sorry for not replying earlier, i was busy trying to fix it and i managed to use rbac roles and profiles defined locally to be used by LDAP MS AD users.
it was more simple than i thought ..
all you have to do is define rbac properly then edit the /etc/user_attr manually and add a line per user.
file attached (snapshot) of /etc/user_attr line needs to be added for each MS AD user
then login with AD user normally , su to RBAC role and thats it , you have Primary Administrator Role.
soon ill finish documenting the complete procedure as proof of concept for the management , along with auto creation of home directories if it didnt exist using one of two options (compiled pam or auto_home with NFS).
sorry again for the late reply and thanks to you all.
whoever needs a copy of the document (within a week will be ready) inshallah, drop me and email of i can post it here too if needed.
All newly created Aix5 users are forced to change password first time when they log in. We know removing the ADMCHG flag in passwd file will not prompt the user for change password. But we are trying to figure out the similar solution if the user is created as a LDAP user ?. Any help?
Thanks... (0 Replies)
hi,
is it possible to link users on a LDAP-Server from one container to another?
we have two trees, one for AIX and one for solaris-linux
but we have a few users in both trees, they should have the same password and a password change must affect both entries
we use IBM Directory Server... (3 Replies)
Hi All,
i would like to know if it's possible to create a new custom role on HMC to manage only one LPAR and few activity on it (START,STOP,CONSOLE).
It's possible create this custom role?
If yes where i can read something about?
Thanks in advance.
Bye.
Zio (1 Reply)
Hello everyone, I am having trouble with something, and I can't find the right answer online. On our company, we are using LDAP Authentication with Active Directory (Windows 2008 Servers) to have a centralized management of AIX 7.1 users.
So far so good, but now, we want to implement RBAC on... (7 Replies)
I have these two table. How do I see if user roles and system roles are seperated?
SQL> desc DBA_ROLES;
Name Null? Type
----------------------------------------- -------- ----------------------------
ROLE NOT NULL... (1 Reply)
I have very limited knowledge on LDAP configuration and have been trying fix one issue, but unsuccessful.
The server, I am working on, is Solaris-10 zone. sudoers is configured on LDAP (its not on local server). I have access to login directly on server with root, but somehow sudo is not working... (9 Replies)
Oracle Solaris 10 9/10 s10s_u9wos_14a SPARC
Hi, just starting with RBAC. I have managed to create a test user with assigned roles:
Basic Actions
Basic Solaris UserI also didroleadd -d /export/home/userrole -m userrolebut when I didrolemod -P "Basic Actions" userrole
rolemod -P "Basic... (1 Reply)
Discussion started by: rino19ny
1 Replies
LEARN ABOUT HPUX
cmdprivadm
cmdprivadm(1M)cmdprivadm(1M)NAME
cmdprivadm - noninteractive editing of a command's authorization and privilege information in the privrun database
SYNOPSIS DESCRIPTION
is a noninteractive command that allows user with appropriate permission to add or delete a command and its privileges in the Role-Base
Access Control (RBAC) database, See privrun(1M) for more details on this file.
When adding a line to the database, sets fields that are not specified a default value. When deleting a line, the lines matching all the
given pairs will be deleted. That is, if all fields specified match, the entry will be deleted.
Appends a line as specified in pairs in the file.
Deletes a line as specified in pairs from file.
HP recommends that only the and commands be used to edit and view the RBAC databases; do not edit the RBAC files directly.
See rbac(5) for information on the RBAC databases.
Options
The following options are valid pairs for
command should include the full path name of the command. There can be one or more arguments following the command.
filename should specify the full path name of a file name.
Specifies the operation.
Specifies the object.
Specifies the real user ID
(ruid).
Specifies the effective user ID
(euid).
Specifies the real group ID
(rgid).
Specifies the effective group ID
(egid).
Specifies the compartment.
Specifies the privileges.
Specifies the PAM service name to reauthenticate under.
See pam.conf(4) for a list of PAM services.
Specifies the flags.
Note: You must enclose values that contain the space character, or any characters that may be interpreted by the shell, with single quotes.
For example, if the has one or more arguments, enclose them with single quotes:
Authorizations:
In order to invoke the user must either be root, (running with effective UID of 0), or have the appropriate authorizations. The following
is a list of the required authorizations for running with particular options:
Allows user to run
with options.
Allows user to run
with options.
EXTERNAL INFLUENCES
Environment Variables
determines the language in which messages are displayed.
International Code Set Support
Single-byte character code set is supported.
RETURN VALUE
Upon completion, returns one of the following values:
Success.
Failure.
An appropriate error message is printed on standard error.
EXAMPLES
The following commands add entries into the file:
The following commands delete entries from the file:
FILES
Database containing valid definitions of all roles.
Database containing definitions of all valid authorizations.
Database specifying the roles allowed for each specified user.
Database defining the authorizations for each specified role.
Database containing the authorization to execute specified commands,
and the privileges to alter UID and GID for command execution.
SEE ALSO authadm(1M), privrun(1M), rbacdbchk(1M), roleadm(1M), rbac(5).
cmdprivadm(1M)