HPSS_PRIMARY_AUTHN_MECH=krb5
HPSS_PRIMARY_AUTHENTICATOR=/krb5/hpss.keytabs
Valid settings for unix authentication are:
HPSS_PRIMARY_AUTHN_MECH=unix
HPSS_PRIMARY_AUTHENTICATOR=/etc/passwd
The new authorization is performed based on the contents of /var/hpss/etc/sit e.conf. This file will tell
HPSS to use unix authorization, or to use LDAP and how to contact the LDAP server based on the
URL entered.
Invoke the mkhpss utility and select the appropriate options to support the authentication and
authorization mechanisms chosen previously.
% /opt/hpss/bin/mkhpss
There are four main sections to this screen:
•Configure Authentication Service
•Configure Authorization Service
•Enable Local Unix Passwd Files
•Configure server accounts
In the "Configure Authentication Service" section, set the Authentication Servic e field to Kerberos or
Unix by means of the drop down menu on the field. If Unix is selected, no further modification to
this section is necessary. If Kerberos is selected, complete the remaining fields of the section
appropriately. Be certain to unselect the "Create the KDC" subsection if your KDC already exists
and you do not want mkhpss to recreate it.
In the "Configure Authorization Service" section, set the Local Site Name, Local Realm Name, and
Local Realm ID. Set the Authorization Service field to "Unix and config files" or "LDAP" by means
of the drop down menu on the field. If Unix is selected, no further modification to this sect ion is
necessary. If LDAP is selected, complete the remaining fields of the section appropriatel y.
Enable the checkbox of the "Enable Local Unix Passwd Files" section and complete al l the fields if
you want to use a set of password and group files for HPSS use only. If you wish to use system
password and group files (such as /etc/passwd and /etc/group, for example), unselect the checkbox
for this section.
Enable the checkbox for the "Configure server accounts" section to request mkhpss to create accounts
for the HPSS server principals.
An example configuration for a site that desires Kerberos authentication with LDAP authorization is
displayed below:
HPSS Installation Guide July 2008Release 6.2 (Revision 2.0) 200