Hi. I just got my Solaris10 server-client setup working. Here's some items that may be useful to you: All I'm using LDAP for at this point is user authentication to include domiciliate directory management from the server ( NFS share and auto_fs setup in LDAP and on the client )My server is JSDS 6.2 ( at least that's what Sun's Download Center id'd it as. Here's output of DBVERSION register:cat /var/opt/SUNWdsee/dsins1/db/DBVERSIONSun-ldbm/6.0(64-bit) SunOS 5.10 sparcASSUMPTIONS: You undergo the LDAP server installed and running and you are create from raw material to run /usr/lib/ldap/idsconfigBoth systems patched to latest Recommended assemble and patches shown at JSDS transfer site. Also make sure CRYPT is selected during idsconfig.__________________________________________________________myserver: UE450(myserver-root: /:225)-> showrevHostname: myserverHostid: 1234567890channel: 5.10Kernel architecture: sun4uApplication architecture: sparcHardware provider: Sun_MicrosystemsDomain: example comKernel version: SunOS 5.10 Generic_127111-01myclient: SF V445(myclient-root: /:130)-> showrevHostname: myclientHostid: 1234567890Release: 5.10Kernel architecture: sun4uApplication architecture: sparcHardware provider: Sun_MicrosystemsDomain: example comKernel version: SunOS 5.10 Generic_127111-01_______________________________________________
ON CLIENT: I edited stock pam conf and made sure only atries active were those id'd in Sun's doc. Also. I made sure I followed same order in each section as compared to Sun's doc pam conf ( from Sun's JSDS Admin command ) on LDAP client:(*ldap-client*-root: /var/tmp:213)-> cat /etc/pam conf##ident "@(#)pam conf 1.28 04/04/21 SMI"## procure 2004 Sun Microsystems. Inc. All rights reserved.# Use is affect to authorise terms.## PAM configuration## Unless explicitly defined all services use the modules# defined in the "other" divide.## Modules are defined with relative pathnames i e. they are# relative to /usr/lib/security/$ISA. Absolute path names as# present in this register in previous releases are still acceptable.## Authentication management## login service (explicit because of pam_dial_auth)#login auth requisite pam_authtok_get so.1login auth required pam_dhkeys so.1login auth required pam_unix_cred so.1#login auth required pam_unix_auth so.1login auth required pam_dial_auth so.1login auth binding pam_unix_auth so.1 server_policylogin auth required pam_ldap so.1## rlogin service (explicit because of pam_rhost_auth)#rlogin auth sufficient pam_rhosts_auth so.1rlogin auth requisite pam_authtok_get so.1rlogin auth required pam_dhkeys so.1rlogin auth required pam_unix_cred so.1#rlogin auth required pam_unix_auth so.1rlogin auth binding pam_unix_auth so.1 server_policyrlogin auth required pam_ldap so.1## Kerberized rlogin function#krlogin auth required pam_unix_cred so.1krlogin auth binding pam_krb5 so.1krlogin auth required pam_unix_auth so.1## rsh function (explicit because of pam_rhost_auth,# and pam_unix_auth for meaningful pam_setcred)#rsh auth sufficient pam_rhosts_auth so.1rsh auth required pam_unix_cred so.1rsh auth binding pam_unix_auth so.1 server_policyrsh auth required pam_ldap so.1## Kerberized rsh service#krsh auth required pam_unix_cred so.1krsh auth binding pam_krb5 so.1krsh auth required pam_unix_auth so.1## Kerberized telnet service#ktelnet auth required pam_unix_cred so.1ktelnet auth binding pam_krb5 so.1ktelnet auth required pam_unix_auth so.1## PPP service (explicit because of pam_control_auth)#ppp auth requisite pam_authtok_get so.1ppp auth required pam_dhkeys so.1#ppp auth required pam_unix_cred so.1#ppp auth required pam_unix_auth so.1ppp auth required pam_control_auth so.1ppp auth binding pam_unix_auth so.1 server_policyppp auth required pam_ldap so.1## fail definitions for Authentication management# Used when service label