LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)

You can also find out from where in the directory the client downloaded the profile by displaying
the file /etc/opt/ldapux/ldapux_client.conf and looking for the line beginning with
PROFILE_ENTRY_DN, for example:
grep ^PROFILE_ENTRY_DN /etc/opt/ldapux/ldapux_client.conf
PROFILE_ENTRY_DN="CN=Profile1, CN=Configuration, DC=cup, DC=hp, DC=com"
Creating a New Profile
To create a new profile, run /etc/ldapux/config/setup.When setup requests the DN of
the profile, give a DN that does not exist and setup prompts you for the parameters to build a
new profile. The setup program also configures the local client to use the new profile.
Alternatively, you can use your directory administration tools to make a copy of an existing
profile and modify it.
You can also use the interactive tool create_profile_entry to create a new profile as follows:
cd /opt/ldapux/config
./create_profile_entry
Once you create a new profile, configure client systems to use it as described in “Changing Which
Profile a Client is Using” (page 142).
Modifying a Profile
You can modify an existing profile directly using the Active Directory Services Interface (ADSI).
Refer to “LDAP-UX Client Services Object Classes” (page 159) for a complete description of the
PosixDUAProfile and PosixNamingProfile object classes, their attributes, and what values
each attribute can have.
After modifying a profile, each client that regularly downloads its profile automatically will get
the changes as scheduled. Refer to “Downloading the Profile Periodically” (page 55) for details.
Changing Which Profile a Client is Using
Each client uses the profile specified in its startup file
/etc/opt/ldapux/ldapux_client.conf. To make a client use a different profile in the
directory, edit this file and change the DN specified in the PROFILE_ENTRY_DN line. Then
download the profile as described in “Downloading the Profile Periodically” (page 55).
Creating an /etc/krb5.keytab File
In the ADS multiple domain environment, your HP-UX client machine will communicate with
multiple Windows 2000 or 2003 domain controllers. To set up Kerberos authentication, your
HP-UX host needs to have a service key known by every domain controller, which also acts as
KDC. The service key is created on Windows 2000 or 2003 Server using ktpass (described in
step 5 of "“Configuring Active Directory for HP-UX Integration” (page 30)"). After you create
the service key file on each domain controller, you need to securely transfer it to your HP-UX
machine. All service key files must be merged and stored in /etc/krb5.keytab.
For example, if you integrate LDAP-UX with ADS multiple domains so that users from DomainA,
DomainB, and DomainC can log into your HP-UX client machine, you will need to create the
service key on each domain controller (say domainA.keytab on DomainA, domainB.keytab
on DomainB and domainC.keytab on DomainC), then transfer those files into your HP-UX
machine. Finally, merge all three service key files to create /etc/krb5.keytab. Use ktutil
to merge service key files on your HP-UX machine:
# /usr/sbin/ktutil
ktutil: rkt domainA.keytab
ktutil: rkt domainB.keytab
142 Administering LDAP-UX Client Services