AIX

Hi,

I am trying to authenticate AIX server against a IDS LDAP instance.

The AIX version is 6.1 and TDS client is 6.1.

I configured the secldapclntd using ldap.cfg file and changed /etc/security/user to set SYSTEM=LDAP, registry=LDAP for one user. Below are the ldap.cfg configurations -

Code:

ldapservers:xx.xx.xx.xx
binddn:cn=test
bindpwd:test
authtype:ldap_auth
useSSL:no
userattrmappath:/etc/security/ldap/2307aixuser.map
groupattrmappath:/etc/security/ldap/2307aixgroup.map
userbasedn:ou=People,ou=server1,ou=all_servers,o=test.com
groupbasedn:ou=Groups,ou=server1,ou=all_servers,o=test.com
userclasses:posixaccount,account,shadowaccount,aixauxaccount,ibm-securityIdentities
groupclasses:posixgroup,aixauxgroup
ldapport:489
cachetimeout: 0 
searchmode:ALL
defaultentrylocation:LDAP
serverschematype:rfc2307aix

Now when I start the secldapclntd daemon, I can see search and modify queries on the LDAP server audit logs. But no bind requests are coming from the client and the authentication fails and user gets "Access denied" message.

What is the reason that bind requests are not coming to server ? I have enabled audit log for all operations even for success cases.

Please help. Thanks in advance !

---------- Post updated at 11:52 AM ---------- Previous update was at 11:49 AM ----------

ldap.cfg file configurations with spaces to avoid smileys -

Code:

ldapservers:xx.xx.xx.xx
binddn:cn=test
bindpwd:test
authtype:ldap_auth
useSSL:no
userattrmappath:/etc/security/ldap/2307aixuser.map
groupattrmappath:/etc/security/ldap/2307aixgroup.map
userbasedn : ou=People,ou=server1,ou=all_servers,o=test.com
groupbasedn : ou=Groups,ou=server1,ou=all_servers,o=test.com
userclasses : posixaccount,account,shadowaccount,aixauxaccount,ibm-securityIdentities
groupclasses : posixgroup,aixauxgroup
ldapport:489
cachetimeout: 0
searchmode:ALL
defaultentrylocation:LDAP
serverschematype:rfc2307aix

Moderator's Comments:

Please use code tags. You can also "avoid using smilies" by using the Go Advanced button and checking the "Disable smilies in text" box in the Miscellaneous Options section.

I will have to check my notes, but I think it is caused by the authtype:ldap_auth option you are choosing. I recall having some issues with that.

Have you tried using a command like:

Code:

LDAP_SERVER=somehost
PWD=myPassword
...
mksecldap -c -h ${LDAP_SERVER} -a cn=aixtools -p ${PWD} -d cn=aixadmin

I do not have my test installation up at the moment, so I cannot check the authtype setting when using mksecldap command.

Hope this helps!

Thanks Michael, but if you see my ldap.cfg settings, I have already set it as ldap_auth.

I have it working on AIX 5.3, but does not work on 6.1

One more factor - the IDS server was already installed on my client unix server and has an instance running on it (which is used by another application). But for authentication, I point the unix server to a different instance on a different system.

Another small difference noticed - the IDS server filesets already installed in the server show level 6.2.0.16 (when used command lslpp -l), however the 32 bit client used by secldapclntd was missing. So I downloaded 6.2 IDS installer and installed the 32 bit client which shows level 6.2.0.0 (on command lslpp -l). Do you think this difference could matter ?

I do not want to change the existing IDS server filesets and also cannot find 32 bit client fix pack version 6.2.0.16

Please suggest !

And that is the error - I fear - see below. unix_auth is default
As one server can have multiple instances running, and the AIX client is designed to make queries from multiple DIT domains, each of which could be a different server, or the same server - I see no issues.
The only reason it "could" matter is if there is a bug. Initially, the 6.2 base was on the AIX 6.1 expansion disk - it is the default for AIX 7.1 (with 6.3 on the AIX 7.1 expansion disk) - until 6.3 becomes the default.

I did not pay that much attention to the versioning of LDAP the last years, but my understanding is that the servers support at their level and back level clients. So, again, except for a hard bug - I do not see any reason for an auth failure - other that what I ran into when experimenting with unix_auth and ldap_auth for the authtype setting.

ISS-ITDS-AIX 6.2.0 fixes
I tried the link above from two different browsers and they both seemed to work. This is a Fixcentral 'thing' so you may need to register before you can actually access the downloads.

Hope this helps!

From: AIX InfoCenter aixfiles:LDAP.CFG
I understand this to mean all password verification is done at the ldap server when using ldap_auth as authtype. Note also, the default is unix_auth (only the "hash" aka "encrypted" string is retrieved).
Using db2ldif -I instanceName (often the userid - hint) -o instance.ldif you should be able to examine what the LDAP server has stored.

In short, as a start, I would switch to unix_auth and see if you can start connecting as expected. Note: you may need to change the password before all the password encryption is "as expected" by AIX.

Hope this helps!

I changed the authtype to ldap_auth, restarted the secldapclntd, and ran command ls-secldapclntd to make sure that auth type is ldap_auth.

However, I am still not able to authenticate successfully. On the server side, the data imported in the LDAP instance is same data exported using sectoldif from the client system.

In the server audit log, I saw bind request only once for the user after restarting. Is there any way that I can debug secldapclntd on the client machine and see what requests it is sending ? I want to enable logging the AIX auth sub-system (requests from auth to LAM to secldapclntd to LDAP server) to find where the error is.

Does anyone know how to enable audit logging on the client side?

change the authtype to "unix_auth" - that is the default.

After you do that, and restart the daemon, do a pwdadm/passwd command to reset the password value stored on the ldap server