LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)
Table Of Contents
- LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Administrator's Guide
- Table of Contents
- Preface
- 1 Introduction
- 2 Installing LDAP-UX Client Services
- Before You Begin
- Summary of Installing and Configuring LDAP-UX Client Services
- Planning Your Installation
- Installing LDAP-UX Client Services on a Client
- Configuring Active Directory for HP-UX Integration
- Step 1: Install Active Directory
- Step 2: Install SFU 2.0, 3.0 or 3.5 including Server for NIS
- Step 3: Create a Proxy User
- Step 4: Add an HP-UX Client Machine Account to Active Directory
- Step 5: Use ktpass to Create the Keytab File for the HP-UX client machine
- Step 6: Add POSIX Attributes into the Global Catalog
- Importing Name Service Data into Your Directory
- Configuring LDAP-UX Client Services
- Step 1: Run the Setup Program
- Step 2: Install the PAM Kerberos Product
- Step 3: Configure Your HP-UX Machine to Authenticate Using PAM Kerberos
- Step 4: Configure the Name Service Switch (NSS)
- Step 5: Configure the PAM Authorization Service Module (pam_authz)
- Step 6: Configure the Disable Login Flag
- Step 7: Verify LDAP-UX Client Services for Single Domain
- Step 8: Configure Subsequent Client Systems
- Configuring the LDAP-UX Client Services with SSL or TLS Support
- Downloading the Profile Periodically
- 3 Active Directory Multiple Domains
- 4 LDAP-UX Client Services with AutoFS Support
- 5 LDAP Printer Configurator Support
- 6 Dynamic Group Support
- 7 Administering LDAP-UX Client Services
- Using the LDAP-UX Client Daemon
- Integrating with Trusted Mode
- SASL GSSAPI Support
- PAM_AUTHZ Login Authorization
- Policy And Access Rules
- How Login Authorization Works
- PAM_AUTHZ Supports Security Policy Enforcement
- Policy File
- Policy Validator
- Dynamic Variable Support
- Constructing an Access Rule in pam_authz.policy
- Static List Access Rule
- Dynamic Variable Access Rule
- Security Policy Enforcement with Secure Shell (SSH) or r-commands
- Adding Additional Domain Controllers
- Adding Users, Groups, and Hosts
- User and Group Management
- Displaying the Proxy User's Distinguished Name
- Verifying the Proxy User
- Creating a New Proxy User
- Displaying the Current Profile
- Creating a New Profile
- Modifying a Profile
- Changing Which Profile a Client is Using
- Creating an /etc/krb5.keytab File
- Considering Performance Impacts
- Client Daemon Performance
- Troubleshooting
- 8 Modifying User Information
- 9 Mozilla LDAP C SDK
- A Configuration Worksheet
- B LDAP-UX Client Services Object Classes
- C Command, Tool, Schema Extension Utility, and Migration Script Reference
- LDAP-UX Client Services Components
- Client Management Tools
- LDAP User and Group Management Tools
- Environment Variables
- Return Value Formats
- Common Return Codes
- The ldapuglist Tool
- The ldapugadd Tool
- The ldapugmod Tool
- The ldapugdel Tool
- The ldapcfinfo Tool
- LDAP Directory Tools
- Schema Extension Utility
- Name Service Migration Scripts
- Unsupported Contributed Tools and Scripts
- D Sample PAM Configuration File
- E Sample /etc/krb5.conf File
- F Sample /etc/pam.conf File for HP-UX 11i v1 Trusted Mode
- G Sample /etc/pam.conf File for HP-UX 11i v2 Trusted Mode
- H Sample PAM Configuration File for Security Policy Enforcement
- Glossary
- Index
full or relative path name or a short name. A short name is
defined as the distinguishing portion of the template file name.
For example, for the passwd service, if the short name “operator”
is specified, the resulting template file is
/etc/opt/ldapux/ug_templates/ug_passwd_operator.tmpl.
All LDAP-UX default template files are stored in the
/etc/opt/ldapux/ug_templates directory. A full or relative
path name must begin with a slash (/) or a period (.) character.
If you do not specify this argument, ldapugadd uses the default
template file
/etc/opt/ldapux/ug_templates/ug_passwd_default.tmpl.
-x <domain>
Optional. Specifies the user’s domain name. Use this option to
specify the ${domain} value that can be used in the template
file. If you do not specify this value, the domain name is created
by using the first dc component of the new user’s distinguished
name. If the distinguished name does not contain any dc
components, and the ${domain} variable is specified in the
template file, ldapugadd generates an error.
-m
Optional. Creates a new home directory for the defined user.
User and group ownership of the newly created directory is
assigned to the user and his/her primary login group. If the -k
option is specified, the files and sub-directories found in
<skel_dir> are copied to the user’s home directory, and user
and group ownership permissions are altered as specified above.
If the -k option is not specified, skeleton files are copied from
/etc/skel. The -m option requires the user has sufficient
privilege to create the new home directory, copy skeleton files
and change ownership of those files and directories. The
ldapugadd tool creates a user’s home directory only after
successfully adding the user entry to the directory server and
adding the user to the primary and secondary groups. If
ldapugadd is unable to properly create the user’s home
directory, per the above process, the newly created changes in
the directory server are not removed. See the “Security
Considerations” section below for more information.
-k <skel_dir> Optional. The ldapugadd tool ignores the -k option unless you
specify the -m option. The <skel_dir> argument specifies a
directory which contains skeleton files and directories that need
to be copied into newly created user home directories. Also see
-m.
<attr>=<value>[...]
Optional. Enables specification of arbitrary LDAP attributes and
values. Because of potential object class requirements, additional
information beyond the basic POSIX account and group data
you might need to specify in order to create new entries in the
LDAP directory server. For example, if the person object class
is used as a structural class for posixAccounts, then the sn
(surname) attribute must be specified in order to properly create
a new entry. This attribute needs to be defined in the template
file, and attribute/value pair needs to be specified at the end of
the ldapugadd command line. The<attr>=<value> parameter
is used to specify attributes required by the template file.
However, if an attribute is specified which is not defined in the
defined template file, that attribute/value pair is considered as
an optional attribute/value which will be added to the entry
exactly as specified. <attr>=<value> parameters are optional,
but you must specify them as the last parameters on the
command line.
LDAP User and Group Management Tools 191