[OpenIndiana-discuss] Setting up Ldap client

[Chris Ridd]

On 25 Dec 2011, at 09:27, Ram Chander wrote:

> Hi,
> 
> I am trying to setup ldap client   and authentication on OpenIndiana  but
> no success. I searched on internet but couldnt get proper steps.
> Can someone pls  provide detailed steps on how to setup the same and which
> packages to install ?

Is your directory server already running with all the right entries in? If not, get that working first.

Once the server's working, I have a shell script I run on each Solaris client that sets up ldapclient in "manual" mode. Before running it make sure your /etc/nsswitch.ldap file contains a good value for hosts. It'll automatically get copied to /etc/nsswitch.conf by ldapclient. The shell script just runs:

ldapclient -v manual \
        -a defaultServerList=127.0.0.1 \
        -a defaultSearchBase=o=MyCompany \
        -a authenticationMethod=simple \
        -a proxyDN=cn=Dummy,ou=System,o=MyCompany \
        -a proxyPassword=dummy

The last two "proxy" lines are necessary but not used. (A longstanding upstream misfeature.) This sets up the client to do anonymous searches for user/group/etc details.

To test that config works, run things like /usr/bin/id and /usr/bin/getent. You should find that data is being returned from your LDAP server. It helps if you can set up some LDAP-only groups or something so that testing shows something "obviously" from LDAP. If not, run "ldapclient uninit", and try "ldapclient -v manual" again with different args.

Setting up authentication is a little more fiddly. Don't start this until you have ldapclient configured properly.

You have to edit /etc/pam.conf and append "<service> auth required pam_ldap.so.1" to each section. I think you also have to edit the previous line to "<service> auth binding pam_unix_auth.so.1 server_policy", but I don't have a stock OI pam.conf file to hand to check.

Here's the section for the login service in mine:

login   auth requisite          pam_authtok_get.so.1
login   auth required           pam_dhkeys.so.1
login   auth required           pam_unix_cred.so.1
login   auth binding            pam_unix_auth.so.1 server_policy
login   auth required           pam_ldap.so.1

Changes to pam.conf take immediate effect. You may need to tweak sshd_config as well.

Cheers,

Chris