LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)

Figure 2-2 Example Directory Structure for Multiple Domains
DC=cup, DC=hp, DC=com
CN=Configuration CN=Users
profile
data
group
data
user
data
DC=<name2>,DC=cup, DC=hp, DC=com
CN=Configu
ration
CN=Users
profile
data
group
data
user
data
DC=<name1>,DC=cup,DC=hp, DC=com
CN=Configur
ation
CN=Users
profile
data
group
data
user
data
NOTE: By default, the CN=configuration, DC=cup, DC=hp, DC=com configuration
container only exists in the root domain. To create the standard profile path for each child
domain, in LDAP-UX, you need to manually create the containers CN=Configuation in
each child domain, using ADSI Edit before you run the setup tool to configure profiles.
Write your configuration profile DN on the worksheet in Appendix A.
• By what method will client systems bind to the directory?
By default, Active Directory does not grant enough access rights to retrieve user and group
information by anonymous access. Therefore, a proxy user needs to be configured.
Write your proxy user DN on the worksheet in Appendix A.
• How will you set up /etc/pam.conf? What other authentication do you want to use and
in what order?
PAM provides authentication services. You can configure PAM to use LDAP, Kerberos, or
other traditional UNIX locations (for example: files, NIS, NIS+) as controlled by NSS. Refer
to pam(3), pam.conf(4), and Managing Systems and Workgroups at http://docs.hp.com/hpux/os
for more information on PAM.
• Do you want to use SSL or TLS for secure communication between LDAP clients and the
Windows 2000, 2003 or 2003 R2 Active Directory Server?
The LDAP-UX Client Services supports SSL or TLS with password as the credential, using
either simple or SASL GSSAPI authentication (SASL GSSAPI is available for the Windows
2000, 2003 or 2003 R2 Active Directory Server only) to ensure confidentiality and data
integrity between the clients and servers. StartTLS is a new extension operation of TLS
(Transport Layer Security) protocol. You can utilize the startTLS operation to set TLS secure
communication over an un-encrypted ( a regular) LDAP port. The secure connection can
also be established on an encrypted LDAP port when using SSL. By default, SSL and TLS
are disabled. For detailed information, refer to “Configuring the LDAP-UX Client Services
with SSL or TLS Support” (page 49).
Planning Your Installation 27