LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)

• What authentication method will you use when you choose to enable TLS?
You have a choice between SIMPLE (the default), or SASL GSSAPI with TLS.
LDAP-UX Client Services includes support for the SASL Generic Security Services Application
Programming Interface (GSSAPI) authentication method using Kerberos v5. Currently,
Kerberos v5 is the only security mechanism that is implemented to work with GSSAPI. For
this release, we only provide SASL GSSAPI authentication method support for Microsoft
Windows 2000, 2003 or 2003 R2 Active Directory. SASL GSSAPI authentication is only for
proxy user authentication for the name service subsystem. Host, service or other principles
may be used for the LDAP-UX proxy identity. For detailed information on SASL GSSAPI
support, see “SASL GSSAPI Support” (page 102).
• What authentication method will you use when you choose to enable SSL?
You have a choice between SIMPLE (the default), or SASL GSSAPI with SSL.
• What authentication method will you use when you choose to not enable SSL or TLS?
You have a choice between SIMPLE (the default), or SASL GSSAPI.
• Do you want to specify the keytab file when you use SASL GSSAPI authentication.
LDAP-UX Client Services allows you to specify the keytab file when you use the SASL
GSSAPI authentication. You can run the setup program to specify the keytab file. If no file
is specified, LDAP-UX will use the default keytab file configured in /etc/krb5.conf
using default_keytab_name. If there is no default keytab file configured in
/etc/krb5.conf, then the keytab file /etc/krb5.keytab file is used.
• Do you want to store and manage automount maps in the LDAP directory? If so, the setup
program can be used to import the new automount schema into your LDAP directory server.
LDAP-UX Client Services B.04.10 supports the automount service under the AutoFS
subsystem. This new feature allows you to store or retrieve automount maps in/from an
LDAP directory. LDAP-UX Client Services supports the new automount schema based on
RFC2307-bis.
The setup program will import the new automount schema into your Directory Server.
For the detailed information about AutoFS with LDAP support, see the “LDAP-UX Client
Services with AutoFS Support” chapter.
• What name services will you use? How will you set up /etc/nsswitch.conf? What order
do you want NSS to try services?
NSS is the Name Service Switch, providing naming services for user names, group names,
and other information. You can configure NSS to use files, LDAP, or NIS in any order and
with different parameters. Refer to /etc/nsswitch.ldap for an example nsswitch.conf
file using files and LDAP. Refer to switch(4) and "Configuring the Name Service Switch"
in Installing and Administering NFS Services at http://docs.hp.com/hpux/communications/ for
more information.
It is recommended you use files first, followed by LDAP for passwd, group and other
supported name services. With this configuration, NSS will first check files, then check the
directory if the user or group is not in the respective files. /etc/nsswitch.ldap is an
example of this configuration.
• Do you need to set up login authorization for a subset of users from a large repository such
as an LDAP directory? How will you set up the /etc/opt/ldapux/pam_authz.conf
and /etc/pam.conf files to implement this feature?
The pam_authz service module for PAM provides functionality that allows the administrator
to control who can login to the system. These modules are located at
/usr/lib/security/libpam_authz.1 on the HP 9000 machine and at libpam_authz.so.1 on the
Integrity (ia64) machine. pam_authz has been created to provide access control. Starting
28 Installing LDAP-UX Client Services