LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)

a. Create or import a POSIX user account into an ADS remote domain (for example, the
user account smith, this is identical to how you set it up for a single domain, except
now you put it into a remote domain).
b. If pwget -n smith returns valid data, LDAP-UX is working with ADS multiple
domains. If no data was returned, the setup was not successful.
Step 8: Configure Subsequent Client Systems
Once you have configured your directory and one client system, you can configure subsequent
client systems using the following steps. Modify any of these files as needed.
1. Use swinstall to install LDAP-UX Client Services on the client system. This requires
rebooting the client system.
2. Copy the following files from a configured client to the client being configured:
• /etc/opt/ldapux/ldapux_client.conf
• /etc/opt/ldapux/pcred only if you have configured a proxy user, not if you are
using only anonymous access
• /etc/pam.conf
• /etc/nsswitch.conf
• cert7.db or cert8.db and key3.db flles if SSL is enabled
3. Download the profile by running get_profile_entry as follows:
cd /opt/ldapux/config
./get_profile_entry -s nss -D bindDN -w password
If you are using multiple domains, download profiles for the GCS and each remote domain.
Refer to “Command, Tool, Schema Extension Utility, and Migration Script Reference”
(page 163), section titled "The get_profile_entry Tool" for information about downloading
these profiles.
Alternatively you could interactively run the setup program to download the profile from
the directory and respond No when prompted to select if you want to change the current
configuration:
cd /opt/ldapux/config
./setup
4. If you are using a proxy user, verify the proxy user by calling ldap_proxy_config as
follows:
cd /opt/ldapux/config
./ldap_proxy_config -v
5. Refer to "Verify the LDAP-UX Client Services for Single Domain" for more information to
verify the installation and configuration of your LDAP-UX Client Services.
Configuring the LDAP-UX Client Services with SSL or TLS Support
The LDAP-UX Client Services provides SSL (Socket Security Layer) support to secure
communication between LDAP clients and the Active Directory Servers. An encrypted connection
can be established on an encrypted port, 636. The LDAP-UX Client Services supports SSL with
password as the credential, using either simple bind or SASL GSSAPI authentication to ensure
confidentiality and data integrity between clients and servers.
The LDAP-UX Client Services supports Microsoft Windows 2000, 2003 or 2003 R2 Active Directory
Server (ADS), Netscape Directory Server (NDS) 6.x and Red Hat Directory Server 7.0/7.1 over
SSL. For detailed information on how to enable SSL communication over LDAP for your Windows
2000 Active Directory Server, refer to Microsoft Knowledge Base Article Q247078 at
http://support.microsoft.com/default.aspx?scid=kb;en-us;247078
Configuring the LDAP-UX Client Services with SSL or TLS Support 49