LDAP-UX Client Services B.04.00 Release Notes

LDAP-UX Client Services Release Notes

LDAP-UX Client Services Overview

Chapter 16

using PAM-Kerberos. Refer to the “SASL/GSSAPI Support” section

in LDAP-UX Client Services B.04.00 with Microsoft Windows

2000/2003 Administrator’s Guide for details.

• Support for pam-authz login authorization enhancements

Prior to LDAP-UX Client Services version B.04.00, pam_authz uses

netgroups as the method to deﬁne access rights to an HP-UX host or

other pam-enabled applications. For this release, pam_authz has

been enhanced to provide administrators a simple policy ﬁle,

/etc/opt/ldapux/pam_authz.policy, to set up a local access policy

to better meet their need in the organization. pam_authz uses the

access policy deﬁned in the policy ﬁle to determine which users are

allowed to login to the system. A policy speciﬁes which groups, ldap

groups, users or other access control objects (such as ldap search

ﬁlters) are allowed to login to the system. For detailed information on

how to construct access rules in

/etc/opt/ldapux/pam_authz.policy, refer to the “PAM_AUTHZ

Services B.04.00 Administrator’s Guide.

• Update LDAP C SDK and commands to Mozilla version 5.14.1

This release of LDAP-UX Client Services updates the LDAP C SDK

and LDAP commands ldapsearch, ldapmodify, ldapcmp,

ldapcompare, to Mozilla version 5.14.1.

• Support for Windows 2003 and SFU 3.5

LDAP-UX Client Services B.04.00 has been enhanced to support

Window 2003 Active Directory Server and Services for Unix (SFU)

3.5. To improve support for multiple domains, the conﬁguration

proﬁle has been moved from cn=Configuration,... to cn=System,...

• Support SSL for proﬁle download

Prior to LDAP-UX Client Services B.04.00, SSL support in LDAP-UX

was limited to user authentication (libpam_ldap) and the name

service subsystem (libnss_ldap). With this release, SSL is now

supported for secure download of the conﬁguration proﬁle. SSL

support of proﬁle download can assure that the LDAP directory

server hosting the LDAP-UX conﬁguration can not be impersonated.

• netgroup() case insensitive enhancement