Pam_ldap and nss_ldap

hello !
i made and put two packages in incoming: pam_ldap and nss_ldap
LDAP authentication is now possible with Arch !
Comete
# Contributor: Comete <[email protected]>
pkgname=pam_ldap
pkgver=167
pkgrel=1
pkgdesc="The pam_ldap module provides the means for Solaris and Linux workstations to authenticate against LDAP directories, and to change
their passwords in the directory."
url="http://www.padl.com/OSS/pam_ldap.html"
depends=('pam')
makedepends=('pam')
conflicts=()
replaces=()
backup=('/etc/pam_ldap.conf')
install=
source=(http://www.padl.com/download/$pkgname.tgz)
md5sums=()
build() {
cd $startdir/src/$pkgname-$pkgver
./configure
--libdir=/lib
--with-ldap-conf-file=/etc/pam_ldap.conf
make || return 1
make prefix=$startdir/pkg/usr install
md5sums=('05bc1ae27087583e20d948659c6b0d61')
# Contributor: Comete <[email protected]>
pkgname=nss_ldap
pkgver=212
pkgrel=1
pkgdesc="The nss_ldap module provides the means for Linux and Solaris workstations to resolve the entities defined in RFC 2307 from LDAP d
irectories."
url="http://www.padl.com/OSS/nss_ldap.html"
depends=('pam')
makedepends=('pam')
conflicts=()
replaces=()
backup=('/etc/libnss-ldap.conf')
install=
source=(http://www.padl.com/download/$pkgname.tgz)
md5sums=()
build() {
cd $startdir/src/$pkgname-$pkgver
./configure
--with-ldap-conf-file=/etc/libnss-ldap.conf
--with-ldap=openldap
--libdir=/lib
--enable-schema-mapping
--enable-rfc2307bis
make || return 1
make prefix=$startdir/pkg/usr install
md5sums=('707869f5bde25145d29f84f7ff591d9f')

Also make sure to start nscd on bootup. Otherwise your LDAP server will get many queries. A simple ls -la in your homedirectory will generate a query for each file in it.
Also, if you don't run nscd, pacman will segfault on synching packagelists, because it's statical linked to NSS.

Similar Messages

  • Solaris 8, pam_ldap and SSL/TLS

    Has anyone got the experience of compiling and installing pam_ldap (padl version) with ssl/tls support on Solaris 8? I tried compiling pam_ldap with Netscape LDAP SDK, but it failed to compile ldap_ssl.h . So I am wondering... is that something I can do on solaris 8? (I am using iDS 5.1)
    Error received on compilation:
    # ./configure with-ldap-lib=netscape5 with-ldap-dir=/ldapsdk
    loading cache ../config.cache
    checking host system type... sparc-sun-solaris2.8
    checking target system type... sparc-sun-solaris2.8
    checking build system type... sparc-sun-solaris2.8
    checking for a BSD compatible install... ../install-sh -c
    checking whether build environment is sane... yes
    checking for mawk... no
    checking for gawk... no
    checking for nawk... nawk
    checking whether make sets ${MAKE}... yes
    checking for working aclocal... missing
    checking for working autoconf... found
    checking for working automake... missing
    checking for working autoheader... found
    checking for working makeinfo... missing
    checking for gnutar... no
    checking for gtar... no
    checking for tar... tar
    checking for gcc... gcc
    checking whether the C compiler (gcc ) works... yes
    checking whether the C compiler (gcc ) is a cross-compiler... no
    checking whether we are using GNU C... yes
    checking whether gcc accepts -g... yes
    checking how to run the C preprocessor... gcc -E
    checking for a BSD compatible install... ../install-sh -c
    checking for security/pam_appl.h... yes
    checking for security/pam_misc.h... no
    checking for security/pam_modules.h... yes
    checking for pam/pam_appl.h... no
    checking for pam/pam_misc.h... no
    checking for pam/pam_modules.h... no
    checking for des.h... no
    checking for crypt.h... yes
    checking for lber.h... yes
    checking for ldap.h... yes
    checking for ldap_ssl.h... yes
    checking for main in -ldl... yes
    checking for main in -lpam... yes
    checking for main in -lresolv... yes
    checking for main in -lcrypt... yes
    checking for main in -lnsl... yes
    checking for gethostbyname... yes
    checking for main in -lldap50... yes
    checking for main in -lpthread... yes
    checking for ldap_init... yes
    checking for ldap_get_lderrno... yes
    checking for ldap_set_lderrno... yes
    checking for ldap_parse_result... yes
    checking for ldap_memfree... yes
    checking for ldap_controls_free... yes
    checking for ldap_set_option... yes
    checking for ldap_get_option... yes
    checking for ldapssl_init... yes
    checking for ldap_start_tls_s... no
    checking for ldap_pvt_tls_set_option... no
    checking for ldap_initialize... no
    checking for gethostbyname_r... yes
    checking whether gethostbyname_r takes 6 arguments... 5
    checking for ldap_set_rebind_proc... yes
    checking whether ldap_set_rebind_proc takes 3 arguments... 3
    updating cache ../config.cache
    creating ./config.status
    creating Makefile
    creating config.h
    # make
    cd . && /padl/pam_ldap-161/missing aclocal
    WARNING: `aclocal' is missing on your system. You should only need it if
    you modified `acinclude.m4' or `configure.in'. You might want
    to install the `Automake' and `Perl' packages. Grab them from
    any GNU archive site.
    cd . && /padl/pam_ldap-161/missing automake --gnu Makefile
    WARNING: `automake' is missing on your system. You should only need it if
    you modified `Makefile.am', `acinclude.m4' or `configure.in'.
    You might want to install the `Automake' and `Perl' packages.
    Grab them from any GNU archive site.
    cd . && autoconf
    /bin/sh ../config.status --recheck
    running /bin/sh ./configure with-ldap-lib=netscape5 with-ldap-dir=/ldapsdk no-create no-recursion
    checking build system type... sparc-sun-solaris2.8
    checking host system type... sparc-sun-solaris2.8
    checking target system type... sparc-sun-solaris2.8
    checking for a BSD-compatible install... ../install-sh -c
    checking whether build environment is sane... yes
    checking for gawk... no
    checking for mawk... no
    checking for nawk... nawk
    checking whether make sets $(MAKE)... yes
    checking for working aclocal... missing
    checking for working autoconf... found
    checking for working automake... missing
    checking for working autoheader... found
    checking for working makeinfo... missing
    checking for gnutar... no
    checking for gtar... no
    checking for tar... tar
    checking for gcc... gcc
    checking for C compiler default output... a.out
    checking whether the C compiler works... yes
    checking whether we are cross compiling... no
    checking for suffix of executables...
    checking for suffix of object files... o
    checking whether we are using the GNU C compiler... yes
    checking whether gcc accepts -g... yes
    checking for gcc option to accept ANSI C... none needed
    checking how to run the C preprocessor... gcc -E
    checking for a BSD-compatible install... ../install-sh -c
    checking for egrep... egrep
    checking for ANSI C header files... yes
    checking for sys/types.h... yes
    checking for sys/stat.h... yes
    checking for stdlib.h... yes
    checking for string.h... yes
    checking for memory.h... yes
    checking for strings.h... yes
    checking for inttypes.h... yes
    checking for stdint.h... no
    checking for unistd.h... yes
    checking security/pam_appl.h usability... yes
    checking security/pam_appl.h presence... yes
    checking for security/pam_appl.h... yes
    checking security/pam_misc.h usability... no
    checking security/pam_misc.h presence... no
    checking for security/pam_misc.h... no
    checking security/pam_modules.h usability... no
    checking security/pam_modules.h presence... yes
    configure: WARNING: security/pam_modules.h: present but cannot be compiled
    configure: WARNING: security/pam_modules.h: check for missing prerequisite headers?
    configure: WARNING: security/pam_modules.h: proceeding with the preprocessor's result
    configure: WARNING: ## ------------------------------------ ##
    configure: WARNING: ## Report this to [email protected]. ##
    configure: WARNING: ## ------------------------------------ ##
    checking for security/pam_modules.h... yes
    checking pam/pam_appl.h usability... no
    checking pam/pam_appl.h presence... no
    checking for pam/pam_appl.h... no
    checking pam/pam_misc.h usability... no
    checking pam/pam_misc.h presence... no
    checking for pam/pam_misc.h... no
    checking pam/pam_modules.h usability... no
    checking pam/pam_modules.h presence... no
    checking for pam/pam_modules.h... no
    checking des.h usability... no
    checking des.h presence... no
    checking for des.h... no
    checking crypt.h usability... yes
    checking crypt.h presence... yes
    checking for crypt.h... yes
    checking lber.h usability... yes
    checking lber.h presence... yes
    checking for lber.h... yes
    checking ldap.h usability... yes
    checking ldap.h presence... yes
    checking for ldap.h... yes
    checking ldap_ssl.h usability... no
    checking ldap_ssl.h presence... yes
    configure: WARNING: ldap_ssl.h: present but cannot be compiled
    configure: WARNING: ldap_ssl.h: check for missing prerequisite headers?
    configure: WARNING: ldap_ssl.h: proceeding with the preprocessor's result
    configure: WARNING: ## ------------------------------------ ##
    configure: WARNING: ## Report this to [email protected]. ##
    configure: WARNING: ## ------------------------------------ ##
    checking for ldap_ssl.h... yes
    checking for main in -ldl... yes
    checking for main in -lpam... yes
    checking for main in -lresolv... yes
    checking for main in -lcrypt... yes
    checking for main in -lnsl... yes
    checking for gethostbyname... yes
    checking for main in -lldap50... yes
    checking for main in -lpthread... yes
    checking for ldap_init... yes
    checking for ldap_get_lderrno... yes
    checking for ldap_set_lderrno... yes
    checking for ldap_parse_result... yes
    checking for ldap_memfree... yes
    checking for ldap_controls_free... yes
    checking for ldap_set_option... yes
    checking for ldap_get_option... yes
    checking for ldapssl_init... yes
    checking for ldap_start_tls_s... no
    checking for ldap_pvt_tls_set_option... no
    checking for ldap_initialize... no
    checking for gethostbyname_r... yes
    checking whether gethostbyname_r takes 6 arguments... 5
    checking for ldap_set_rebind_proc... yes
    checking whether ldap_set_rebind_proc takes 3 arguments... 3
    configure: creating ../config.status
    cd . \
    && CONFIG_FILES=Makefile CONFIG_HEADERS= /bin/sh ./config.status
    config.status: creating Makefile
    config.status: executing default-1 commands
    gcc -DHAVE_CONFIG_H -DLDAP_REFERRALS -D_REENTRANT -I/ldapsdk/include -g -O2 -Wall -fPIC -c -o pam_ldap.o pam_ldap.c
    gcc -DHAVE_CONFIG_H -DLDAP_REFERRALS -D_REENTRANT -I/ldapsdk/include -g -O2 -Wall -fPIC -c -o md5.o md5.c
    /usr/ccs/bin/ld -o pam_ldap.so -B dynamic -M ../exports.solaris -G -B group -lc -L/ldapsdk/lib -R/ldapsdk/lib pam_ldap.o md5.o -lpthread -lldap50 -lssldap50 -lssl3 -lnss3 -lnspr4 -lprldap50 -lplc4 -lplds4 -lnsl -lcrypt -lresolv -lpam -ldl
    cd . && autoheader
    WARNING: Using auxiliary files such as `acconfig.h', `config.h.bot'
    WARNING: and `config.h.top', to define templates for `config.h.in'
    WARNING: is deprecated and discouraged.
    WARNING: Using the third argument of `AC_DEFINE' and
    WARNING: `AC_DEFINE_UNQUOTED' allows to define a template without
    WARNING: `acconfig.h':
    WARNING: AC_DEFINE([NEED_MAIN], 1,
    WARNING: [Define if a function `main' is needed.])
    WARNING: More sophisticated templates can also be produced, see the
    WARNING: documentation.
    cd . \
    && CONFIG_FILES= CONFIG_HEADERS=config.h \
    /bin/bash ../config.status
    config.status: creating config.h
    config.status: executing default-1 commands

