hpss_ldap_import to convert DCE authorization information into LDAP.
•Kerberos authentication and Unix authorization. In this case, the site deter mines on its own
how to convert DCE authentication information into Kerberos. The site will then use
hpss_unix_import to convert DCE authorization information into Unix. Depending on
environment variables, the hpss_unix_import program may import authentication information
(i.e. Create a password for the Unix user) into Unix. The site could manually reset or remove
the password from the converted Unix accounts if this is an issue after running the
hpss_unix_import program.
6.2.3.1. Authentication Me chanisms
A site may select between Unix or Kerberos authentication. Some pros and cons of each ar e listed
below.
Unix:
•Cross cell authentication is not supported.
•Can choose to use either system password or HPSS password file.
•Can degrade performance as the number of HPSS users increases due to sequential seeking
through password file.
•Encryption is performed using Unix encrypt function.
•HPSS servers/processes utilize Unix keytab file.
•Can use LDAP or Unix as authorization mechanism.
•The hpss_dce_export and hpss_unix_import utilities are provided to convert DCE
authentication information.
Kerberos:
•Cross cell authentication information is not converted; thus, not covered in this document.
•Using an institutional Kerberos server can complicate conversion if UID conflicts exist s
between current DCE principals or groups and existing Kerberos principals or groups.
•Uses underlying Kerberos encryption algorithms.
•HPSS servers/processes utilize Kerberos keytab file.
•Requires LDAP as authorization mechanism; Unix authorization not supported.
•No utilities are provided to convert DCE information to Kerberos. Site are requir ed to perform
the conversion from DCE on their own.
6.2.3.2. Authorization Mech anisms
A site may select between Unix or LDAP authorization. Some pros and cons of each are listed
below.
Unix:
•Can degrade performance as the number of HPSS users increases due to sequential seeking
through password file.
•Easier to setup and manage than LDAP.
HPSS Installation Guide July 2008
Release 6.2 (Revision 2.0) 183