Solaris

Hi Gurus

I am a novice in LDAP and need to configure an LDAP client(Solaris 10).
The client has to bind to an AD for LDAP queries. I have created a user called testbind in AD for binding purpose.

I am planning to configure LDAP client manually(as the requirement is as such).

This is the script,which i believe will configure the client as an LDAP client.
Please correct me if i have put something wrong:


ldapclient manual \
-a credentialLevel=proxy \
-a authenticationMethod=simple \
-a proxyDN=cn=proxyuser,cn=testbind,dc=example,dc=com \
-a proxyPassword=password@123 \
-a defaultSearchBase=dc=example,dc=com \
-a domainName=example.com \
-a “defaultServerList=172.16.1.10” \
-a attributeMap=group:userpassword=userPassword \
-a attributeMap=group:memberuid=memberUid \
-a attributeMap=group:gidnumber=gidNumber \
-a attributeMap=passwd:gecos=cn \
-a attributeMap=passwd:gidnumber=gidNumber \
-a attributeMap=passwd:uidnumber=uidNumber \
-a attributeMap=passwd:homedirectory=unixHomeDirectory \
-a attributeMap=passwd:loginshell=loginShell \
-a attributeMap=shadow:shadowflag=shadowFlag \
-a attributeMap=shadow:userpassword=userPassword \
-a objectClassMap=grouposixGroup=group \
-a objectClassMap=passwdosixAccount=user \
-a objectClassMap=shadow:shadowAccount=user \
-a serviceSearchDescriptor=passwd:dc=example,dc=com?sub \
-a serviceSearchDescriptor=group:dc=example,dc=com?sub

The user for binding is "testbind"
The password for testbind user is "password@123".
The IP of domain controller is 172.16.1.10

I will be running this as a script once i correct any mistakes above.
Appreciate if you could guide me.

Thanks
HG

Have you installed a Unix plugin on the AD server? What LDAP schema are you using? These affect the names of the objects you are interested in on the AD server.

I have been involved in extended attempts to get Solaris 10 to integrate with AD and got it such that you could su to a user from root, but could not get user log in to work from dtlogin(1), via SSH or even login(1).

I have done something very similar to you in order to get the output from "ps -ef" to translate UIDs and GIDs to the username and group on Solaris 10, but the actual logon is being handled by a LDAP PAM and NSS libraries from PADL with NSCD disabled (see "ps -ef" below).

What ever you do you will need to amend /etc/nsswitch.conf and /etc/pam.conf to refer to LDAP or Kerberos where appropriate, note that the settings in pam.conf have changed for Solaris 10.

May I point you to Scott Lowe's series of article on this subject, an index of which is at: Active Directory Integration Index - blog.scottlowe.org - The weblog of an IT pro specializing in virtualization, storage, and servers ?

Tony,

Thanks for the reply.But you haven't cleared my doubts.

By the way, i am following scott lowe's blog on Solaris-AD integration to get my solaris servers integrated with AD. LDAP client config is one of the steps in the blog and i couldn't understand the way he(scott) has put it.
Infact the script i have pasted above is straight from his blog(except for the user"testbind"). But i was not too sure about whether i have been right with the customisations.

Now coming to ur questions....
Have you installed a Unix plugin on the AD server?
Yes,i have installed a unix plug-in and i am able to get the unix attributes for user..(i suppose that is what you are referring to..)

What LDAP schema are you using?
Honestly,i don't know what schema i am using. Can you enlighten me.

And i am aware that i have to edit the nsswitch.conf file and pam.conf file in the solaris end. But i believe when i run this script(ldapclient) the nsswitch.conf file automatically adds the ldap attribute to all services.

My confusion here, is how to configure my solaris client as an LDAP client. How to make the LDAP client bind with AD using a particular user and how to get it's queries answered.

Thanks
HG
What LDAP schema are you using?

Depending on what Unix plugin/LDAP schema you are using the object names on the AD server will vary, e.g.:

Code:

attributeMap: passwd:uid=msSFU30Name

Where the msFFU30Name is the name of the object in AD, if the object name is incorrect then the AD integration will not work (computers are picky like that!), the object names will vary depending on what Unix plugin you have installed so I imagine the object names will be documented in it and all need to be correct! The fact that you are getting user attributes back means you are not far off.

The testbind proxy user account needs to be a user in AD who has read permission for all the parts of the LDAP schema "tree" you need, it can be a non-interactive user but does need a password, i.e. the proxyPassword as you have shown.

Yes you are correct I was forgetting that the ldapclient(1m) command does copy /etc/nsswitch.ldap to /etc/nsswitch.conf.

Here is a posting elsewhere that talks about configuring the /etc/pam.conf file for LDAP: Solaris 10 pam.conf for LDAP authentication.

I can't remember what Unix plugin was used but that does not matter as long as you know what the Unix object names are called in AD.

Thanks for the guidance,Tony.

I managed to configure the LDAP client,but when i give an ldaplist,it returns an object not found error.

When i run this command:
ldapsearch -v -h 10.0.0.3 -b "dc=lxdc-india,dc=com" -D "cn=fis,cn=Users,dc=lxdc-india,dc=com" -w - "cn=administrator"
....and the bind password thereafter,

I am getting the following error:
ldap_simple_bind:Invalid Credentials.

I have rechecked the password for administrator,but still the same error.
Appreciate if you could throw some light.

Also,getent passwd is displaying my local passwd file.

Thanks
HG

Tony,

This was the LDAP client config script,i ran:

ldapclient manual \
-a credentialLevel=proxy \
-a authenticationMethod=simple \
-a proxyDN=cn=fis,cn=users,dc=lxdc-india,dc=com \
-a proxyPassword=efunds_15 \
-a defaultSearchBase=dc=lxdc-india,dc=com \
-a domainName=lxdc-india.com \
-a “defaultServerList=10.0.0.3" \
-a attributeMap=group:userpassword=msSFU30Password \
-a attributeMap=group:memberuid=msSFU30MemberUid \
-a attributeMap=group:gidnumber=msSFU30GidNumber \
-a attributeMap=passwd:gecos=msSFU30Gecos \
-a attributeMap=passwd:gidnumber=msSFU30GidNumber \
-a attributeMap=passwd:uidnumber=msSFU30UidNumber \
-a attributeMap=passwd:homedirectory=msSFU30HomeDirectory \
-a attributeMap=passwd:loginshell=msSFU30LoginShell \
-a attributeMap=shadow:shadowflag=msSFU30ShadowFlag \
-a attributeMap=shadow:userpassword=msSFU30Password \
-a objectClassMap=grouposixGroup=group \
-a objectClassMap=passwdosixAccount=user \
-a objectClassMap=shadow:shadowAccount=user \
-a serviceSearchDescriptor=passwd:dc=lxdc-india,dc=com?sub \
-a serviceSearchDescriptor=group:dc=lxdc-india,dc=com?sub

Thanks
HG

Getting:

Code:

ldap_simple_bind:Invalid Credentials.

Means that either the proxy user or proxy password is incorrect:

Looking at examples the fact that your ProxyDN does not specify an ou may be significant, e.g.:

Code:

# ldapclient -v init -a proxyDN=cn=fake,ou=People,dc=example,dc=com

from: Solaris LDAP client with OpenLDAP server - Docupedia

and:

Code:

# ldapclient init -a proxyDN=cn=proxyagent,ou=profile,dc=const,dc=lan

from: http://forums.sun.com/thread.jspa?th...832&tstart=135