    Has anyone got the experience of compiling and installing pam_ldap (padl version) with ssl/tls support on Solaris 8? I tried compiling pam_ldap with Netscape LDAP SDK, but it failed to compile ldap_ssl.h . So I am wondering... is that something I can do on solaris 8? (I am using iDS 5.1)
    Error received on compilation:
    # ./configure with-ldap-lib=netscape5 with-ldap-dir=/ldapsdk
    loading cache ../config.cache
    checking host system type... sparc-sun-solaris2.8
    checking target system type... sparc-sun-solaris2.8
    checking build system type... sparc-sun-solaris2.8
    checking for a BSD compatible install... ../install-sh -c
    checking whether build environment is sane... yes
    checking for mawk... no
    checking for gawk... no
    checking for nawk... nawk
    checking whether make sets ${MAKE}... yes
    checking for working aclocal... missing
    checking for working autoconf... found
    checking for working automake... missing
    checking for working autoheader... found
    checking for working makeinfo... missing
    checking for gnutar... no
    checking for gtar... no
    checking for tar... tar
    checking for gcc... gcc
    checking whether the C compiler (gcc ) works... yes
    checking whether the C compiler (gcc ) is a cross-compiler... no
    checking whether we are using GNU C... yes
    checking whether gcc accepts -g... yes
    checking how to run the C preprocessor... gcc -E
    checking for a BSD compatible install... ../install-sh -c
    checking for security/pam_appl.h... yes
    checking for security/pam_misc.h... no
    checking for security/pam_modules.h... yes
    checking for pam/pam_appl.h... no
    checking for pam/pam_misc.h... no
    checking for pam/pam_modules.h... no
    checking for des.h... no
    checking for crypt.h... yes
    checking for lber.h... yes
    checking for ldap.h... yes
    checking for ldap_ssl.h... yes
    checking for main in -ldl... yes
    checking for main in -lpam... yes
    checking for main in -lresolv... yes
    checking for main in -lcrypt... yes
    checking for main in -lnsl... yes
    checking for gethostbyname... yes
    checking for main in -lldap50... yes
    checking for main in -lpthread... yes
    checking for ldap_init... yes
    checking for ldap_get_lderrno... yes
    checking for ldap_set_lderrno... yes
    checking for ldap_parse_result... yes
    checking for ldap_memfree... yes
    checking for ldap_controls_free... yes
    checking for ldap_set_option... yes
    checking for ldap_get_option... yes
    checking for ldapssl_init... yes
    checking for ldap_start_tls_s... no
    checking for ldap_pvt_tls_set_option... no
    checking for ldap_initialize... no
    checking for gethostbyname_r... yes
    checking whether gethostbyname_r takes 6 arguments... 5
    checking for ldap_set_rebind_proc... yes
    checking whether ldap_set_rebind_proc takes 3 arguments... 3
    updating cache ../config.cache
    creating ./config.status
    creating Makefile
    creating config.h
    # make
    cd . && /padl/pam_ldap-161/missing aclocal
    WARNING: `aclocal' is missing on your system. You should only need it if
    you modified `acinclude.m4' or `configure.in'. You might want
    to install the `Automake' and `Perl' packages. Grab them from
    any GNU archive site.
    cd . && /padl/pam_ldap-161/missing automake --gnu Makefile
    WARNING: `automake' is missing on your system. You should only need it if
    you modified `Makefile.am', `acinclude.m4' or `configure.in'.
    You might want to install the `Automake' and `Perl' packages.
    Grab them from any GNU archive site.
    cd . && autoconf
    /bin/sh ../config.status --recheck
    running /bin/sh ./configure with-ldap-lib=netscape5 with-ldap-dir=/ldapsdk no-create no-recursion
    checking build system type... sparc-sun-solaris2.8
    checking host system type... sparc-sun-solaris2.8
    checking target system type... sparc-sun-solaris2.8
    checking for a BSD-compatible install... ../install-sh -c
    checking whether build environment is sane... yes
    checking for gawk... no
    checking for mawk... no
    checking for nawk... nawk
    checking whether make sets $(MAKE)... yes
    checking for working aclocal... missing
    checking for working autoconf... found
    checking for working automake... missing
    checking for working autoheader... found
    checking for working makeinfo... missing
    checking for gnutar... no
    checking for gtar... no
    checking for tar... tar
    checking for gcc... gcc
    checking for C compiler default output... a.out
    checking whether the C compiler works... yes
    checking whether we are cross compiling... no
    checking for suffix of executables...
    checking for suffix of object files... o
    checking whether we are using the GNU C compiler... yes
    checking whether gcc accepts -g... yes
    checking for gcc option to accept ANSI C... none needed
    checking how to run the C preprocessor... gcc -E
    checking for a BSD-compatible install... ../install-sh -c
    checking for egrep... egrep
    checking for ANSI C header files... yes
    checking for sys/types.h... yes
    checking for sys/stat.h... yes
    checking for stdlib.h... yes
    checking for string.h... yes
    checking for memory.h... yes
    checking for strings.h... yes
    checking for inttypes.h... yes
    checking for stdint.h... no
    checking for unistd.h... yes
    checking security/pam_appl.h usability... yes
    checking security/pam_appl.h presence... yes
    checking for security/pam_appl.h... yes
    checking security/pam_misc.h usability... no
    checking security/pam_misc.h presence... no
    checking for security/pam_misc.h... no
    checking security/pam_modules.h usability... no
    checking security/pam_modules.h presence... yes
    configure: WARNING: security/pam_modules.h: present but cannot be compiled
    configure: WARNING: security/pam_modules.h: check for missing prerequisite headers?
    configure: WARNING: security/pam_modules.h: proceeding with the preprocessor's result
    configure: WARNING: ## ------------------------------------ ##
    configure: WARNING: ## Report this to [email protected]. ##
    configure: WARNING: ## ------------------------------------ ##
    checking for security/pam_modules.h... yes
    checking pam/pam_appl.h usability... no
    checking pam/pam_appl.h presence... no
    checking for pam/pam_appl.h... no
    checking pam/pam_misc.h usability... no
    checking pam/pam_misc.h presence... no
    checking for pam/pam_misc.h... no
    checking pam/pam_modules.h usability... no
    checking pam/pam_modules.h presence... no
    checking for pam/pam_modules.h... no
    checking des.h usability... no
    checking des.h presence... no
    checking for des.h... no
    checking crypt.h usability... yes
    checking crypt.h presence... yes
    checking for crypt.h... yes
    checking lber.h usability... yes
    checking lber.h presence... yes
    checking for lber.h... yes
    checking ldap.h usability... yes
    checking ldap.h presence... yes
    checking for ldap.h... yes
    checking ldap_ssl.h usability... no
    checking ldap_ssl.h presence... yes
    configure: WARNING: ldap_ssl.h: present but cannot be compiled
    configure: WARNING: ldap_ssl.h: check for missing prerequisite headers?
    configure: WARNING: ldap_ssl.h: proceeding with the preprocessor's result
    configure: WARNING: ## ------------------------------------ ##
    configure: WARNING: ## Report this to [email protected]. ##
    configure: WARNING: ## ------------------------------------ ##
    checking for ldap_ssl.h... yes
    checking for main in -ldl... yes
    checking for main in -lpam... yes
    checking for main in -lresolv... yes
    checking for main in -lcrypt... yes
    checking for main in -lnsl... yes
    checking for gethostbyname... yes
    checking for main in -lldap50... yes
    checking for main in -lpthread... yes
    checking for ldap_init... yes
    checking for ldap_get_lderrno... yes
    checking for ldap_set_lderrno... yes
    checking for ldap_parse_result... yes
    checking for ldap_memfree... yes
    checking for ldap_controls_free... yes
    checking for ldap_set_option... yes
    checking for ldap_get_option... yes
    checking for ldapssl_init... yes
    checking for ldap_start_tls_s... no
    checking for ldap_pvt_tls_set_option... no
    checking for ldap_initialize... no
    checking for gethostbyname_r... yes
    checking whether gethostbyname_r takes 6 arguments... 5
    checking for ldap_set_rebind_proc... yes
    checking whether ldap_set_rebind_proc takes 3 arguments... 3
    configure: creating ../config.status
    cd . \
    && CONFIG_FILES=Makefile CONFIG_HEADERS= /bin/sh ./config.status
    config.status: creating Makefile
    config.status: executing default-1 commands
    gcc -DHAVE_CONFIG_H -DLDAP_REFERRALS -D_REENTRANT -I/ldapsdk/include -g -O2 -Wall -fPIC -c -o pam_ldap.o pam_ldap.c
    gcc -DHAVE_CONFIG_H -DLDAP_REFERRALS -D_REENTRANT -I/ldapsdk/include -g -O2 -Wall -fPIC -c -o md5.o md5.c
    /usr/ccs/bin/ld -o pam_ldap.so -B dynamic -M ../exports.solaris -G -B group -lc -L/ldapsdk/lib -R/ldapsdk/lib pam_ldap.o md5.o -lpthread -lldap50 -lssldap50 -lssl3 -lnss3 -lnspr4 -lprldap50 -lplc4 -lplds4 -lnsl -lcrypt -lresolv -lpam -ldl
    cd . && autoheader
    WARNING: Using auxiliary files such as `acconfig.h', `config.h.bot'
    WARNING: and `config.h.top', to define templates for `config.h.in'
    WARNING: is deprecated and discouraged.
    WARNING: Using the third argument of `AC_DEFINE' and
    WARNING: `AC_DEFINE_UNQUOTED' allows to define a template without
    WARNING: `acconfig.h':
    WARNING: AC_DEFINE([NEED_MAIN], 1,
    WARNING: [Define if a function `main' is needed.])
    WARNING: More sophisticated templates can also be produced, see the
    WARNING: documentation.
    cd . \
    && CONFIG_FILES= CONFIG_HEADERS=config.h \
    /bin/bash ../config.status
    config.status: creating config.h
    config.status: executing default-1 commands

