HP UX LDAP-UX Integration Software instruction

Introduction

Overview of LDAP-UX Client Services

Figure 1-4

The Local Start-up File and the Conﬁguration Proﬁle

LDAP Directory
Conﬁguration	The shared conﬁguration
proﬁle	proﬁle is stored in the
	directory and downloaded
The start-up ﬁle points	to all LDAP-UX clients.
The start-up ﬁle points
to the conﬁguration
proﬁle in the directory.
Start-up	Conﬁguration
ﬁle	proﬁle
LDAP-UX client

The following chapter describes in detail how to install, conﬁgure, and verify LDAP-UX Client Services.

Chapter 1

7

Image 21

HP UX LDAP-UX Integration Software manual Local Start-up File and the Conﬁguration Proﬁle

Contents

Manufacturing Part Number J4269-90071 E0207 Edition Legal Notices Contents Administering LDAP-UX Client Services Command and Tool Reference User Tasks Tables Viii Figures Figures New and Changed Documentation in This Edition Intended Audience What’s in This document Publishing History Xiii HP Encourages Your Comments Typographical Conventions Chapter Overview of LDAP-UX Client Services Simpliﬁed NIS Environment Overview of LDAP-UX Client Services Trafﬁc from replica updates How LDAP-UX Client Services WorksSimpliﬁed LDAP-UX Client Services Environment Introduction Examples of Commands and Subsystems Commands that use Commands that use PAMThat use PAM and NSS Login, ftpd Ls, who Overview of LDAP-UX Client Services Local Start-up File and the Conﬁguration Proﬁle Overview of LDAP-UX Client Services Chapter Before You Begin LDAP-UX Client Services Summary of Installing and Conﬁguring Summary of Installing and Conﬁguring Optionally modify the /etc/opt/ldapux/pamauthz.policy Plan Your Installation Plan Your Installation Still log in to the system Share user names and passwords with other applications, Example Directory Structure Plan Your Installation Plan Your Installation Section must be set to yes. If the start option is enabled, Plan Your Installation Install LDAP-UX Client Services on a Client Install LDAP-UX Client Services on a Client Conﬁgure Your Directory Conﬁgure Your DirectoryStep Conﬁgure Your Directory Grant read access of all attributes of the posix schema Conﬁgure Your Directory Import Name Service Data into Your Directory Import Name Service Data into Your Directory Directory Steps to Importing Name Service Data into Your Conﬁgure the LDAP-UX Client Services Conﬁgure the LDAP-UX Client Services Conﬁgure the LDAP-UX Client Services Quick Conﬁguration Required to start the services Simple Sasl DIGEST-MD5 Conﬁguration Parameter Default Values Conﬁgure the LDAP-UX Client Services Custom Conﬁguration Specify up to three directory hosts, to be searched in order Specify the service you want to map? Specify the attribute you want to map You type 0 to exit this menu for the following question Answer Y instead of the default N For the question You want to create a custom search descriptor for Conﬁgure the LDAP-UX Client Serivces with SSL Support Conﬁgure the LDAP-UX Client Serivces with SSL Support Steps to Download the CA Certiﬁcate from Mozilla Browser Conﬁguring the LDAP-UX Client to Use SSL Mail users, and Trust the CA to identify software developers Use the rm command to remove the old database ﬁles Steps to create database ﬁles using the certutil utility Conﬁgure the LDAP-UX Client Serivces with SSL Support Conﬁgure LDAP-UX Client Services with Publickey Support Conﬁgure LDAP-UX Client Services with Publickey Support Enhanced Publickey-LDAP Software for HP-UX 11i v1 or JuneOctober Extending the Publickey Schema into Your Directory Admin Proxy UserConﬁguring an Admin Proxy User Using ldapproxyconﬁg Password for an Admin Proxy User Setting ACI for Key ManagementSetting ACI for an Admin Proxy User An Example Setting ACI for a User Conﬁguring serviceAuthenticationMethod Procedures Used to Conﬁgure serviceAuthenticationMethod Authentication Methods ServiceAuthenticationMethodkeyservsasl/digest-md5 Conﬁguring Name Service Switch Conﬁgure LDAP-UX Client Services with Publickey Support AutoFS Support Automount SchemasAutoFS Patch Requirement AutoFS Support Schema New Automount Schema An Example NisObject Automount Schema Obsolete Automount Schema Removing The Obsolete Automount SchemaLimitations Attribute Mappings New Automount Attribute NisObject Automount Attribute Mappings AutoFS Migration Scripts Migration Scripts DescriptionEnvironment Variables General Syntax For Migration Scripts Examples Syntax Migrateautomount.pl Script AutoFS Support Following shows the /tmp/autoindirect.ldif ﬁle Migratenisautomount.pl Script Following shows the nispautomap.ldif ﬁle Migratenispautofs.pl Script Verify the LDAP-UX Client Services Verify the LDAP-UX Client Services Making sure the output is as expected Verify the LDAP-UX Client Services #cat /etc/nsswitch.conf Conﬁgure Subsequent Client Systems Conﬁgure Subsequent Client Systems Change the current conﬁguration Download the Proﬁle Periodically Download the Proﬁle Periodically Crontab crontab.profile Use r-command for Pamldap Use r-command for Pamldap#passwordas = Password, and turning on the rcommand option for pamldap Use r-command for Pamldap Chapter Ldap Printer Conﬁgurator Overview DeﬁnitionsOverview System How the Ldap Printer Conﬁgurator works How the Ldap Printer Conﬁgurator works System administrator manually adds or removes printers to Printer Conﬁgurator Architecture Printer Conﬁguration Parameters Printer Conﬁguration Parameters Printer Schema Printer SchemaAn Example Printer Schema Managing the LP printer conﬁguration Managing the LP printer conﬁgurationExample Managing the LP printer conﬁguration Managing the LP printer conﬁguration Limitations of Printer Conﬁgurator Limitations of Printer Conﬁgurator Limitations of Printer Conﬁgurator Chapter Administering LDAP-UX Client Using The LDAP-UX Client Daemon Using The LDAP-UX Client DaemonOverview Starting the client LdapclientdControlling the client Client Daemon performance Diagnostics Command options Missing settings Ldapclientd.confConﬁguration ﬁle syntax Opt/ldapux/conﬁg/setup Using The LDAP-UX Client Daemon 100 Chapter 101 102 Chapter 103 Conﬁguration File Features and Limitations Integrating with Trusted ModeIntegrating with Trusted Mode Auditing Password and Account Policies PAM Conﬁguration File OthersChapter 107 Conﬁguration Parameter Policy And Access Rules Pamauthz Login Authorization EnhancementPamauthz Login Authorization Enhancement Chapter 109 Pamauthz Environment How Login Authorization Works Chapter 111 Policy File Fields in an Access Rule Constructing an Access Rule in pamauthz.policyField Syntax in an Access Rule Actiontyperule Chapter 113 Action No value is required Chapter 115 116 Chapter 117 Policy Validator Adding a Directory Replica Adding a Directory ReplicaAn Example of /etc/opt/ldapux/pamauthz.policy File Displaying the Proxy User’s DN Displaying the Proxy User’s DNChapter 119 Creating a New Proxy User Verifying the Proxy UserExample Verifying the Proxy User Creating a New Proﬁle Displaying the Current ProﬁleDisplaying the Current Proﬁle Chapter 121 Changing Which Proﬁle a Client Is Using Modifying a ProﬁleModifying a Proﬁle Access Changing from Anonymous Access to ProxyChanging from Proxy Access to Anonymous Access Changing from Anonymous Access to Proxy Access Changing from Proxy Access to Anonymous Access Minimizing Enumeration Requests Performance ConsiderationsPerformance Considerations Chapter 125 Client Daemon Performance Ldapclientd CachingClient Daemon Performance Chapter 127 Map Name Beneﬁts Example Side-Effect 128 Chapter 129 Ldapclientd Persistent Connections Troubleshooting TroubleshootingEnabling and Disabling LDAP-UX Logging Chapter 131 TIP Enabling and Disabling PAM Logging Netscape Directory Server Log Files User Cannot Log on to Client SystemChapter 133 134 Chapter 135 You should get output like the following 136 Chapter 137 Command and Tool Reference LDAP-UX Client Services Components LDAP-UX Client Services ComponentsLDAP-UX Client Services Components Description LDAP-UX Client Services Components Component DescriptionChapter 139 PA machine Files Description LDAP-UX Client Services Libraries on the HP-UX 11.0 or 11i LDAP-UX Client Services Libraries on the HP-UX 11i v2 PA Machine Files DescriptionChapter 141 LDAP-UX Client Services Libraries on the HP-UX 11i v2 IA Createproﬁleentry Tool Client Management ToolsCreateproﬁlecache Tool Client Management Tools Displayproﬁlecache Tool Createproﬁleschema Tool Chapter 145 Getproﬁleentry Tool Getprofileentry -s NSS Ldapproxyconﬁg Tool Chapter 147 File 148 Chapter 149 Beq Search Tool SyntaxBeq Search Tool Chapter 151 Examples 152 Chapter 153 Uid2dn Tool Ldap Directory Tools Getattrmap.pl ToolLdap Directory Tools Chapter 155 Ldapentry 156 Chapter 157 Ldapsearch Ldapmodify Ldapdelete Certutil Adding One or More Users Adding One or More UsersChapter 159 Name Service Migration Scripts Name Service Migration ScriptsDefault Naming Context Naming Context Migrating All Your Files Migrating Individual FilesChapter 161 General Syntax for Perl Migration Scripts Migration ScriptsMigration Scripts Script Name Description Chapter 163 Script Name Description 164 Chapter 165 Ldappasswd Command Ldappasswd Command Chapter 167 168 Chapter 169 To Change Passwords Cannot Change Passwords on Replica Servers To Change Passwords Chapter 171 172 To Change Personal Information To Change Personal InformationChapter 173 174 Chapter 175 Mozilla Ldap C SDK 176 Mozilla Ldap C SDK File Components Mozilla Ldap C SDK File ComponentsMozilla Ldap C SDK File Components on the PA machine Files Description Mozilla Ldap C SDK File Components on the IA machine Chapter 179 Header Files Description Mozilla Ldap C SDK API Header Files Chapter 181 182 Appendix a 183 Table A-1 LDAP-UX Client Services Conﬁguration Worksheet Appendix a Appendix a 185 186 Appendix B 187 Classes Proﬁle Attributes Proﬁle AttributesAppendix B Appendix B 189 190 Appendix C 191 ﬁle Appendix C Sample /etc/pam.ldap.trusted ﬁle Appendix C 193 194 Glossary PAM Authorization Service ModuleLdap Data Interchange Format Ldif Glossary 195 Glossary Slapd Index Symbols NIS, 2, 12, 15 Pwget, 4, 69 200