseconds
restart: sleep 800000 microseconds
restart: milestone/name-services:default... success
Error resetting system.
Recovering old system settings.
Stopping network services
sendmail not running
nscd not running
autofs not running
Stopping ldap
stop: sleep 100000 microseconds
stop: sleep 200000 microseconds
stop: sleep 400000 microseconds
stop: network/ldap/client:default... success
nisd not running
nis(yp) not running
recover: stat(/var/ldap/restore/defaultdomain)=0
recover: open(/var/ldap/restore/defaultdomain)
recover: read(/var/ldap/restore/defaultdomain)
recover: old domainname "adsol.test.com"
recover: stat(/var/ldap/restore/ldap_client_file)=-1
recover: stat(/var/ldap/restore/ldap_client_cred)=-1
recover: stat(/var/ldap/restore/NIS_COLD_START)=-1
recover: stat(/var/ldap/restore/adsol.test.com)=-1
recover: stat(/var/ldap/restore/nsswitch.conf)=0
recover: file_move(/var/ldap/restore/nsswitch.conf, /etc/nsswitch.conf)=0
recover: stat(/var/ldap/restore/defaultdomain)=0
recover: file_move(/var/ldap/restore/defaultdomain, /etc/defaultdomain)=0
Starting network services
start: /usr/bin/domainname adsol.test.com... success
restart: sleep 100000 microseconds
restart: sleep 200000 microseconds
restart: milestone/name-services:default... success

Restart the LDAP Client:

Code:
# svcadm restart svc:/network/ldap/client:default

List the LDAP Client cache:

Code:
# ldapclient list
Cannot get print configuration
Unable to open filename '/var/ldap/ldap_client_file' for reading (errno=2).

Can someone tell me what happened? am I missed something?Smilie

Thank you~
Login or Register to Ask a Question

Previous Thread | Next Thread

8 More Discussions You Might Find Interesting

1. UNIX for Beginners Questions & Answers

Active Directory OR LDAP

Hi, How can we check users added through LDAP or AD. Users added through a group of AD or LDAP group. (2 Replies)
Discussion started by: Nishit
2 Replies

2. Shell Programming and Scripting

Script to extract data from Active Directory and import in Zimbra Ldap

Hello Experts, I have this specific requirment where i need to download/extract from AD (Firstname, LastName, etc) and upload the same to Ldap used by Zimbra mail server running on Suse Linux. I know how to manually do that, but that is the not the solution. I am not yet sure on how to start... (3 Replies)
Discussion started by: Siddheshk
3 Replies

3. HP-UX

HP-UX SSH and Active Directory Kerberos with Samba

The situation: i have a AD server with samba4,all clients ssh-kerberos works fine,except hpux :p wich works only for few days..then i must re-export(sic!) the keys with samba-tool domain exportkeytab 11.keytab --principal=host/hpux.fqdn Why after few days ssh return error "server not found... (1 Reply)
Discussion started by: Linusolaradm1
1 Replies

4. HP-UX

Problem in Configuring kerberos Server on HPUX

Hi, I am getting this error during kerberos server setup in HPUX 11.31 : kdb_create: unknown LDAP backend error while adding master entry to the database ps -ef|grep ldap root 3905 1 0 13:11:36 ? 0:00 /opt/ldapux/bin/ldapclientd Unable to find out the meaning of this... (1 Reply)
Discussion started by: Amit Kulkarni
1 Replies

5. Red Hat

ldap and active directory

Hi Friends, I need your help to get some solution of one of my problem. Ours is a mixed domain. Most of the servers are windows and very little linux servers. We are using the MS AD for authentication. My problem is, I want to authenticate linux servers against AD. I donot want to use any... (1 Reply)
Discussion started by: arumon
1 Replies

6. UNIX for Advanced & Expert Users

Compiling Samba from Source on AIX, Active Directory, LDAP, Kerberos

Hello, I asked this question in the AIX subforum but never received an answer, probably because the AIX forum is not that heavily trafficked. Anyway, here it is.. I have never had any issues like this when compiling applications from source. When I try to compile samba-3.5.0pre2, configure runs... (9 Replies)
Discussion started by: raidzero
9 Replies

7. Linux

How to set up FTP Server with Active Directory

I've set up a FTP server (vsftpd) with some local user account and it works fine. Now i want to upgrade this FTP server with an ability that can authorize user through Active Directory. I do a search around our forum and it leads me to this page: Native LDAP, native Kerberos and Windows Server... (0 Replies)
Discussion started by: cthinh
0 Replies

8. UNIX for Advanced & Expert Users

LDAP request from unix into Active Directory

Hi all, I experienced a problem when making a LDAP search from Unix Netscape or Unix Mozilla adressbooks into my Active Directory LDAP db for email addresses. I add my Domain Controller hostname and the LDAP root dir to search in. For example: Name: AD LDAP server: gullvi Search Root:... (0 Replies)
Discussion started by: tonlu
0 Replies
Login or Register to Ask a Question