  • Solaris pam_ldap and passwordless logins

    Dear all,
    http://docs.sun.com/app/docs/doc/816-4556/6maort2te?a=view
    states:
    After you enable pam_ldap account management, all users must provide a password any time they log in to the system. A login password is required for authentication. Therefore, nonpassword-based logins using tools such as rsh, rlogin, or ssh will fail.
    Can somebody confirm that this is really true?
    Background:
    We are using shosts.equiv, which worked fine with NIS. Now we switched to LDAP and everything works fine -- except passwordless logins. Password-based logins work fine. But passwordless (publickey or shosts) gives this message in /var/adm/messages:
    sshd[9023]: [ID 778364 auth.warning] libsldap: server xx.xx.xx.xx does not provide account information without passwordDoes anybody see a chance of getting passwordless logins with pam_ldap to work at all?
    Cheers,
    Jan

    I don't know if LPK (LDAP Public Key) helps, pls try and let us know.
    http://www.opendarwin.org/en/projects/openssh-lpk/
    (google "ldap public key")
    Gary

  • Issue with pam_ldap and referrals

    I'm currently running into a problem where pam_ldap is complaining about a bad referral when trying to make password changes. Here the debug output from /var/adm/messages
    Jun 10 18:25:53 ldapclnt passwd[761]: [ID 545954 user.error] libsldap: Invalid or non-LDAP URL when processing referrals URL: ldap://sea-d-ldap1.xypoint.com:389
    Jun 10 18:25:53 ldapclnt passwd[761]: [ID 293258 user.error] libsldap: Status: 0 Mesg: Internal write State machine exit (state = 14, rc = 0).
    Currently we are set up with Directory Server 5 packaged with Solaris 9. We have a multi-master setup with 2 machines being masters and one machine being consumers. The ldap_pam is setup so that it will follow referrals and will use the consumer ldap as it's primary authentication store.
    I'm a bit suspicious of the ldap URL's that are getting returned from the server as doing an LDAP modify doesn't work either. When doing ldapmodify -v -R here is what I get returned.
    bash-2.05$ ./ldapmodify -v -R -D "cn=Directory Manager" -w password
    ldapmodify: started Wed Jun 11 10:50:46 2003
    ldap_init( localhost, 389 )
    dn: uid=nada,ou=people,dc=operations,dc=xypoint,dc=com
    changetype: modify
    replace: homeDirectory
    homeDirectory: /var/tmp
    ldapmodify: value: /var/tmp vlen: 8
    ldapmodify: ldaptool_berval_from_ldif_value: value: /var/tmp
    replace homeDirectory:
    /var/tmp
    modifying entry uid=nada,ou=people,dc=operations,dc=xypoint,dc=com
    ldap_modify: Referral received
    ldap_modify: matched: dc=operations,dc=xypoint,dc=com
    Referral: ldap://sea-d-ldap1.xypoint.com:389
    I thought that LDAP urls needed to be post pended with a '/', but I could be wrong....
    At any rate if there is any news on this issue or some configuration parameters I should try, please let me know.

    I have exactly the same problem and have raised an SR with Oracle. I suspect you can override this behaviour if you could somehow populate Organization Name during reconciliation with a value other than than the default, updating /db/LDAPUser for the required mapping. Unfortunately in my case to do this I would need to run some code to get the required Organization Name, which I had hoped I could call via a custom Transformation, but I cannot get Transformation code to run in this instance.
    The other option, which does not seem so ideal to me, would be to have a post process event handler which, if it still has access to the required data, could move users back from the default organization, but it is not great as it means every time you run a full reconciliation many users would be updated twice, to move them to the default then back to their proper organization.
    For now I have proposed a manual workaround where before a full reconciliation is run (manually only) I extract from the database a list of all user's organizations, then replay this back to the database after reconciliation to put everyone back where they should be.

  • Pam_ldap / nss_ldap questions okay here?

    Hello.
    I've got some problems with the Sun pam_ldap and nss_ldap "bits" on Solaris 9 and 10. LDAP server is a OpenLDAP server.
    Are questions reg. this okay here?
    Thanks,
    Alexander

    I take that to be a "yes"? :)
    Allright, I'll post my question in a new thread.
    Thanks,
    Alexander

