LDAP-UX Client Services B.04.10 with Microsoft Windows Active Directory Server Administrator's Guide

Configuring LDAP-UX Client Services
To configure the LDAP-UX Client Services, complete the steps in this section.
If you attempt to enable SSL or TLS support with LDAP-UX, you must configure the LDAP
directory server to support SSL or TLS and install the security database (cert7.db or cert8.db and
key3.db) on your client before you run the setup program. For SSL or TLS setup details, refer to
“Configuring the LDAP-UX Client Services with SSL or TLS Support” (page 49).
NOTE: The LDAP-UX Client Services provides default attributes and search descriptor settings
to work with Microsoft Windows Services for UNIX 3.0/3.5 (SFU 3.0/3.5) when working with the
Windows 2000, 2003 or 2003 R2 Active Directory.
If you use SFU 2.0 with the Windows 2000 or 2003 ADS, you can manually re-link the attribute
configuration file to SFU 2.0. Use this command to switch to SFU 2.0:
ln -fs /etc/opt/ldapux/defautl_profile_attr_ads_sfu2.ldif \
/etc/opt/ldapux/defuatl_profile_attr_ads.ldif
If you use the R2's RFC2307 schema with Windows 2003 R2 ADS, you can manually re-link the
attribute configuration file to R2's RFC2307. Use this command to switch to R2's RFC2307:
ln -fs /etc/opt/ldapux/defautl_profile_attr_ads_winr2.ldif \
/etc/opt/ldapux/defuatl_profile_attr_ads.ldif
LDAP-UX Client Services will also use SFU 3.0/3.5 in the absence of the softlink
/etc/opt/ldapux/defualt_profile_attr_ads.ldif.
You can also run the setup program to select and set the attribute map to be used with your
directory server.
Step 1: Run the Setup Program
This section describes in detail the steps you need to take to configure LDAP-UX Client Services
with Windows 2000, 2003, 2003 R2 Active Directory. In summary, you will need to run the setup
program to extend the profile schema into Active Directory and to create specific profile entries.
The setup program also creates the necessary files on your client system and configures the proxy
user.
If you want to use SSL or TLS, you must perform the following tasks before you run the setup
program:
• Ensure to have the certificate database files, cert8.db or cert7.db and key3.db, on your client
system.
• If you choose to use TLS, set the enable_starttls parameter to 1 in the
/etc/opt/ldapux/lldapux_client.conf file to enable TLS. To use SSL, set enable_starttls to
0 to disable TLS. By default, TLS is disabled.
• You need to install and configure PAM Kerberos Product before you run the setup program.
See the “Step 2: Install the PAM Kerberos Product” (page 44) section for details.
• Configure the Kerberos configuration file, /etc/krb5.conf, to specify the default realm,
the location of a Key Distribution Center (KDC) server and the logging file name. See the
“Step 3: Configure Your HP-UX Machine to Authenticate Using PAM Kerberos” (page 45)
section for details.
• Create a new proxy user. See the “Creating a New Proxy User” (page 123) section for details.
• Configure PAM Kerberos library, libpam_krb5.1 (on HP-UX 11i v1) or
libpam_krb5.so.1 (on HP-UX 11i v2) in the PAM configuration file, pam.conf. See
Appendix D (page 193) appendix for details.
1. Log in as root and run the setup program:
cd /opt/ldapux/config
./setup
36 Installing LDAP-UX Client Services