[Date Prev][Date Next] [Chronological] [Thread] [Top]

RE: Configuring Solaris 8 clients

--On Thursday, March 27, 2003 9:37 AM -0500 Igor Brezac <igor@ipass.net> wrote:

On Thu, 27 Mar 2003, Matthew Mauzy wrote:

Thanks for the examples but I'm still not able to configure solaris 8 as
a client of the openldap 2.1.12 server.

Here's my /var/ldap/ldap_client_file

NS_LDAP_SEARCH_BASEDN= dc=amath,dc=unc,dc=edu
NS_LDAP_DOMAIN= amath.unc.edu
NS_LDAP_EXP= 1045640377
NS_LDAP_SEARCH_DN= passwd:(ou=People,dc=amath,dc=unc,dc=edu),

Here's my /var/ldap/ldap_client_cred

NS_LDAP_BINDDN= cn=solaris,ou=ldapusers,dc=amath,dc=unc,dc=edu

I've edited /etc/nsswitch.conf to place ldap into the passwd, group, hosts, etc., but when I run listusers all I get are the local users.

My questions:

 - For the BINDDN, don't I need the password?  When adding that 'user'
 into the LDAP dir, why is it that the NS_LDAP_BINDDN_PASSWD has the
{NS1} stuff?

It depends. You told the ldap client to bind anonymously to the ldap server (NS_LDAP_AUTH= NS_LDAP_AUTH_NONE). You can NS_LDAP_AUTH= NS_LDAP_AUTH_SIMPLE if you want to simple bind to the ldap server with NS_LDAP_BINDDN and NS_LDAP_BIND_PASSWD.

Added NS_LDAP_BINDPASSWD= {NS1}xxxxxxxxxxx to the /var/ldap/ldap_client_cred and now am able to get LDAP info via nss.

 - Would upgrading to openLDAP 2.1.16 solve any of these problems?

For Solaris 9 I've run the ldapclient command that you supplied (with proper alterations for my LDAP system) and am able to get all of the LDAP users with listusers (yah!), but when I try and login to one of the LDAP accounts I get incorrect password errors. I can su - <ldap account> so I'm getting proper info from the LDAP server. Is this a PAM problem???

My guess is that anonymous cannot read userPassword attribute, or the userPassword attribute is not of the {crypt}xxxxxxxxxxxxx form.

Correct. My userPassword attribute is {KERBEROS}prinical@REALM

I am now getting account info from LDAP. Only problem is getting PAM stacked correctly to allow login via ssh/telnet/xdm for LDAP accounts. I can su into the account, but logins fail to no local accounts.

                       Matthew W. Mauzy
                     Systems Administrator
                     Applied Math @ UNC-CH
email : mauzy@amath.unc.edu           pager : mpager@amath.unc.edu
(W) 919.962.9819   www.amath.unc.edu/~mauzy/   (P) 919.347.0390