  • Solaris 10 openldap authentication with md5 passwords

    Hello to everyone,
    We are trying to enable ldap authentication with pam_ldap and md5 passwords on a Solaris 10 system to an openldap server. If passwords are stored using crypt, everything works correctly. But if the password in openldap is in md5, then authentication fails.
    We have installed openldap client along with pam_ldap and nss_ldap from padl (http://www.padl.com/pam_ldap.html)
    The error messages when trying to 'su -' to the ldap user are:
    Jun  1 18:35:23 servername su: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate()
    Jun  1 18:35:23 servername su: [ID 810491 auth.crit] 'su ldapuser' failed for mike on /dev/pts/4and for ssh:
    Jun  1 18:35:54 servername sshd[14197]: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate()
    Jun  1 18:35:54 servername sshd[14191]: [ID 800047 auth.error] error: PAM: Authentication failed for ldapuser from pc7395.sa.example.int
    Jun  1 18:36:00 servername sshd[14224]: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate()
    Jun  1 18:36:00 servername sshd[14191]: [ID 800047 auth.error] error: PAM: Authentication failed for ldapuser from pc7395.sa.example.int
    Jun  1 18:36:02 servername sshd[14278]: [ID 800047 auth.info] Accepted publickey for scponly from 10.24.4.52 port 35390 ssh2
    Jun  1 18:36:04 servername sshd[14270]: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate()
    Jun  1 18:36:04 servername sshd[14191]: [ID 800047 auth.error] error: PAM: Authentication failed for ldapuser from pc7395.sa.example.int
    Jun  1 18:36:04 servername sshd[14191]: [ID 800047 auth.info] Failed keyboard-interactive/pam for ldapuser from 192.168.1.25 port 41075 ssh2
    Jun  1 18:36:08 servername sshd[14191]: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate()
    Jun  1 18:36:08 servername sshd[14191]: [ID 800047 auth.info] Failed password for ldapuser from 192.168.1.25 port 41075 ssh2
    Jun  1 18:36:12 servername sshd[14191]: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate()
    Jun  1 18:36:12 servername sshd[14191]: [ID 800047 auth.info] Failed password for ldapuser from 192.168.1.25 port 41075 ssh2
    Jun  1 18:36:17 servername sshd[14191]: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate()
    Jun  1 18:36:17 servername sshd[14191]: [ID 800047 auth.info] Failed password for ldapuser from 192.168.1.25 port 41075 ssh2Below are the configuration files (pam.conf, nsswitch.conf, ldap.conf) and anything else that I imagine could help (comments of the files have been removed).
    Please feel free to ask for any other configuration file:
    */etc/pam.conf*
    login   auth requisite        pam_authtok_get.so.1
    login   auth required         pam_dhkeys.so.1
    login   auth required         pam_unix_cred.so.1
    login   auth required         pam_dial_auth.so.1
    login   auth sufficient       pam_unix_auth.so.1  server_policy debug
    login   auth required           /usr/lib/security/pam_ldap.so.1 debug
    rlogin auth sufficient       pam_rhosts_auth.so.1
    rlogin auth requisite        pam_authtok_get.so.1
    rlogin auth required         pam_dhkeys.so.1
    rlogin auth required         pam_unix_cred.so.1
    rlogin  auth required          pam_unix_auth.so.1 use_first_pass
    rsh    auth sufficient       pam_rhosts_auth.so.1
    rsh    auth required         pam_unix_cred.so.1
    rsh    auth required         pam_unix_auth.so.1
    ppp     auth requisite        pam_authtok_get.so.1
    ppp     auth required         pam_dhkeys.so.1
    ppp     auth required         pam_dial_auth.so.1
    ppp     auth sufficient       pam_unix_auth.so.1 server_policy
    other   auth sufficient         /usr/lib/security/pam_ldap.so.1 debug
    other   auth required           pam_unix_auth.so.1 use_first_pass debug
    passwd  auth sufficient          pam_passwd_auth.so.1 server_policy
    passwd  auth required           /usr/lib/security/pam_ldap.so.1 debug
    cron    account required      pam_unix_account.so.1
    other   account requisite     pam_roles.so.1
    other   account sufficient       pam_unix_account.so.1 server_policy
    other   account required        /usr/lib/security/pam_ldap.so.1 debug
    other   session required      pam_unix_session.so.1
    other   password required     pam_dhkeys.so.1
    other   password requisite    pam_authtok_get.so.1
    other   password requisite    pam_authtok_check.so.1
    other   password required     pam_authtok_store.so.1 server_policy*/etc/ldap.conf*
    base ou=users,ou=Example,dc=staff,dc=example
    ldap_version 3
    scope sub
    pam_groupdn [email protected],ou=groups,ou=Example,dc=staff,dc=example
    pam_member_attribute memberUid
    nss_map_attribute uid displayName
    nss_map_attribute cn sn
    pam_password_prohibit_message Please visit https://changepass.exapmle.int/ to change your password.
    uri ldap://ldapserver01/
    ssl no
    bind_timelimit 1
    bind_policy soft
    timelimit 10
    nss_reconnect_tries 3
    host klnsds01
    nss_base_group         ou=system_groups,ou=Example,dc=staff,dc=example?sub
    pam_password md5*/etc/nsswitch.conf*
    passwd:     files ldap
    group:      files ldap
    hosts:      files dns
    ipnodes:   files dns
    networks:   files
    protocols:  files
    rpc:        files
    ethers:     files
    netmasks:   files
    bootparams: files
    publickey:  files
    netgroup:   files
    automount:  files
    aliases:    files
    services:   files
    printers:       user files
    auth_attr:  files
    prof_attr:  files
    project:    files
    tnrhtp:     files
    tnrhdb:     files*/etc/security/policy.conf*
    AUTHS_GRANTED=solaris.device.cdrw
    PROFS_GRANTED=Basic Solaris User
    CRYPT_ALGORITHMS_DEPRECATE=__unix__
    LOCK_AFTER_RETRIES=YES
    CRYPT_ALGORITHMS_ALLOW=1,2a,md5
    CRYPT_DEFAULT=1Thanks in advance for any response...!!

    Thanks you for your reply.
    Our openldap version is openldap-2.3.39
    And all passwords are encrypted with : Base 64 encoded md5
    Below is a sample password:
    {md5}2FeO34RYzgb7xbt2pYxcpA==Thanks again for any help..

  • Nfs start ???

    hi..
    I would like to make a network with a lot of computers, thats has a mainserver with all the /homes  in..  When people lock in on the clients, they should have their username and passwd. And when there loggod in, their /home from the server should be the home on the client also...
    I have noticed a lot´og questions about that, bat their also old question.. As I´m thinking - there must be some update s on that since 02? So just a question ?? Wich packages do I nedd to have installed today if I want this to work ????
    THX

    I got that one now....
    But the meaning was that the users only should have access to their own home - not all!!! And on the client they should put in username and passwd and have that validate on a ldapserver ??? I got the LDAP running, but can´t get the klient to show the users on ldap ? So am i missing something..
    I have configurated pam_ldap.conf & nss_ldap.conf(its an example i can see) but can´t see the client... So whar am i doing wrong or missing.

  • After jumpstart host doesn't prompt for root password

    Hiya gang,
    I am migrating my jumpstart functionality to a new server and while it would appear that 100% of things are identical on both (as far as my /jumpstart tree is concerned), when I jumpstart a host (V240, in this case, but I've seen it on a SunBlade 150 too) everything appears to go well, but after the host reboots at the very end and I attempt to log in on console as root I am not even prompted for a password.
    I've booted to single user over the net and on the disk that was just jumpstarted I see what would appear to be a normal Solaris system. There are no indications that I can find of why it wouldn't prompt for password at all, and I'm not well enough versed with the way the login functionality works to know why this is.
    My new jumpstart server is running Solaris 10 (08/07), and I'm trying to jump a host with the same version. The very same jumpstart using my old jumpstart server works just fine.
    Thanks in advance,
    pb

    Darren,
    Thanks for your reply. It got me in the right frame of mind for troubleshooting :)
    I set up pam debugging for pam_ldap and got the following messages in /var/adm/messages:
    Aug 29 10:13:46 testfoo login: [ID 293258 auth.warning] libsldap: Status: 2 Mesg: Unable to load configuration '/var/ldap/ldap_client_file' ('').
    Aug 29 10:13:46 testfoo login: [ID 562097 auth.alert] open_module: Owner of the module /usr/lib/security/pam_mkhomedir.so is not root
    Aug 29 10:13:46 testfoo login: [ID 487707 auth.error] load_modules: can not open module /usr/lib/security/pam_mkhomedir.so
    Aug 29 10:13:46 testfoo svc.startd[7]: [ID 694882 daemon.notice] instance svc:/system/console-login:default exited with status 1
    Aug 29 10:56:51 testfoo su[3209]: [ID 105162 auth.alert] open_pam_conf: Owner of /etc/pam.conf is not root
    Aug 29 10:57:49 testfoo login[1225]: [ID 105162 auth.alert] open_pam_conf: Owner of /etc/pam.conf is not root
    ...so, I checked them out and /etc/pam.conf and /usr/lib/security/pam_mkhomedir.so are both owned nobody:nobody, which smelled like an NFS issue since both of those files are copied over to the hosts as part of a JASS_FILES variable, but during the finish script execution (they're copied by install-templates.fin). So, I did some digging there and found another Sun forum thread that had info on it:
    http://forums.sun.com/thread.jspa?forumID=841&threadID=5100999
    ...so I made the requisite change to /etc/default/nfs (setting the max version to 3) and the next jumpstart I tested worked perfectly, password prompt and all. All files that were previously owned nobody:nobody had the correct ownership this time around.
    Crazy!
    Thanks again Darren for your input!

  • Dbus hanging at startup, nss_ldap and pam_ldap to blame?

    https://bbs.archlinux.org/viewtopic.php?id=104114
    This post is about the same problem I'm having, but I don't really like the solution. I'm running an arch box that is authenticating users through and Windows domain using ldap and kerberos, I know I can remove pam_ldap without any issue since the pam part of the setup is only using kerberos, but I don't think I can remove nss_ldap without breaking authentication. Does anyone else have a work around? I'm going to try removing the one once I get back into the box with a arch boot disk, and I'll update if that goes well.

    https://bbs.archlinux.org/viewtopic.php?id=104114
    This post is about the same problem I'm having, but I don't really like the solution. I'm running an arch box that is authenticating users through and Windows domain using ldap and kerberos, I know I can remove pam_ldap without any issue since the pam part of the setup is only using kerberos, but I don't think I can remove nss_ldap without breaking authentication. Does anyone else have a work around? I'm going to try removing the one once I get back into the box with a arch boot disk, and I'll update if that goes well.

