LDAP-UX Client Services B.04.10 with Microsoft Windows Active Directory Server Administrator's Guide

User Cannot Log on to Client System
If a user cannot log in to a client system, perform the following checks.
• Use a command like pwget(1) with -n, or nsquery(1)
2
to verify that NSS is working:
pwget -n username
nsquery passwd username
If the output shows LDAP is not being searched, check /etc/nsswitch.conf to make
sure LDAP is specified. If username is not found, make sure that user is in the directory and,
if using a proxy user, make sure the proxy user is properly configured.
If nsquery(1) displays the user's information, make sure/etc/pam.conf is configured
correctly for Kerberos. If/etc/pam.conf is configured correctly, check the directory's
policy management status. It could be the directory's policy management is preventing the
bind because, for example the user's password has expired or the login retry limit has been
exceeded. To check this try an ldapsearch command and bind as the user, for example:
cd /opt/ldapux/bin
./ldapsearch -h servername -b "CN=Users,DC=cup,DC=hp,DC=com"
msSFUName=username -D <directory Administrator DN> -w passwd
./ldapsearch -h servername -b "CN=Users,DC=cup,DC=hp,DC=com"
-D userDN" -w passwd msSFUName=username
where userDN is the DN of the user who cannot log in and username is the login of the user.
If you cannot bind as the user, check if any directory policies are preventing access.
See below for an example of determining the user's bind DN.
• Display the current configuration profile and check all the values to make sure they are as
you expect:
cd /opt/ldapux/config
./display_profile_cache
In particular, check the values for the directory server host and port, the default search base
DN, and the credential level. Also, if you have remapped any standard attributes to alternate
attributes, or defined any custom search descriptors, make sure these are correct and exist
in your database. If any of these are incorrect, correct them as described in “Modifying a
Profile” (page 124).
• If you are using a proxy user, make sure the configuration is correct as described in “Verifying
the Proxy User” (page 123).
• Make sure the client system can authenticate to the directory and find a user in the directory
by searching for one of your user's information in the directory. Use theldapsearch
command and information from the current profile.
Try searching for a user's information in the directory as the proxy user with a command
similar to following:
cd /opt/ldapux/bin
./ldapsearch-h servername -b "baseDN" -D <proxy user DN> -w\ passwd
msSFUName=username
using the name of your directory server (from display_profile_cache), search base
DN (from display_profile_cache), proxy user (from ldap_proxy_config -p),
proxy user password, and a user name from the directory.
For example:
cd /opt/ldapux/bin
2. nsquery(1) is a contributed tool included with the ONC/NFS product.
130 Administering LDAP-UX Client Services