LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)

the host name or fully qualified host name and LDAP-UX only has the IP address of the host, it
is not possible for LDAP-UX to verify the host name on the certificate.
If you want to configure the CNCERT validation level with the peer_cert_policy parameter,
you must manually execute the following configuration steps:
1. Update the preferredserverlist setting in the profile to contain the host name of the
LDAP server such that it matches the host name specified in the LDAP server’s certificate.
See the “Modifying perferredserverList in the LDAP-UX Profile” section for details.
2. Select and execute one of the following steps:
• Either LDAP-UX must not be used for host-name resolution by removing “ldap” from
the “hosts” service in the /etc/nsswitch.conf file.
• Or the host name and IP address must be provided by some other name resolution
service, such as “files” or “dns”, and that service must appear before “ldap” in the
/etc/nsswitch.conf file for the “hosts” service.
Modifying preferredSererList in the LDAP-UX Profile
Use the following steps to modify the value of the preferredServerList attribute in the
LDAP-UX configuration profile:
1. Run the following steps to find the name of the LDAP server used on the server certificate.
Assuming this certificate has been installed in your local certificate database file,
/etc/opt/ldapux/cert8.db:
• Run the following commands to list all server certificates used by LDAP-UX:
cd /etc/opt/ldapux
certutil -d . -L
• Run the following command to select the nickname of the certificate from the above
list:
cetutil -d . -L -n <selected nickname>
• Select the first name component of the “Subject:” name. For example, if the
“Subject:” string is “CN=ldapserver.example.com, O=Example Corp” then
the name component would be “ldapserver.example.com".
NOTE: Depending on how your certificate administrator manages your network, the above
server certificate may not be found in your cert8.db file. Instead you may only find
certificates for any trusted Certificate Authorities. In this case, contact your certificate
administrator for the LDAP server certificate details.
2. In a separate window, use the Active Directory Services Interface (ADSI) to modify the value
of the preferredServerList attribute with the LDAP server name found in step 1. See
“Modifying a Profile” (page 142) for detailed information on changing LDAP-UX configuration
profile settings manually.
3. Examine the “preferedServerList” attribute
4. Use the nslookup tool to verify the IP address specified in the preferred server list matches
that of the name of the host name found in step 1 above.
For example, if the preferredserverlist attribute value is 192.168.1.1:636 and “Subject”
is CN=ldapserver.example.com,O=Example Corp, then
$ nslookup 192.168.1.1
Name Server: dns-resolver.example.com
Address: 192.169.1.254
Trying DNS
Name: ldapserver.example.com
Address: 192.168.1.1
54 Installing LDAP-UX Client Services