  • /etc/pam_ldap.conf, /etc/nss_ldap.conf ?? Help!

    I've never thought I'll ever say that, but...
    I decided to switch my faculty's workstations from Gentoo to Arch. It seemed to be a good idea until I started to configure LDAP client configuration. Under Gentoo it seems to be much more _easier_... :-(
    Instead of a single file there are : /etc/pam_ldap.conf and /etc/nss_ldap.conf . I'm trying to figure out the difference between the first two ones. They differ... slightly. I wonder what'd happen if I deleted one of them and created just a symlink? If there are two files there should be some reason for this. I cannot guess: what reason -- I can't find any...Thanks for any clarification.
    Last edited by quayasil (2011-08-22 08:07:54)

    I sincerely doubt that. You can change the way you're authenticating yourself to SSH but that doesn't automaticly imply that you would also need to change the way SSH checks this authentication with the system.
    Besides; just take another carefull look at the sshd_config file; you'll see that RSA authentication is enabled by default but disabled in Solaris 10. Simply change the option and... Also keep in mind that RSAAuthentication applies to protocol 1, and I'm not too sure that you'd want to fully focus on that.

  • JSDS 6.2 and Solaris 10 UNIX Accounts (simple,proxy)

    Hi,
    I just got my Solaris10 server-client setup working. Here's some items that may be useful to you: All I'm using LDAP for at this point is user authentication to include home directory management from the server ( NFS share and auto_fs setup in LDAP and on the client )
    My server is JSDS 6.2 ( at least, that's what Sun's Download Center id'd it as. Here's output of DBVERSION file:
    cat /var/opt/SUNWdsee/dsins1/db/DBVERSION
    Sun-ldbm/6.0(64-bit) SunOS 5.10 sparc
    ASSUMPTIONS:  You have the LDAP server installed and running and you are ready to run /usr/lib/ldap/idsconfig
    Both systems patched to latest Recommended cluster and patches shown at JSDS download site. Also, make sure CRYPT is selected during idsconfig.
    myserver: UE450
    (myserver-root: /:225)-> showrev
    Hostname: myserver
    Hostid: 1234567890
    Release: 5.10
    Kernel architecture: sun4u
    Application architecture: sparc
    Hardware provider: Sun_Microsystems
    Domain: example.com
    Kernel version: SunOS 5.10 Generic_127111-01
    myclient: SF V445
    (myclient-root: /:130)-> showrev
    Hostname: myclient
    Hostid: 1234567890
    Release: 5.10
    Kernel architecture: sun4u
    Application architecture: sparc
    Hardware provider: Sun_Microsystems
    Domain: example.com
    Kernel version: SunOS 5.10 Generic_127111-01
    ON CLIENT:
    ldapclient -v init -a proxyDN=cn=proxyagent,ou=profile,dc=example,dc=com
    -a profileName=myprofile my.svr.ip.addr:port (port if not 389)
    I was not fully qualifying proxyDN and this caused authentication failures. ( do not run ldapclient init until the following are done first )
    ON CLIENT: I edited stock pam.conf and made sure only atries active were those id'd in Sun's doc. Also, I made sure I followed same order in each section as compared to Sun's doc.
    pam.conf ( from Sun's JSDS Admin guide ) on LDAP client:
    (*ldap-client*-root: /var/tmp:213)-> cat /etc/pam.conf
    #ident "@(#)pam.conf 1.28 04/04/21 SMI"
    # Copyright 2004 Sun Microsystems, Inc. All rights reserved.
    # Use is subject to license terms.
    # PAM configuration
    # Unless explicitly defined, all services use the modules
    # defined in the "other" section.
    # Modules are defined with relative pathnames, i.e., they are
    # relative to /usr/lib/security/$ISA. Absolute path names, as
    # present in this file in previous releases are still acceptable.
    # Authentication management
    # login service (explicit because of pam_dial_auth)
    login auth requisite pam_authtok_get.so.1
    login auth required pam_dhkeys.so.1
    login auth required pam_unix_cred.so.1
    #login auth required pam_unix_auth.so.1
    login auth required pam_dial_auth.so.1
    login auth binding pam_unix_auth.so.1 server_policy
    login auth required pam_ldap.so.1
    # rlogin service (explicit because of pam_rhost_auth)
    rlogin auth sufficient pam_rhosts_auth.so.1
    rlogin auth requisite pam_authtok_get.so.1
    rlogin auth required pam_dhkeys.so.1
    rlogin auth required pam_unix_cred.so.1
    #rlogin auth required pam_unix_auth.so.1
    rlogin auth binding pam_unix_auth.so.1 server_policy
    rlogin auth required pam_ldap.so.1
    # Kerberized rlogin service
    krlogin auth required pam_unix_cred.so.1
    krlogin auth binding pam_krb5.so.1
    krlogin auth required pam_unix_auth.so.1
    # rsh service (explicit because of pam_rhost_auth,
    # and pam_unix_auth for meaningful pam_setcred)
    rsh auth sufficient pam_rhosts_auth.so.1
    rsh auth required pam_unix_cred.so.1
    rsh auth binding pam_unix_auth.so.1 server_policy
    rsh auth required pam_ldap.so.1
    # Kerberized rsh service
    krsh auth required pam_unix_cred.so.1
    krsh auth binding pam_krb5.so.1
    krsh auth required pam_unix_auth.so.1
    # Kerberized telnet service
    ktelnet auth required pam_unix_cred.so.1
    ktelnet auth binding pam_krb5.so.1
    ktelnet auth required pam_unix_auth.so.1
    # PPP service (explicit because of pam_dial_auth)
    ppp auth requisite pam_authtok_get.so.1
    ppp auth required pam_dhkeys.so.1
    #ppp auth required pam_unix_cred.so.1
    #ppp auth required pam_unix_auth.so.1
    ppp auth required pam_dial_auth.so.1
    ppp auth binding pam_unix_auth.so.1 server_policy
    ppp auth required pam_ldap.so.1
    # Default definitions for Authentication management
    # Used when service name is not explicitly mentioned for authentication
    other auth requisite pam_authtok_get.so.1
    other auth required pam_dhkeys.so.1
    other auth required pam_unix_cred.so.1
    #other auth required pam_unix_auth.so.1
    other auth binding pam_unix_auth.so.1 server_policy
    other auth required pam_ldap.so.1
    # passwd command (explicit because of a different authentication module)
    #passwd auth required pam_passwd_auth.so.1
    passwd auth binding pam_passwd_auth.so.1 server_policy
    passwd auth required pam_ldap.so.1
    # cron service (explicit because of non-usage of pam_roles.so.1)
    cron account required pam_unix_account.so.1
    # Default definition for Account management
    # Used when service name is not explicitly mentioned for account management
    other account requisite pam_roles.so.1
    #other account required pam_unix_account.so.1
    other account binding pam_unix_account.so.1 server_policy
    other account required pam_ldap.so.1
    # Default definition for Session management
    # Used when service name is not explicitly mentioned for session management
    other session required pam_unix_session.so.1
    # Default definition for Password management
    # Used when service name is not explicitly mentioned for password management
    other password required pam_dhkeys.so.1
    other password requisite pam_authtok_get.so.1
    other password requisite pam_authtok_check.so.1
    #other password required pam_authtok_store.so.1
    other password required pam_authtok_store.so.1 server_policy
    # Support for Kerberos V5 authentication and example configurations can
    # be found in the pam_krb5(5) man page under the "EXAMPLES" section.
    ON CLIENT: Sun's nsswitch.ldap files that get's activated after running lapclient init has LDAP take over everything. I use a trimmed-down nsswitch.conf with very few ldap entries.
    nsswitch.conf on LDAP client
    (*ldap-client*-root: /var/tmp:215)-> cat /etc/nsswitch.conf
    # Copyright 2006 Sun Microsystems, Inc. All rights reserved.
    # Use is subject to license terms.
    # ident "@(#)nsswitch.ldap 1.10 06/05/03 SMI"
    # /etc/nsswitch.ldap:
    # An example file that could be copied over to /etc/nsswitch.conf; it
    # uses LDAP in conjunction with files.
    # "hosts:" and "services:" in this file are used only if the
    # /etc/netconfig file has a "-" for nametoaddr_libs of "inet" transports.
    # LDAP service requires that svc:/network/ldap/client:default be enabled
    # and online.
    # the following two lines obviate the "+" entry in /etc/passwd and /etc/group.
    passwd: files ldap
    group: files ldap
    # consult /etc "files" only if ldap is down.not using LDAP for hosts
    hosts: files dns
    # Note that IPv4 addresses are searched for in all of the ipnodes databases
    # before searching the hosts databases.
    ipnodes: files
    networks: files
    protocols: files
    rpc: files
    ethers: files
    netmasks: files
    bootparams: files
    publickey: files
    netgroup: files
    automount: files ldap
    aliases: files
    # for efficient getservbyname() avoid ldap
    services: files
    printers: user files
    auth_attr: files
    prof_attr: files
    project: files
    tnrhtp: files
    tnrhdb: files
    ON CLIENT:
    contents of /var/ldap files on client: notice fully qualified NS_LDAP_BINDDN - it me quite some time to understand that this had to be fully qualified or I would continue to get those "Error: Unable to update from profile" in /var/ldap/cachemgr.log and "openConnection: simple bind failed - No such object" in /var/adm/messages error messages.
    (*ldap-client*-root: /var/ldap:218)-> cat ldap*
    # Do not edit this file manually; your changes will be lost.Please use ldapclien
    t (1M) instead.
    NS_LDAP_BINDDN= cn=proxyagent,ou=profile,dc=pacmh,dc=us,dc=eds,dc=com
    NS_LDAP_BINDPASSWD= (removed)
    # Do not edit this file manually; your changes will be lost.Please use ldapclien
    t (1M) instead.
    NS_LDAP_FILE_VERSION= 2.0
    NS_LDAP_SERVERS= my.svr.ip.addr:port (port if not 389)
    NS_LDAP_SEARCH_BASEDN= dc=example,dc=com
    NS_LDAP_AUTH= simple
    NS_LDAP_SEARCH_REF= FALSE
    NS_LDAP_SEARCH_SCOPE= one
    NS_LDAP_SEARCH_TIME= 30
    NS_LDAP_SERVER_PREF= my.svr.ip.addr:port (port if not 389)NS_LDAP_CACHETTL= 3600
    NS_LDAP_PROFILE= myprofile
    NS_LDAP_CREDENTIAL_LEVEL= proxy
    NS_LDAP_BIND_TIME= 15
    ON SERVER
    After running /usr/lib/ldap/idsconfig, I had to create VLV indexes with this command ( after idsconfig runs, it says to use directoryserver command, which does not exist in JSDS 6.2)
    /opt/SUNWdsee/ds6/bin/dsconf create-index -h myserver -p nnnn ( port if not 389 ) dc=example,dc=com getgrent gethostent [....]
    enter space-separated list of all VLV indexes idsconfig said to add after you ran idsconfig
    ON CLIENT:
    If you need to clear client init: ldapclient uninit ( if you get errors, check if ldap_cachemgr is running; if it is, kill -9 it, clear /var/ldap directory, make sure nsswitch.conf is not pointing to ldap stuff -- cp /etc/nsswitch.files /etc/nsswitch.conf
    Initialize ldapclient:
    ldapclient -v init -a proxyDN=cn=proxyagent,ou=profile,dc=example,dc=com
    -a profileName=myprofile my.svr.ip.addr:port (port if not 389)
    If this still does not work, clean up client again as before and reboot it. I had some issues w/Sun's nsswitch.conf file for LDAP taking over my client machine and rendering it useless until I rebooted it with files-settings in nsswitch.conf, making my own nsswitch.ldap file it /etc so Sun's LDAP-happy nsswitch file would not be used, and then running ldapclient init.
    ON CLIENT
    cp /etc/passwd /var/tmp/passwd.ldif ( same for group, shadow, auto_home, auto_master )
    Edit each ldif file and remove all entries other than regular user accounts and nobody/noaccess accounts
    passwd.ldif should look something like this:
    johndoe:x:146:14:John Doe:/home/johndoe:/bin/ksh
    janedoe:x:145:14:Jane Doe:/home/janedoe:/bin/ksh
    nobody:x:60001:60001:NFS Anonymous Access User:/:
    noaccess:x:60002:60002:No Access User:/:
    nobody4:x:65534:65534:SunOS 4.x NFS Anonymous Access User:/:
    For auto_home, make sure each entry starts w/home-dir server's ip-addr: it'll look something like this:
    janedoe 10.10.20.50:/export/home/janedoe
    johndoe 10.10.20.50:/export/home/johndoe
    ldapaddent -D "cn=Directory Manager" -w <password> -f /var/tmp/passwd.ldif passwd
    .... group.ldif group NOTE order is important: passwd,
    .... shadow.ldif shadow group, shadow
    .... auto_home.ldif auto_home
    .... auto_master.ldif auto_master
    ON CLIENT
    /etc/auto_master
    +auto_master
    /etc/auto_home
    +auto_home
    enable these NFS daemons: ( ie. svcadm enable network/nfs/status )
    online 9:06:26 svc:/network/nfs/status:default
    online 9:06:27 svc:/network/nfs/nlockmgr:default
    online 13:09:41 svc:/network/nfs/cbd:default
    online 13:09:41 svc:/network/nfs/mapid:default
    online 13:09:41 svc:/network/nfs/client:default
    enable auto_fs
    online 13:37:42 svc:/system/filesystem/autofs:default
    ON SERVER
    enable these NFS daemons:
    online 16:36:16 svc:/network/nfs/cbd:default
    online 16:36:16 svc:/network/nfs/status:default
    online 16:36:17 svc:/network/nfs/mapid:default
    online 16:36:17 svc:/network/nfs/nlockmgr:default
    online 16:36:22 svc:/network/nfs/rquota:default
    online 16:36:22 svc:/network/nfs/client:default
    online 16:36:23 svc:/network/nfs/server:default
    ON HOME DIRECTORY SERVER
    export home dirs
    (home-dir-svr-root: /var/tmp:221)-> cat /etc/dfs/dfstab
    # Place share(1M) commands here for automatic execution
    # on entering init state 3.
    # Issue the command 'svcadm enable network/nfs/server' to
    # run the NFS daemon processes and the share commands, after adding
    # the very first entry to this file.
    # share [-F fstype] [ -o options] [-d "<text>"] <pathname> [resource]
    # .e.g,
    share -F nfs -o rw -d "home dirs" /export/home
    shareall
    enable auto_fs
    online 13:37:42 svc:/system/filesystem/autofs:default
    ON LDAP SERVER via the GUI ( not sure how to do this via command-line and since I have a JAVA GUI, I'm not going to knock myself out on the command-line trying to do something it'l take 15 seconds to do from the GUI -- command-line purists, feel free to contribute command to do this:
    From GUI, go into your DS instance: --> entry Management --> automountMapName=auto_home --> automountinformation: 144.10.199.220:/export/home/janedoe
    Verify home-dir-svr IP and home dir info are correct.
    log on as user from ldap-client
    NOTE: I did not alter any UNIX system files ( nsswitch.conf, pam.conf, passwd, auto_home, and the like) on LDAP server.
    Not sure if I missed anything, but hope this helps.
    John
    Edited by: No_Windoze on Nov 14, 2007 4:16 PM

    Just remembered something that is very subtle during idsconfig:
    At one point durint idsconfig, there's a questions about storing passwords in unix CRYPT format. You must answer yes to that question or none of this will work. The default answer is no.
    John
    Hi munnik,
    I had the same errors initially. I didn't write down what I did to clear them (oops!) but I think what I did to 'fix' this was I restarted/rebooted (can't remember which) the directory server to clear the error and then, from the client and in this order - passwd, group, shadow - I readded ldifs.
    If you're still having issues with DS, make sure the VLV index step discussed above was done, nothing missed, no errors - redo if necessary: uninit client(s), reinit client(s) with new profile created as a result of running idsconfig to recreate VLV indexes - it'll skip any VLV indexes that are in the server and display a message to that effect. It's a reather brute-force method of doing things, but I couldn't locate much in the way of troubleshooting user account creation issues.
    When I add a new user, here's what I do: add user to server where home dirs are and create a set of passwd, shadow, and auto_home ldif files with just the new user info and run ldapaddent. Then I add them to group (if necessary) with direct edit on ldap server.
    HTH
    John
    (aka NoWindoze)
    indexes and VLV Indexes 'created' when I ran idsconfig:
    uidNumber (eq,pres) skipped already exists
    ipNetworkNumber (eq,pres) skipped already exists
    gidnumber (eq,pres) skipped already exists
    oncrpcnumber (eq,pres) skipped already exists
    automountKey (eq,pres) skipped already exists
    VLV-indexes:
    getgrent vlv_index skipped already exists
    gethostent vlv_index skipped already exists
    getnetent vlv_index skipped already exists
    getpwent vlv_index skipped already exists
    getrpcent vlv_index skipped already exists
    getspent vlv_index skipped already exists
    getauhoent vlv_index skipped already exists
    getsoluent vlv_index skipped already exists
    getauduent vlv_index skipped already exists
    getauthent vlv_index skipped already exists
    getexecent vlv_index skipped already exists
    getprofent vlv_index skipped already exists
    getmailent vlv_index skipped already exists
    getbootent vlv_index skipped already exists
    getethent vlv_index skipped already exists
    getngrpent vlv_index skipped already exists
    getipnent vlv_index skipped already exists
    getmaskent vlv_index skipped already exists
    getprent vlv_index skipped already exists
    getip4ent vlv_index skipped already exists
    getip6ent vlv_index skipped already exists
    You can see indexes defined in your server with this command:
    dsconf list-indexes -h ldap.server.host.name-or.ip -p 389
    Edited by: SolarisSAinPA on Nov 30, 2007 1:05 PM
    Edited by: SolarisSAinPA on Nov 30, 2007 1:40 PM

