User Commands ldap(1)
NAME
ldap - LDAP as a naming repository
DESCRIPTION
LDAP refers to Lightweight Directory Access Protocol, which
is an industry standard for accessing directory servers. By
initializing the client using ldapclient(1M) and using the
keyword ldap in the name service switch file,
/etc/nsswitch.conf, Solaris clients can obtain naming infor-
mation from an LDAP server. Information such as usernames,
hostnames, and passwords are stored on the LDAP server in a
Directory Information Tree or DIT. The DIT consists of
entries which in turn are composed of attributes. Each
attribute has a type and one or more values.
Solaris LDAP clients use the LDAP v3 protocol to access nam-
ing information from LDAP servers. The LDAP server must sup-
port the object classes and attributes defined in RFC2307bis
(draft), which maps the naming service model on to LDAP. As
an alternate to using the schema defined in RFC2307bis
(draft), the system can be configured to use other schema
sets and the schema mapping feature is configured to map
between the two. Refer to the System Administration Guide:
Naming and Directory Services (DNS, NIS, and LDAP) for more
details.
The ldapclient(1M) utility can make a Solaris machine an
LDAP client by setting up the appropriate directories,
files, and configuration information. The LDAP client caches
this configuration information in local cache files. This
configuration information is accessed through the
ldapcachemgr(1M) daemon. This daemon also refreshes the
information in the configuration files from the LDAP server,
providing better performance and security. The ldapcachemgr
must run at all times for the proper operation of the naming
services.
There are two types of configuration information, the infor-
mation available through a profile, and the information con-
figured per client. The profile contains all the information
as to how the client accesses the directory. The credential
information for proxy user is configured on a per client
basis and is not downloaded through the profile.
The profile contains server-specific parameters that are
required by all clients to locate the servers for the
desired LDAP domain. This information could be the server's
IP address and the search base Distinguished Name (DN), for
SunOS 5.11 Last change: 28 Aug 2006 1
User Commands ldap(1)
instance. It is configured on the client from the default
profile during client initialization and is periodically
updated by the ldapcachemgr daemon when the expiration time
has elapsed.
Client profiles can be stored on the LDAP server and can be
used by the ldapclient utility to initialize an LDAP client.
Using the client profile is the easiest way to configure a
client machine. See ldapclient(1M).
Credential information includes client-specific parameters
that are used by a client. This information could be the
Bind DN (LDAP "login" name) of the client and the password.
If these parameters are required, they are manually defined
during the initialization through ldapclient(1M).
The naming information is stored in containers on the LDAP
server. A container is a non-leaf entry in the DIT that con-
tains naming service information. Containers are similar to
maps in NIS and tables in NIS]. A default mapping between
the NIS databases and the containers in LDAP is presented
below. The location of these containers as well as their
names can be overridden through the use of serviceSear-
chDescriptors. For more information, see ldapclient(1M).
SunOS 5.11 Last change: 28 Aug 2006 2
User Commands ldap(1)
SunOS 5.11 Last change: 28 Aug 2006 3
User Commands ldap(1)
Database Object Class Container
passwd posixAccount ou=people,dc=...
shadowAccount
group posixGroup ou=Group,dc=...
services ipService ou=Services,dc=...
protocols ipProtocol ou=Protocols,dc=...
rpc oncRpc ou=Rpc,dc=...
hosts ipHost ou=Hosts,dc=...
ipnodes ipHost ou=Hosts,dc=...
ethers ieee802Device ou=Ethers,dc=...
bootparams bootableDevice ou=Ethers,dc=...
networks ipNetwork ou=Networks,dc=...
netmasks ipNetwork ou=Networks,dc=...
netgroup nisNetgroup ou=Netgroup,dc=...
aliases mailGroup ou=Aliases,dc=...
publickey nisKeyObject
generic nisObject nisMapName=...,dc=...
printers printerService ou=Printers,dc=...
authattr SolarisAuthAttr ou=SolarisAuthAttr,dc=...
profattr SolarisProfAttr ou=SolarisProfAttr,dc=...
execattr SolarisExecAttr ou=SolarisProfAttr,dc=...
userattr SolarisUserAttr ou=people,dc=...
audituser SolarisAuditUser ou=people,dc=...
The security model for clients is defined by a combination
of the credential level to be used, the authentication
method, and the PAM modules to be used. The credential level
defines what credentials the client should use to authenti-
cate to the directory server, and the authentication method
SunOS 5.11 Last change: 28 Aug 2006 4
User Commands ldap(1)
defines the method of choice. Both these can be set with
multiple values. The Solaris LDAP supports the following
values for credential level :
anonymous
proxy
self
The Solaris LDAP supports the following values for authenti-
cation method:
none
simple
sasl/CRAM-MD5
sasl/DIGEST-MD5
sasl/GSAPI
tls:simple
tls:sasl/CRAM-MD5
tls:sasl/DIGEST-MD5
When the credential level is configured as self, DNS must be
configured and the authentication method must be
sasl/GSAPI. The hosts and ipnodes in /etc/nsswitch.conf
must be configured to use DNS, for example hosts: dns files
and ipnodes: dns files.
sasl/GSAPI automatically uses GSAPI confidentiality and
integrity options, if they are configured on the directory
server.
The credential level of self enables per-user naming service
lookups, or lookups that use the GSAPI credentials of the
user when connecting to the directory server. Currently the
only GSAPI mechanism supported in this model is Kerberos
V5. Kerberos must be configured before you can use this
credential level. See kerberos(5) for details.
More protection can be provided by means of access control,
allowing the server to grant access for certain containers
or entries. Access control is specified by Access Control
Lists (ACLs) that are defined and stored in the LDAP server.
The Access Control Lists on the LDAP server are called
Access Control Instructions (ACIs) by the the SunOne Direc-
tory Server. Each ACL or ACI specifies one or more directory
objects, for example, the cn attribute in a specific con-
tainer, one or more clients to whom you grant or deny
access, and one or more access rights that determine what
the clients can do to or with the objects. Clients can be
users or applications. Access rights can be specified as
SunOS 5.11 Last change: 28 Aug 2006 5
User Commands ldap(1)
read and write, for example. Refer to the System Administra-
tion Guide: Naming and Directory Services (DNS, NIS, and
LDAP) regarding the restrictions on ACLs and ACIs when using
LDAP as a naming repository.
A sample nsswitch.conf(4) file called nsswitch.ldap is pro-
vided in the /etc directory. This is copied to
/etc/nsswitch.conf by the ldapclient(1M) utility. This file
uses LDAP as a repository for the different databases in the
nsswitch.conf file.
The following is a list of the user commands related to
LDAP:
idsconfig(1M) Prepares a SunOne Directory Server to be
ready to support Solaris LDAP clients.
ldapaddent(1M) Creates LDAP entries from corresponding
/etc files.
ldapclient(1M) Initializes LDAP clients, or generates a
configuration profile to be stored in the
directory.
ldaplist(1) Lists the contents of the LDAP naming
space.
FILES
/var/ldap/ldapclientcred Files that contain the LDAP
/var/ldap/ldapclientfile configuration of the client.
Do not manually modify these
files. Their content is not
guaranteed to be human read-
able. Use ldapclient(1M) to
update them.
/etc/nsswitch.conf Configuration file for the
name-service switch.
/etc/nsswitch.ldap Sample configuration file for
the name-service switch con-
figured with LDAP and files.
SunOS 5.11 Last change: 28 Aug 2006 6
User Commands ldap(1)
/etc/pam.conf PAM framework configuration
file.
SEE ALSO
ldaplist(1), idsconfig(1M), ldapcachemgr(1M),
ldapaddent(1M), ldapclient(1M), nsswitch.conf(4),
pam.conf(4), kerberos(5)pamauthtokcheck(5),
pamauthtokget(5), pamauthtokstore(5), pamdhkeys(5),
pamldap(5), pampasswdauth(5), pamunixaccount(5),
pamunixauth(5), pamunixsession(5)
System Administration Guide: Naming and Directory Services
(DNS, NIS, and LDAP)
NOTES
The pamunix(5) module is no longer supported. Similar func-
tionality is provided by pamauthtokcheck(5),
pamauthtokget(5), pamauthtokstore(5), pamdhkeys(5),
pampasswdauth(5), pamunixaccount(5), pamunixauth(5),
andpamunixsession(5).
SunOS 5.11 Last change: 28 Aug 2006 7
|
