Sponsored Content
Full Discussion: RBAC and LDAP users (AD)
Operating Systems AIX RBAC and LDAP users (AD) Post 302784483 by MichaelFelt on Friday 22nd of March 2013 10:54:48 AM
Old 03-22-2013
my pleasure.

If you have a chance to attend the TechU in Amsterdam or Athens this year I'll be doing a presentation/labs on RBAC and LDAP (installing ITDS from try and buy images). As I have time I am looking at compiling openldap for AIX and doing the same.

p.s. I expected that AD admins would not be "excited" about a schema change. "All" customers I have worked with have said no - in the end. AD support seems to end once a none-AD schema is installed. No support == No install.

Sorry I cannot provide an easier answer.

p.s. I do not know the answer - exactly - but you should also look into a construction for not allowing "any" AD defined user to be able to login to "all" systems. Normally, there are only one or two systems where a login is appropriate.
 

10 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

Equivalent of ADMCHG for LDAP Users

All newly created Aix5 users are forced to change password first time when they log in. We know removing the ADMCHG flag in passwd file will not prompt the user for change password. But we are trying to figure out the similar solution if the user is created as a LDAP user ?. Any help? Thanks... (0 Replies)
Discussion started by: vipas
0 Replies

2. UNIX for Advanced & Expert Users

link LDAP-Users

hi, is it possible to link users on a LDAP-Server from one container to another? we have two trees, one for AIX and one for solaris-linux but we have a few users in both trees, they should have the same password and a password change must affect both entries we use IBM Directory Server... (3 Replies)
Discussion started by: funksen
3 Replies

3. Solaris

Rbac

I am trying to let user asillitoe su to the godbrook role to execute commands. I have editted files as follows: user_attr: asillito::::type=normal;roles=godbrook godbrook::::type=role;profiles=Gadbrook,All prof_attr: Gadbrook:::Allow root commands to be used by godbrook: exec_attr:... (0 Replies)
Discussion started by: chrisdberry
0 Replies

4. Solaris

RBAC Help

do i have to create a new account to add a role? i want the sysadmin login i have 3 users on my systems sysadmin secman oc01 also 3 profiles SA (goes t0 sysadmin account) SSO (goes to secman account) LMICS (goes to oc01 account) the user accounts are located in /h/USERS/local the... (4 Replies)
Discussion started by: deaconf19
4 Replies

5. UNIX for Dummies Questions & Answers

Unix Rbac

Can anyone help me on "How to change Unix to support RBAC policy"? (4 Replies)
Discussion started by: JPoroo
4 Replies

6. Solaris

rbac problem.

Hi all! On backup server with contab my script worked, but one command don't fine to be executed: bash-3.00$ scp itadmin@172.17.0.44:/export/backups/* /bckp1/opencms/bcp_`date +%Y%m%d`/ www-zone.cfg 100%... (0 Replies)
Discussion started by: sotich82
0 Replies

7. Solaris

LDAP users with RBAC Roles

I have an issue with integration between Microsoft LDAP users and RBAC roles defined in a Solaris box. to explain more , i managed to integrate Microsoft Active Directory user loggings to Solaris boxes. I've done it to centralize user repo. and instead of creating admin accounts on more than... (9 Replies)
Discussion started by: mduweik
9 Replies

8. Linux

Monitor ldap users

Any way to find the ldap users currently logged into the clinets ? I am using Openldap with NFS for home directory mounts. (0 Replies)
Discussion started by: nitin09
0 Replies

9. Linux

Help me with all users ldap

Need to find the ldap id's of all the users in my organizations... is there any command??? (0 Replies)
Discussion started by: Syed Imran
0 Replies

10. Solaris

LDAP Client not connecting to LDAP server

I have very limited knowledge on LDAP configuration and have been trying fix one issue, but unsuccessful. The server, I am working on, is Solaris-10 zone. sudoers is configured on LDAP (its not on local server). I have access to login directly on server with root, but somehow sudo is not working... (9 Replies)
Discussion started by: solaris_1977
9 Replies
Net::LDAP::DSML(3)					User Contributed Perl Documentation					Net::LDAP::DSML(3)