  • Nsswitch doesn't run PADL's nss_ldap.so

    Hi, all!
    I've really broken my brain.
    I've successfully compiled PADL's nss_ldap-253 with openldap-2.3.21 and openssl-0.9.7i. All linked static.
    /etc/nsswitch.conf reads "passwd: files ldap". nss_ldap.so copied to /usr/lib/nss_ldap.so.1.
    When I run `getent passwd` it displays content of /etc/passwd only and exits with code 0. truss shows that it opens /usr/lib/nss_ldap.so.1. But it doesn't run any functions, even nssldap_passwd_constr().
    I've downloaded ready-to-use nss_ldap.so.1 from www.symas.com and it works fine. It frustrates and encourages me. I cannot understand what is wrong with my job?
    I have Sun Fire V240, Solaris 9 9/05, GCC 3.4.2.
    openssl-0.9.7i:
    # ./config no-hw threads
    # make ; make install
    openldap-2.3.21:
    # ./configure disable-ipv6 disable-slapd disable-slurpd disable-shared --without-cyrus-sasl \
    --with-tls CPPFLAGS=-I/usr/local/ssl/include LDFLAGS=-L/usr/local/ssl/lib
    # make depend ; make ; make install
    nss_ldap-253:
    # CPPFLAGS=-I/usr/local/ssl/include LDFLAGS=-L/usr/local/ssl/lib LIBS="-lssl -lcrypto" \
    ./configure with-ldap-dir=/usr/local with-ldap-lib=openldap --enable-rfc2307bis \
    with-ldap-conf-file=/etc/ldap.conf with-ldap-secret-file=/etc/ldap.secret
    # LDADD=-L/usr/local/ssl/lib make
    # cp nss_ldap.so /usr/lib/nss_ldap.so.1
    # ln -s /etc/ldap.conf /usr/local/etc/openldap/ldap.conf

    GCC 3.4.2 was the matter. GCC 3.3.2 works fine.

  • Sgd + ldap auth + ssh and numeric usernames

    Hi there, sorry if there is a well known answer to my problem, bu tI have not found it.
    anyway, We have a problem where our customer wants to use purelly numeric usernames to logg in to secure global desktop
    From the point of secure global desktop we don't have any problems with this, the problem happens later on with the ssh to solaris (which is set up with ldap authentication) in that I have not been able to get purely numerical logins to work with solaris pam_ldap. Now some of you think that this is not an SGD problem, and that is true, but I was wondering if SGD could help me solve this.
    My question is simple, can SGD use a "different" username taken from ldap after it has logged in the user instead of the username tha tthe user provided.
    ex.
    the user loggs in to SGD with the username 173651
    when starting the application , instead of logging in to the application server (via ssh) with username 173651 it should take an other field from ldap that holds the solaris username.
    thanks for any answers and hints.

    Sorry, but you missunderstood my question a bit :-)
    What you suggest is a way for the users to type in an other username after logged in to Secure Global desktop, tha tis now what we want
    We want this to be done automaticly for us.
    First we have changed a bit how the login procedure works, when the user surfs to the SGD server they will not be presented with any choices, they wil be presented with a single login screen, when they have logged in SGD will automaticly start our application.
    the problem we have is that we want to use only digits as the login name in SGD, but unforutunally Solaris have some problems with using digits alone in usernames (and especially usernames longer then 8 characters)
    so I was hoping that SGD could read from LDAP (we are using LDAP user store, not UNIX) another value that it would use to login to the app server thorugh SSH
    for example, when logging in to SGD it loggs in towards the LDAP uid field, but when it starts the application SGD reads some other property from LDAP and sends that to ssh. Solaris is then also authenticating towards SSH and uses the second property to authenticate.
    If this cannot be done in Secure global Desktop, I think we will look at using a third party authenticator that can do what we want (hopefully OpenSSO can do this)

  • Solaris 10 and LDAP Authentication

    Were trying to use LDAP authentication with Solaris 10 accounts and Sun One Java Systems Directory Server 5.2, where there won't be no /etc/passwd or /etc/group user entries, ( only entries for system accounts). The Sun One Java Systems Directory Server 5.2 is on a separate machine from the accounts. Both machines are using Solaris 10.
    I first ran the "idsconfig" utility to setup the VLV indexes, but I received an error on the "automountKey" when it was doing the index processing. It showed that the index processing had failed. All the other indexes were configured successfully. What would cause this?
    My next step is initializing the LDAP Client . Then configure the pam.conf file to use pam_ldap. Finally import all the users into LDAP with the required ObjectClasses and attributes for the authentication process, (posixAccount, shadowAccounts etc.). This also includes adding the automount entries into LDAP, which I'm really not sure how to do that. All of our users paths will be under /export/home/username.
    I'am missing any steps?
    Doese anyone have a step by step guide to use LDAP authentication for Solaris 10 accounts, where LDAP will manage the groups, passwords, automounts for each user?
    Message was edited by:
    automount
    Message was edited by:
    automount

    You may follow:
    http://web.singnet.com.sg/~garyttt/
    http://projects.alkaloid.net/content/view/15/26/
    http://blogs.sun.com/roller/resources/raja/ldap-psd.html
    http://jnester.lunarpages.com/howtos/solaris/howToSolarisLDAPAuth.html
    http://www.thebergerbits.com/unix.shtml
    http://blogs.sun.com/roller/page/baban?entry=steps_to_setup_ssl_using (SSL/TLS steps)
    http://blogs.sun.com/roller/page/rohanpinto?entry=nis_to_ldap_migration_guide (NIS to LDAP migration)
    http://blogs.sun.com/roller/page/anupcs?entry=ldap_related_documentation_at_sun
    (LDAP related docs)
    Gary

