LDAP client config.


 
Thread Tools Search this Thread
Operating Systems Solaris LDAP client config.
# 1  
Old 04-03-2009
LDAP client config.

Hi Gurus

I am a novice in LDAP and need to configure an LDAP client(Solaris 10).
The client has to bind to an AD for LDAP queries. I have created a user called testbind in AD for binding purpose.

I am planning to configure LDAP client manually(as the requirement is as such).

This is the script,which i believe will configure the client as an LDAP client.
Please correct me if i have put something wrong:


ldapclient manual \
-a credentialLevel=proxy \
-a authenticationMethod=simple \
-a proxyDN=cn=proxyuser,cn=testbind,dc=example,dc=com \
-a proxyPassword=password@123 \
-a defaultSearchBase=dc=example,dc=com \
-a domainName=example.com \
-a “defaultServerList=172.16.1.10” \
-a attributeMap=group:userpassword=userPassword \
-a attributeMap=group:memberuid=memberUid \
-a attributeMap=group:gidnumber=gidNumber \
-a attributeMap=passwd:gecos=cn \
-a attributeMap=passwd:gidnumber=gidNumber \
-a attributeMap=passwd:uidnumber=uidNumber \
-a attributeMap=passwd:homedirectory=unixHomeDirectory \
-a attributeMap=passwd:loginshell=loginShell \
-a attributeMap=shadow:shadowflag=shadowFlag \
-a attributeMap=shadow:userpassword=userPassword \
-a objectClassMap=groupSmilieosixGroup=group \
-a objectClassMap=passwdSmilieosixAccount=user \
-a objectClassMap=shadow:shadowAccount=user \
-a serviceSearchDescriptor=passwd:dc=example,dc=com?sub \
-a serviceSearchDescriptor=group:dc=example,dc=com?sub

The user for binding is "testbind"
The password for testbind user is "password@123".
The IP of domain controller is 172.16.1.10

I will be running this as a script once i correct any mistakes above.
Appreciate if you could guide me.

Thanks
HG
# 2  
Old 04-05-2009
Have you installed a Unix plugin on the AD server? What LDAP schema are you using? These affect the names of the objects you are interested in on the AD server.

I have been involved in extended attempts to get Solaris 10 to integrate with AD and got it such that you could su to a user from root, but could not get user log in to work from dtlogin(1), via SSH or even login(1).

I have done something very similar to you in order to get the output from "ps -ef" to translate UIDs and GIDs to the username and group on Solaris 10, but the actual logon is being handled by a LDAP PAM and NSS libraries from PADL with NSCD disabled (see "ps -ef" below).

What ever you do you will need to amend /etc/nsswitch.conf and /etc/pam.conf to refer to LDAP or Kerberos where appropriate, note that the settings in pam.conf have changed for Solaris 10.

May I point you to Scott Lowe's series of article on this subject, an index of which is at: Active Directory Integration Index - blog.scottlowe.org - The weblog of an IT pro specializing in virtualization, storage, and servers ?

Last edited by TonyFullerMalv; 04-05-2009 at 05:20 PM..
# 3  
Old 04-06-2009
Tony,

Thanks for the reply.But you haven't cleared my doubts.

By the way, i am following scott lowe's blog on Solaris-AD integration to get my solaris servers integrated with AD. LDAP client config is one of the steps in the blog and i couldn't understand the way he(scott) has put it.
Infact the script i have pasted above is straight from his blog(except for the user"testbind"). But i was not too sure about whether i have been right with the customisations.

Now coming to ur questions....
Have you installed a Unix plugin on the AD server?
Yes,i have installed a unix plug-in and i am able to get the unix attributes for user..(i suppose that is what you are referring to..)

What LDAP schema are you using?
Honestly,i don't know what schema i am using. Can you enlighten me.

And i am aware that i have to edit the nsswitch.conf file and pam.conf file in the solaris end. But i believe when i run this script(ldapclient) the nsswitch.conf file automatically adds the ldap attribute to all services.

My confusion here, is how to configure my solaris client as an LDAP client. How to make the LDAP client bind with AD using a particular user and how to get it's queries answered.

Thanks
HG
What LDAP schema are you using?
# 4  
Old 04-06-2009
Depending on what Unix plugin/LDAP schema you are using the object names on the AD server will vary, e.g.:
Code:
attributeMap: passwd:uid=msSFU30Name

Where the msFFU30Name is the name of the object in AD, if the object name is incorrect then the AD integration will not work (computers are picky like that!), the object names will vary depending on what Unix plugin you have installed so I imagine the object names will be documented in it and all need to be correct! The fact that you are getting user attributes back means you are not far off.

The testbind proxy user account needs to be a user in AD who has read permission for all the parts of the LDAP schema "tree" you need, it can be a non-interactive user but does need a password, i.e. the proxyPassword as you have shown.

Yes you are correct I was forgetting that the ldapclient(1m) command does copy /etc/nsswitch.ldap to /etc/nsswitch.conf.

Here is a posting elsewhere that talks about configuring the /etc/pam.conf file for LDAP: Solaris 10 pam.conf for LDAP authentication.

I can't remember what Unix plugin was used but that does not matter as long as you know what the Unix object names are called in AD.
# 5  
Old 04-07-2009
Thanks for the guidance,Tony.

I managed to configure the LDAP client,but when i give an ldaplist,it returns an object not found error.

When i run this command:
ldapsearch -v -h 10.0.0.3 -b "dc=lxdc-india,dc=com" -D "cn=fis,cn=Users,dc=lxdc-india,dc=com" -w - "cn=administrator"
....and the bind password thereafter,

I am getting the following error:
ldap_simple_bind:Invalid Credentials.

I have rechecked the password for administrator,but still the same error.
Appreciate if you could throw some light.

Also,getent passwd is displaying my local passwd file.

Thanks
HG
# 6  
Old 04-07-2009
Tony,

This was the LDAP client config script,i ran:

ldapclient manual \
-a credentialLevel=proxy \
-a authenticationMethod=simple \
-a proxyDN=cn=fis,cn=users,dc=lxdc-india,dc=com \
-a proxyPassword=efunds_15 \
-a defaultSearchBase=dc=lxdc-india,dc=com \
-a domainName=lxdc-india.com \
-a “defaultServerList=10.0.0.3" \
-a attributeMap=group:userpassword=msSFU30Password \
-a attributeMap=group:memberuid=msSFU30MemberUid \
-a attributeMap=group:gidnumber=msSFU30GidNumber \
-a attributeMap=passwd:gecos=msSFU30Gecos \
-a attributeMap=passwd:gidnumber=msSFU30GidNumber \
-a attributeMap=passwd:uidnumber=msSFU30UidNumber \
-a attributeMap=passwd:homedirectory=msSFU30HomeDirectory \
-a attributeMap=passwd:loginshell=msSFU30LoginShell \
-a attributeMap=shadow:shadowflag=msSFU30ShadowFlag \
-a attributeMap=shadow:userpassword=msSFU30Password \
-a objectClassMap=groupSmilieosixGroup=group \
-a objectClassMap=passwdSmilieosixAccount=user \
-a objectClassMap=shadow:shadowAccount=user \
-a serviceSearchDescriptor=passwd:dc=lxdc-india,dc=com?sub \
-a serviceSearchDescriptor=group:dc=lxdc-india,dc=com?sub

Thanks
HG
# 7  
Old 04-07-2009
Getting:
Code:
ldap_simple_bind:Invalid Credentials.

Means that either the proxy user or proxy password is incorrect:

Looking at examples the fact that your ProxyDN does not specify an ou may be significant, e.g.:
Code:
# ldapclient -v init -a proxyDN=cn=fake,ou=People,dc=example,dc=com

from: Solaris LDAP client with OpenLDAP server - Docupedia

and:

Code:
# ldapclient init -a proxyDN=cn=proxyagent,ou=profile,dc=const,dc=lan

from: http://forums.sun.com/thread.jspa?th...832&tstart=135
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Solaris

LDAP Client not connecting to LDAP server

I have very limited knowledge on LDAP configuration and have been trying fix one issue, but unsuccessful. The server, I am working on, is Solaris-10 zone. sudoers is configured on LDAP (its not on local server). I have access to login directly on server with root, but somehow sudo is not working... (9 Replies)
Discussion started by: solaris_1977
9 Replies

2. Solaris

LDAP server and client configuration in Solaris 10

How do i install ldap server and client in solaris server how to configure ldap server and client please help me (1 Reply)
Discussion started by: ainstin
1 Replies

3. AIX

AIX 5.2 ldap client AD

I have been able to configure on an AIX 5.2 ldap.cfg so service starts correctly. but when I try to log on with a windows user after entering the password login hangs and get no response. I have set it up on Aix 5.3 with no problem but in Aix 5.2 I have not been able to log in. ldap.cfg... (1 Reply)
Discussion started by: laxtnog
1 Replies

4. AIX

LDAP authentication client issue

Hi, I am trying to authenticate AIX server against a IDS LDAP instance. The AIX version is 6.1 and TDS client is 6.1. I configured the secldapclntd using ldap.cfg file and changed /etc/security/user to set SYSTEM=LDAP, registry=LDAP for one user. Below are the ldap.cfg configurations - ... (5 Replies)
Discussion started by: vs1
5 Replies

5. UNIX and Linux Applications

User Based LDAP Client Access

Hi everyone, I am not that familiar with LDAP advanced contents. But since it is a popular secure tool for authentication, I preferred to user RedHat LDAP. The organization has 5 organizational units. There are 3 client servers and I want to limit each client to access different users. So, I... (3 Replies)
Discussion started by: royalliege
3 Replies

6. UNIX for Advanced & Expert Users

LDAP client issue

Hello, I'm new to Centos and to openldap. I am by trade a Solaris Admin. I'm experimenting with openldap and thought Linux would be easier to install and setup openldap on, so far this is true. The problem I'm having is that I can't get the client server to authenticate to the openldap server. I... (1 Reply)
Discussion started by: bitlord
1 Replies

7. Solaris

LDAP client config GSSAPI

Configure ldap client: I have configured my ldapclient with the AuthenticationMethod=simple and with the credentialLevel=proxy. However, as soon as i want to set the AuthenticationMethod=sasl/GSSAPI, and credentiallevel=self, then it fails to configure. Kerberos is already setup successfully. The... (0 Replies)
Discussion started by: Henk Trumpie
0 Replies

8. Solaris

Empty LDAP client file

Hi All, I am getting one strange problem of empty LDAP_client_ file. There was one /var 100% overload issue few days back. After that we are observing this new issue. I got to know about similar issue SunSolve Bug ID 6495683 - “LDAP client files & cred files are deleted when /var is full”... (1 Reply)
Discussion started by: ailnilanjan
1 Replies

9. AIX

Where to download ldap.client lpp

Hello, I am trying to configure an AIX machina to authenticate against a Windows 2003 AD, and I am desesperately trying to find the ldap.client lpp in the internet. I am using AIX 5.3 and I don't have access to the DVD media, please help! Thankyou, Tiago (2 Replies)
Discussion started by: tiagoskid
2 Replies

10. UNIX for Dummies Questions & Answers

AIX v5.3 LDAP CLIENT and AD

Has anyone successfully authenticated unix users via Active Directory using LDAP client on AIX v5.2 or v5.3?? ldapsearch from our unix box retrieves info from AD but having trouble authenticating unix id when I logon - get a msg ': 3004-318 Error obtaining the user's password information'. Not... (0 Replies)
Discussion started by: DANNYC
0 Replies
Login or Register to Ask a Question

Featured Tech Videos