AIX has ldif additions to add into an AD server what it needs for full AIX support. However, I hear AD support may "stop" when you add any "foreign" ldif files. I also hear it is very difficult (read impossible) to back out a ldif extension.

The AIX client does not really care what LDAP server is supplying the answers to queries. But it does need much more than simple rfc2307 (basically that only supports the 7 user administration entries in /etc/passwd and /etc/group (with the encrypted password "shadowed" away).

So, the key thing to test/verify - does the LDAP server support multiple DIT domains (some shops use different domains for production and server to support different specifications of the authentications and privileges assigned to roles under RBAC. In other words, the role name is the same on all systems, but the "power" differs.

IMHO: is it very much worth the time and effort to get AIX system configuration configured behind LDAP services.

From /etc/security/ldap/ldap.cfg (client side)

Code:

# Base DN where the user and group data are stored in the LDAP server.
# e.g., if user foo's DN is: uid=foo,ou=people,cn=aixdata
# then the user base DN is: ou=people,cn=aixdata
#userbasedn:ou=people,cn=aixdata
#groupbasedn:ou=groups,cn=aixdata
#idbasedn:cn=aixid,ou=system,cn=aixdata
#hostbasedn:ou=hosts,cn=aixdata
#servicebasedn:ou=services,cn=aixdata
#protocolbasedn:ou=protocols,cn=aixdata
#networkbasedn:ou=networks,cn=aixdata
#netgroupbasedn:ou=netgroup,cn=aixdata
#rpcbasedn:ou=rpc,cn=aixdata
#automountbasedn:ou=automount,cn=aixdata
#aliasbasedn:ou=aliases,cn=aixdata
#bootparambasedn:ou=ethers,cn=aixdata
#etherbasedn:ou=ethers,cn=aixdata
#authbasedn:ou=authorizations,cn=aixdata
#rolebasedn:ou=roles,cn=aixdata
#privcmdbasedn:ou=privcmds,cn=aixdata
#privdevbasedn:ou=privdevs,cn=aixdata
#privfilebasedn:ou=privfiles,cn=aixdata
#domainbasedn:ou=domains,cn=aixdata
#domobjbasedn:ou=domobjs,cn=aixdata

The first two are what most people are thinking of initially, while AIX preferes the first three (the third brings the file /etc/security/.ids into LDAP simplyfying/ensuring unique userid generation).
In short, if your choice for an LDAP server is not going to support, or is difficult about supporting these many different domains - it is not suitable as an LDAP server for AIX.

Hope this helps!

p.s. regarding the Tivoli Directory Servers - they permit multiple versions installed and operating on a single AIX system (obviously using different ports).
AIX v4 client only knows about the AIX-only schema, so you will need a separate LDAP server for that - regardless of your choice. When you get to the point that you have everything bu AIXv4 under LDAP - try and contact me and I'll ask my LDAP SSO colleagues if they have suggestions.