NAME
Net::LDAP::DSML -- A DSML Writer for Net::LDAP SYNOPSIS
For a directory entry; use Net::LDAP; use Net::LDAP::DSML; use IO::File; my $server = "localhost"; my $file = "testdsml.xml"; my $ldap = Net::LDAP->new($server); $ldap->bind(); # # For file i/o # my $file = "testdsml.xml"; my $io = IO::File->new($file,"w") or die ("failed to open $file as filehandle.$! "); my $dsml = Net::LDAP::DSML->new(output => $io, pretty_print => 1 ) or die ("DSML object creation problem using an output file. "); # OR # # For file i/o # open (IO,">$file") or die("failed to open $file.$!"); my $dsml = Net::LDAP::DSML->new(output => *IO, pretty_print => 1) or die ("DSML object creation problem using an output file. "); # OR # # For array usage. # Pass a reference to an array. # my @data = (); $dsml = Net::LDAP::DSML->new(output => @data, pretty_print => 1) or die ("DSML object creation problem using an output array. "); my $mesg = $ldap->search( base => 'o=airius.com', scope => 'sub', filter => 'ou=accounting', callback => sub { my ($mesg,$entry) =@_; $dsml->write_entry($entry) if (ref $entry eq 'Net::LDAP::Entry'); } ); die ("search failed with ",$mesg->code()," ") if $mesg->code(); For directory schema; A file or array can be used for output, in the following example only an array will be used. my $schema = $ldap->schema(); my @data = (); my $dsml = Net::LDAP::DSML->new(output => @data, pretty_print => 1 ) or die ("DSML object creation problem using an output array. "); $dsml->write_schema($schema); print "Finished printing DSML "; DESCRIPTION
Directory Service Markup Language (DSML) is the XML standard for representing directory service information in XML. At the moment this module only writes DSML entry and schema entities. Reading DSML entities is a future project. Eventually this module will be a full level 2 consumer and producer enabling you to give you full DSML conformance. Currently this module has the ability to be a level 2 producer. The user must understand the his/her directory server will determine the consumer and producer level they can achieve. To determine conformance, it is useful to divide DSML documents into four types: 1.Documents containing no directory schema nor any references to an external schema. 2.Documents containing no directory schema but containing at least one reference to an external schema. 3.Documents containing only a directory schema. 4.Documents containing both a directory schema and entries. A producer of DSML must be able to produce documents of type 1. A producer of DSML may, in addition, be able to produce documents of types 2 through 4. A producer that can produce documents of type 1 is said to be a level 1 producer. A producer than can produce documents of all four types is said to be a level 2 producer. CALLBACKS
The module uses callbacks to improve performance (at least the appearance of improving performance ;) and to reduce the amount of memory required to parse large DSML files. Every time a single entry or schema is processed we pass the Net::LDAP object (either an Entry or Schema object) to the callback routine. CONSTRUCTOR
new () Creates a new Net::LDAP::DSML object. There are 2 options to this method. "output" is a reference to either a file handle that has already been opened or to an array. "pretty_print" is an option to print a new line at the end of each element sequence. It makes the reading of the XML output easier for a human. Example my $dsml = Net::LDAP::DSML->new(); Prints xml data to standard out. my $dsml = Net::LDAP::DSML->new(output => @array); my $dsml = Net::LDAP::DSML->new(output => *FILE); Prints xml data to a file or array. my $dsml = Net::LDAP::DSML->new(output => @array, pretty_print => 1); my $dsml = Net::LDAP::DSML->new(output => *FILE, pretty_print => 1); Prints xml data to a file or array in pretty print style. METHODS
start_dsml () Start a DSML file. end_dsml () End a DSML file. write_entry ( ENTRY ) Entry is a Net::LDAP::Entry object. The write method will parse the LDAP data in the Entry object and put it into DSML XML format. Example my $entry = $mesg->entry(); $dsml->write_entry($entry); write_schema ( SCHEMA ) Schema is a Net::LDAP::Schema object. The write_schema method will parse the LDAP data in the Schema object and put it into DSML XML format. Example my $schema = $ldap->schema(); $dsml->write_schema($schema); AUTHOR
Graham Barr gbarr@pobox.com SEE ALSO
Net::LDAP, XML::SAX::Base COPYRIGHT
Copyright (c) 2002-2006 Graham Barr. All rights reserved. This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself. perl v5.18.2 2013-12-23 Net::LDAP::DSML(3)
All times are GMT -4. The time now is 07:12 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy