LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)

7. Run the setup program to configure LDAP-UX Client Services on a client system. Setup
does the following for you:
• Extends your Active Directory schema with the configuration profile schema, if not
already done.
• Creates a start-up file on the client. This enables each client to download the
configuration profile.
• Creates a configuration profile of directory access information in the directory, to be
shared by a group of (or possibly all) clients.
If the ADS multiple domains feature has been selected, Setup will also create the remote
domains profiles, Global Catalog server (GCS) profile, or both.
• Downloads the configuration profile from the directory to the client.
• Starts the product daemon, ldapclientd, if you choose to start it.
8. Modify the files /etc/pam.conf and /etc/nsswitch.conf on the client to specify
Kerberos authentication and LDAP name service, respectively.
9. Optionally modify the disable_uid_range flag in the
/etc/opt/ldapux/ldapux_client.conf file to disable user login uids to the local
system from specific users on the LDAP server. Refer to “Step 6: Configure the Disable Login
Flag” (page 46).
10. Verify each client is working properly. Refer to “Step 7: Verify LDAP-UX Client Services
for Single Domain” (page 46).
11. Also refer to “Step 8: Configure Subsequent Client Systems” (page 49) for some shortcuts.
Planning Your Installation
Before beginning your installation, plan how to set up and verify your Active Directory and your
LDAP-UX Client Services environment. Consider the following questions. Record your decisions
and configuration information in “Configuration Worksheet” (page 157).
• Will Active Directory be set up with a single domain or multiple domains?
Starting from the release of B.03.00, LDAP-UX allows you to store your password and group
data in multiple domains. You need to decide if you want to store data in a single domain
or multiple domains. If multiple domains are selected, decide how to group data into different
domains. Data could be grouped based on organization, geography, or any variable
appropriate to your environment.
• If multiple domains are selected, how will data be stored in the forest?
LDAP-UX Client Services treats the first domain configured as the local domain, and all
other domains in the forest as remote domains. When retrieving data, the search always
starts from the local domain. Frequently accessed information should be stored in the local
domain.
For remote domains, information can be stored in every remote domain or only in some
remote domains. Determine the appropriate structure for your environment.
• If multiple domains are selected, how will data be retrieved?
When multiple domains are selected, LDAP-UX Client Services has search rules for remote
domains. For information about configuring the search sequence, refer to “Active Directory
Multiple Domains” (page 57).
• How many directory databases are needed?
Each client system binds to an Active Directory server containing your supported name
service data (such as user and group data). On Active Directory networks, each domain
controller contains a copy of the Active Directory database.
24 Installing LDAP-UX Client Services