LDAP-UX Client Services B.05.00 with Microsoft Windows Active Directory Server Administrator's Guide (obsolete beyond B.05.00)

host name of the directory server (which could lead to a catch-22). However, since certificates
normally embed the host name or fully qualified host name and LDAP-UX only has the IP address
of the host, it is not possible for LDAP-UX to verify the host name on the certificate.
If you want to configure the CNCERT validation level with the peer_cert_policy parameter,
you must manually execute the following configuration steps:
1. Update the preferredserverlist setting in the profile to contain the host name of the
LDAP server such that it matches the host name specified in the LDAP server’s certificate. See
the Modifying perferredserverList in the LDAP-UX Profile section for details.
2. Select and execute one of the following steps:
• Either LDAP-UX must not be used for host-name resolution by removing “ldap” from the
“hosts” service in the /etc/nsswitch.conf file.
• Or the host name and IP address must be provided by some other name resolution service,
such as “files” or “dns”, and that service must appear before “ldap” in the
/etc/nsswitch.conf file for the “hosts” service.
2.4.6.2.2.1 Modifying preferredSererList in the LDAP-UX profile
Use the following steps to modify the value of the preferredServerList attribute in the LDAP-UX
configuration profile:
1. Run the following steps to find the name of the LDAP server used on the server certificate.
Assuming this certificate has been installed in your local certificate database file, /etc/opt/
ldapux/cert8.db:
• Run the following commands to list all server certificates used by LDAP-UX:
cd /etc/opt/ldapux
certutil -d . -L
• Run the following command to select the nickname of the certificate from the above list:
certutil -d . -L -n <selected nickname>
• Select the first name component of the “Subject:” name. For example, if the
“Subject:” string is “CN=ldapserver.example.com, O=Example Corp” then
the name component would be “ldapserver.example.com".
NOTE: Depending on how your certificate administrator manages your network, the above
server certificate may not be found in your cert8.db file. Instead you may only find certificates
for any trusted Certificate Authorities. In this case, contact your certificate administrator for
the LDAP server certificate details.
2. In a separate window, use the Active Directory Services Interface (ADSI) to modify the value
of the preferredServerList attribute with the LDAP server name found in step 1. See
Section 6.14 (page 130) for detailed information on changing LDAP-UX configuration profile
settings manually.
3. Examine the “preferedServerList” attribute
4. Use the nslookup tool to verify the IP address specified in the preferred server list matches
that of the name of the host name found in step 1 above.
For example, if the preferredserverlist attribute value is 192.168.1.1:636 and “Subject”
is CN=ldapserver.example.com,O=Example Corp, then
$ nslookup 192.168.1.1
Name Server: dns-resolver.example.com
Address: 192.169.1.254
Trying DNS
2.4 Customized installation (setup) 51