  • Solaris 10 with PAM, OpenSSH and OpenLDAP

    Hi all,
    Due to the mix of Linux and Solaris machines, we decided to do OpenLdap and OpenSSH on the Solaris machines as well. All works fine on the Linux machines, but we cannot get PAM authentification to work on the Solaris machines. I have a user in the ldap database esawyja, when the user su esawyja, it works, but the user cannot ssh into the server.
    test5:/ $ su esawyja
    test5:/ $ whoami
    esawyja
    test5:/ $ exit
    exit
    test5:/ $ whoami
    root
    test5:/ $
    test5:/ $ ssh -v [email protected]
    OpenSSH_5.8p1, OpenSSL 1.0.0a 1 Jun 2010
    debug1: Reading configuration data /usr/local/etc/ssh_config
    debug1: Connecting to 10.1.1.5 [10.1.1.5] port 22.
    debug1: Connection established.
    debug1: permanently_set_uid: 0/0
    debug1: identity file /.ssh/id_rsa type -1
    debug1: identity file /.ssh/id_rsa-cert type -1
    debug1: identity file /.ssh/id_dsa type -1
    debug1: identity file /.ssh/id_dsa-cert type -1
    debug1: identity file /.ssh/id_ecdsa type -1
    debug1: identity file /.ssh/id_ecdsa-cert type -1
    debug1: Remote protocol version 2.0, remote software version OpenSSH_5.8
    debug1: match: OpenSSH_5.8 pat OpenSSH*
    debug1: Enabling compatibility mode for protocol 2.0
    debug1: Local version string SSH-2.0-OpenSSH_5.8
    debug1: SSH2_MSG_KEXINIT sent
    debug1: SSH2_MSG_KEXINIT received
    debug1: kex: server->client aes128-ctr hmac-md5 none
    debug1: kex: client->server aes128-ctr hmac-md5 none
    debug1: sending SSH2_MSG_KEX_ECDH_INIT
    debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
    debug1: Server host key: RSA 1b:42:5b:37:e4:86:99:e1:af:81:bc:64:c8:68:a6:98
    debug1: Host '10.1.1.5' is known and matches the RSA host key.
    debug1: Found key in /.ssh/known_hosts:3
    debug1: ssh_rsa_verify: signature correct
    debug1: SSH2_MSG_NEWKEYS sent
    debug1: expecting SSH2_MSG_NEWKEYS
    debug1: SSH2_MSG_NEWKEYS received
    debug1: Roaming not allowed by server
    debug1: SSH2_MSG_SERVICE_REQUEST sent
    debug1: SSH2_MSG_SERVICE_ACCEPT received
    debug1: Authentications that can continue: publickey,password,keyboard-interactive
    debug1: Next authentication method: publickey
    debug1: Trying private key: /.ssh/id_rsa
    debug1: Trying private key: /.ssh/id_dsa
    debug1: Trying private key: /.ssh/id_ecdsa
    debug1: Next authentication method: keyboard-interactive
    Password:
    debug1: Authentications that can continue: publickey,password,keyboard-interactive
    Password:
    from the debug parameter on the pam_ldap.so.1 in /etc/pam.conf, see below, I get the error pam_ldap: no legal authentication method configured
    from /etc/pam.conf
    sshd auth requisite pam_authtok_get.so.1
    sshd auth required pam_dhkeys.so.1
    sshd auth required pam_unix_cred.so.1
    sshd auth binding pam_unix_auth.so.1 server_policy
    sshd auth required pam_ldap.so.1 debug
    Feb 17 14:48:19 test5.com sshd[11347]: [ID 800047 auth.info] Failed password for esawyja from 10.1.1.215 port 51939 ssh2
    Feb 17 14:48:23 test5.company.com sshd[11347]: [ID 285619 auth.debug] ldap pam_sm_authenticate(sshd esawyja), flags = 1
    Feb 17 14:48:23 test5.company.com sshd[11347]: [ID 453631 auth.debug] tid= 1: Adding connection (serverAddr=127.0.0.1)
    Feb 17 14:48:23 test5.company.com sshd[11347]: [ID 816976 auth.debug] tid= 1: Connection added [0]
    Feb 17 14:48:23 test5.company.com sshd[11347]: [ID 467101 auth.debug] tid= 1: connectionID=1024
    Feb 17 14:48:23 test5.company.com sshd[11347]: [ID 805042 auth.debug] tid= 1: shared=1
    Feb 17 14:48:23 test5.company.com sshd[11347]: [ID 982078 auth.debug] tid= 1: usedBit=0
    Feb 17 14:48:23 test5.company.com sshd[11347]: [ID 727660 auth.debug] tid= 1: threadID=1
    Feb 17 14:48:23 test5.company.com sshd[11347]: [ID 577507 auth.debug] tid= 1: serverAddr=127.0.0.1
    Feb 17 14:48:23 test5.company.com sshd[11347]: [ID 939703 auth.debug] tid= 1: AuthType=0
    Feb 17 14:48:23 test5.company.com sshd[11347]: [ID 142272 auth.debug] tid= 1: TlsType=0
    Feb 17 14:48:23 test5.company.com sshd[11347]: [ID 537450 auth.debug] tid= 1: SaslMech=0
    Feb 17 14:48:23 test5.company.com sshd[11347]: [ID 625532 auth.debug] tid= 1: SaslOpt=0
    Feb 17 14:48:23 test5.company.com sshd[11347]: [ID 316739 auth.error] pam_ldap: no legal authentication method configured
    Feb 17 14:48:23 test5.company.com sshd[11347]: [ID 800047 auth.info] Failed password for esawyja from 10.1.1.215 port 51939 ssh2
    Feb 17 14:48:39 test5.company.com sshd[11349]: [ID 285619 auth.debug] ldap pam_sm_authenticate(sshd root), flags = 1
    Feb 17 14:48:39 test5.company.com sshd[11349]: [ID 453631 auth.debug] tid= 1: Adding connection (serverAddr=127.0.0.1)
    Feb 17 14:48:39 test5.company.com sshd[11349]: [ID 776464 auth.debug] tid= 1: Initialized sessionPool
    Feb 17 14:48:39 test5.company.com sshd[11349]: [ID 816976 auth.debug] tid= 1: Connection added [0]
    Feb 17 14:48:39 test5.company.com sshd[11349]: [ID 467101 auth.debug] tid= 1: connectionID=1024
    Feb 17 14:48:39 test5.company.com sshd[11349]: [ID 805042 auth.debug] tid= 1: shared=1
    Feb 17 14:48:39 test5.company.com sshd[11349]: [ID 982078 auth.debug] tid= 1: usedBit=0
    Feb 17 14:48:39 test5.company.com sshd[11349]: [ID 727660 auth.debug] tid= 1: threadID=1
    Feb 17 14:48:39 test5.company.com sshd[11349]: [ID 577507 auth.debug] tid= 1: serverAddr=127.0.0.1
    Feb 17 14:48:39 test5.company.com sshd[11349]: [ID 939703 auth.debug] tid= 1: AuthType=0
    Feb 17 14:48:39 test5.company.com sshd[11349]: [ID 142272 auth.debug] tid= 1: TlsType=0
    Feb 17 14:48:39 test5.company.com sshd[11349]: [ID 537450 auth.debug] tid= 1: SaslMech=0
    Feb 17 14:48:39 test5.company.com sshd[11349]: [ID 625532 auth.debug] tid= 1: SaslOpt=0
    Feb 17 14:48:39 test5.company.com sshd[11349]: [ID 316739 auth.error] pam_ldap: no legal authentication method configured
    Feb 17 14:48:39 test5.company.com sshd[11349]: [ID 800047 auth.info] Failed password for root from 10.1.1.215 port 51941 ssh2
    Feb 17 14:48:42 test5.company.com sshd[11349]: [ID 800047 auth.info] Accepted password for root from 10.1.1.215 port 51941 ssh2
    Feb 17 14:54:59 test5.company.com su: [ID 366847 auth.info] 'su esawyja' succeeded for root on /dev/pts/10
    Feb 17 14:55:32 test5.company.com sshd[8939]: [ID 800047 auth.info] Received disconnect from 10.1.1.118: 11: disconnected by user
    Feb 17 14:55:36 test5.company.com sshd[11602]: [ID 285619 auth.debug] ldap pam_sm_authenticate(sshd esawyja), flags = 1
    Feb 17 14:55:36 test5.company.com sshd[11602]: [ID 453631 auth.debug] tid= 1: Adding connection (serverAddr=127.0.0.1)
    Feb 17 14:55:36 test5.company.com sshd[11602]: [ID 776464 auth.debug] tid= 1: Initialized sessionPool
    Feb 17 14:55:36 test5.company.com sshd[11602]: [ID 816976 auth.debug] tid= 1: Connection added [0]
    Feb 17 14:55:36 test5.company.com sshd[11602]: [ID 467101 auth.debug] tid= 1: connectionID=1024
    Feb 17 14:55:36 test5.company.com sshd[11602]: [ID 805042 auth.debug] tid= 1: shared=1
    Feb 17 14:55:36 test5.company.com sshd[11602]: [ID 982078 auth.debug] tid= 1: usedBit=0
    Feb 17 14:55:36 test5.company.com sshd[11602]: [ID 727660 auth.debug] tid= 1: threadID=1
    Feb 17 14:55:36 test5.company.com sshd[11602]: [ID 577507 auth.debug] tid= 1: serverAddr=127.0.0.1
    Feb 17 14:55:36 test5.company.com sshd[11602]: [ID 939703 auth.debug] tid= 1: AuthType=0
    Feb 17 14:55:36 test5.company.com sshd[11602]: [ID 142272 auth.debug] tid= 1: TlsType=0
    Feb 17 14:55:36 test5.company.com sshd[11602]: [ID 537450 auth.debug] tid= 1: SaslMech=0
    Feb 17 14:55:36 test5.company.com sshd[11602]: [ID 625532 auth.debug] tid= 1: SaslOpt=0
    Feb 17 14:55:36 test5.company.com sshd[11602]: [ID 316739 auth.error] pam_ldap: no legal authentication method configured
    Feb 17 14:55:36 test5.company.com sshd[11600]: [ID 800047 auth.error] error: PAM: Authentication failed for esawyja from 10.1.1.5
    Feb 17 14:55:58 test5.company.com sshd[9612]: [ID 800047 auth.info] Received disconnect from 10.1.1.118: 11: disconnected by user
    In the slapd logfile I get this
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 737876 local4.debug] => slap_access_allowed: read access granted by read(=rscxd)
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 384072 local4.debug] => access_allowed: read access granted by read(=rscxd)
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 923158 local4.debug] => access_allowed: read access to "uid=esawyja,ou=People,dc=company,dc=com" "userPassword" requested
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 184944 local4.debug] => dn: [1]
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 184944 local4.debug] => dn: [2] cn=subschema
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 134411 local4.debug] => acl_get: [3] attr userPassword
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 105589 local4.debug] => slap_access_allowed: result not in cache (userPassword)
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 971074 local4.debug] => acl_mask: access to entry "uid=esawyja,ou=People,dc=company,dc=com", attr "userPassword" requested
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 488679 local4.debug] => acl_mask: to value by "", (=0)
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 704950 local4.debug] <= check a_dn_pat: self
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 704950 local4.debug] <= check a_dn_pat: *
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 279303 local4.debug] <= acl_mask: [2] applying auth(=xd) (stop)
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 804284 local4.debug] <= acl_mask: [2] mask: auth(=xd)
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 737876 local4.debug] => slap_access_allowed: read access denied by auth(=xd)
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 127828 local4.debug] => access_allowed: no more rules
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 572208 local4.debug] send_search_entry: conn 437 access to attribute userPassword, value #0 not allowed
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 119476 local4.debug] begin get_filter
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 823432 local4.debug] AND
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 679408 local4.debug] begin get_filter_list
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 119476 local4.debug] begin get_filter
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 694368 local4.debug] EQUALITY
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 274773 local4.debug] end get_filter 0
    Feb 17 14:59:11 test5.company.com slapd[8208]: [ID 119476 local4.debug] begin get_filter
    The user looks like this in the ldap database
    test5:/var/log $ ldaplist -l passwd esawyja
    dn: uid=esawyja,ou=People,dc=company,dc=com
    objectClass: account
    objectClass: posixAccount
    objectClass: top
    objectClass: shadowAccount
    cn: xxxxxxxxxxxxxxxxxxxxx
    uid: esawyja
    loginShell: /usr/bin/bash
    uidNumber: 1001
    gidNumber: 500
    homeDirectory: /home/admin/esawyja
    shadowLastChange: 12193
    shadowMin: 0
    shadowMax: 99999
    shadowWarning: 7
    shadowInactive: 1
    shadowExpire: 12999
    gecos: Wynand
    test5:/var/log $
    PLEASE I need help, been at this for the last week and I'm out of ideas
    Thanks

    I am not using OpenLDAP as a backend myself, I am using Sun/Oracle directory server. Initially this was version 5, and I have since upgraded to a mix of DS 6 and DS 7.
    With Sun DS, you run the idsconfig command (/usr/lib/ldap/idsconfig) which helps configure the server with things like a client profile and appropriate access permissions (e.g compare password). it will also help configure a proxy account. Sun LDAP clients should NOT need a proxy account. Linux clients would need the proxy account.

Maybe you are looking for