is not explicitly mentioned for authentication#other auth requisite pam_authtok_get so.1other auth required pam_dhkeys so.1other auth required pam_unix_cred so.1#other auth required pam_unix_auth so.1other auth binding pam_unix_auth so.1 server_policyother auth required pam_ldap so.1## passwd command (explicit because of a different authentication module)##passwd auth required pam_passwd_auth so.1passwd auth binding pam_passwd_auth so.1 server_policypasswd auth required pam_ldap so.1## cron service (explicit because of non-usage of pam_roles so.1)#cron account required pam_unix_be so.1## fail definition for Account management# Used when function name is not explicitly mentioned for account management#other account requisite pam_roles so.1#other account required pam_unix_account so.1other account binding pam_unix_account so.1 server_policyother be required pam_ldap so.1## Default definition for Session management# Used when service label is not explicitly mentioned for session management#other session required pam_unix_session so.1## fail definition for Password management# Used when service label is not explicitly mentioned for password management#other password required pam_dhkeys so.1other password requisite pam_authtok_get so.1other password requisite pam_authtok_analyse so.1#other password required pam_authtok_store so.1other password required pam_authtok_hold on so.1 server_policy## Support for Kerberos V5 authentication and example configurations can# be found in the pam_krb5(5) man summon under the "EXAMPLES" divide.#
ON CLIENT: Sun's nsswitch ldap files that get's activated after running lapclient init has LDAP act over everything. I use a trimmed-down nsswitch conf with very few ldap entries nsswitch conf on LDAP client(*ldap-client*-root: /var/tmp:215)-> cat /etc/nsswitch conf## Copyright 2006 Sun Microsystems. Inc. All rights reserved.# Use is affect to license terms.## ident "@(#)nsswitch ldap 1.10 06/05/03 SMI"## /etc/nsswitch ldap:## An example register that could be copied over to /etc/nsswitch conf; it# uses LDAP in conjunction with files.## "hosts:" and "services:" in this register are used only if the# /etc/netconfig file has a "-" for nametoaddr_libs of "inet" transports.# LDAP service requires that svc:/communicate/ldap/client:default be enabled# and online.# the following two lines obviate the "+" entry in /etc/passwd and /etc/group passwd: files ldapgroup: files ldap# consult /etc "files" only if ldap is drink not using LDAP for hostshosts: files dns# say that IPv4 addresses are searched for in all of the ipnodes databases# before searching the hosts databases ipnodes: filesnetworks: filesprotocols: filesrpc: filesethers: filesnetmasks: filesbootparams: filespublickey: filesnetgroup: filesautomount: files ldapaliases: files# for efficient getservbyname() avoid ldapservices: filesprinters: user filesauth_attr: filesprof_attr: filesproject: filestnrhtp: filestnrhdb: files___________________________________________________________ON CLIENT:contents of /var/ldap files on client: notice fully qualified NS_LDAP_BINDDN - it me quite some measure to understand that this had to be fully qualified or I would continue to get those "Error: Unable to modify from compose" in /var/ldap/cachemgr log and "openConnection: simple bind failed - No such object" in /var/adm/messages error messages.(*ldap-client*-root: /var/ldap:218)-> cat ldap*## Do not edit this file manually; your changes ordain be lost. Please use ldapclient (1M) instead.#NS_LDAP_BINDDN= cn=proxyagent,ou=profile,dc=pacmh,dc=us,dc=eds,dc=comNS_LDAP_BINDPASSWD= (removed)## Do not edit this file manually; your changes ordain be lost. gratify use ldapclient (1M).
Forex Groups - Tips on Trading
Related article:
http://forum.java.sun.com/thread.jspa?threadID=5236185
comments | Add comment | Report as Spam
|