Solaris LDAP

LDAP is a client-server protocol for accessing a directory service. LDAP server can be used as a central point for user authentication over the network. LDAP is the industry standard for directory access and embraced by companies such as IBM, Netscape, Novell, Microsoft etc.

LDAP was first implemented at the University of Michigan in the early 1990's. LDAP is a TCP/IP application level protocol similar to HTTP, ftp and telnet.

There are many commercial LDAP servers available like Microsoft Active Directory, Novell eDirectory, iPlanet Directory Server, etc. In addition there is an open source implementation of LDAP (OpenLDAP) based on the work done at Michigan . It is used mainly on Linux and BSD operating systems, but can be used on Solaris too. LDAP is commonly defined in terms of four models. These are:

The Lightweight Directory Access Protocol (LDAP) is an open-standard, platform independent, access protocol based on the X.500 informational model. It is designed to run over TCP/IP and uses simple string encoding. LDAP servers provide access to a hierarchical Directory Information Tree (DIT) that is made up of entries much like Unix filesystem tree. An entry has a relative distinguished name (RDN) that is unique among all its siblings and a distinguished name (DN) that is unique in the tree. LDAPv3 (RFC 2251) supports the following operations:

The LDAP client library was first available in Solaris 7. The ldap(3LDAP) man page refers to 134 LDAP library functions that were added. In addition, the following user commands became available:

Starting from version 8 Solaris provides complete LDAP integration. LDAP back-end support to the Name Service switch was added. Network administrators can now specify LDAP as the desired name service to directory access by copying the nsswitch.ldap template file to /etc/nsswitch.conf. Native LDAP support is only available for IPv4 for Solaris versions less then 10.

A directory service functions somewhat like a database, but it differs from traditional relational databases in several ways:

Because of these advantages LDAP is replacing NIS/NIS+ as the enterprise user account and authentication of choice. That's why NIS+ will no longer be supported in future versions of Solaris. The Solaris best supports LDAP with the iPlanet Directory Server but can also work with other LDAP directory servers. iPlanet Directory Server must be set up and then configured to support Solaris LDAP clients. On a configured LDAP server, the /etc/rc2.d/S72directory script starts the iPlanet Directory Server during the boot process.

LDAP provides a directory service which can be used for storing and querying information about the users. The range of information that can be made available in this way is typical for directories: Unix user account data or other institutional directory data (office location, phone numbers, and the like).

In order to emphasize these differences with respect to standard relational databases, different terminology is used to name a directory service's data structures: records are referred to as entries, and each field within a record is known as an attribute. .Like the DNS namespace, LDAP names start with the least significant component and proceed to the most significant; in other words, those just below root. The DN is constructed by concatenating the sequence of RDNs up to the root of the tree.

Note: Although the term LDAP is very fuzzy, it actually refers only to the protocol by which data are accessed (implemented in a daemon). The actual database capabilities are provided by a separate back-end program or package.

LDAP directories provide a way to name, manage, and access collections of directory entries. A directory entry is composed of attributes that have a type and one or more values. The syntax for each attribute defines the allowed values, or the allowed data type of the attribute values, such as American Standard Code for Information Interchange (ASCII) characters or a numerical data. LDAP also defines how those values are interpreted during a directory operation; for example, determining if a search or compare is case sensitive.

Directory entries are organized into a tree structure, which can be based on boundaries defined by geography (country), organization (company), or domain components (dc).

Entries are named according to their position in this tree structure by a distinguished name (DN). Each component of the DN is called a relative distinguished name (RDN). An RDN is composed of one or more attributes from the entry. The hierarchy of the directory tree structure is similar to that of the UNIX file system. An RDN corresponds to the relative path name of a file, and the DN to the absolute path name. As in the UNIX file system, sibling directory entries must have unique RDNs. However, unlike Unix filesystem in the directory tree, each entry can contain both content and attributes.

Solaris LDAP Client

You execute the ldapclient command on the client system once to initiate the client as a native LDAP client. The required command-line arguments include the proxy name, password, and the LDAP server’s IP address. The following example describes a typical client initialization:

You use the ldaplist command to list the naming information from the LDAP servers.

To unconfigure an LDAP client, use the ldapclient uninit in used. This command removes the client files from the /var/ldap directory and restores the previous /etc/nsswitch.conf file.The ldap_cachemgr process is also stopped. The configuration changes are dynamic and no reboot is needed after ldapclient uninit command.

Old News ;-)

[July 15, 2007] Brads Publications

[Aug 24, 2006]LDAP Authentication In Linux HowtoForge - Linux Howtos and Tutorials Submitted by tdi

[Jul 27, 2006] Demystifying LDAP

LDAPSolaris Docs TWiki

Solaris LDAP Authentication

This document covers how a Solaris system can be configured for LDAP authentication. It is an early draft and has only been tested with Solaris 10 zones although there is no reason why it should not work with earlier versions of Solaris.

Configure an SSL Tunnel

Because our LDAP service requires SSL connections before allowing authentication, it is necessary to connect to the LDAP server using SSL. The easiest way of doing this, is to configure a network tunnel ... the local machine will think it is talking to an LDAP server on the local machine.

First [ for O/S 9 and 10] , create the configuration necessary for the stunnel tool in /opt/etc. Or copy from ISOadm/nw-sun/LDAPclient/site-scripts/st-ldap.conf:-

    client = yes
    [ldap]
        accept=localhost:389
        connect=ldap.port.ac.uk:636

Note the "accept=localhost:389" ... the use of 'localhost' here prevents the tunnel from being visible (and usable) from the network, which would be a possible security hole.

Next is to configure an XML manifest for the SMF service if applying to Solaris 10. Either create the XML file with these conditions or use ISOadm/nw-sun/LDAPclient/site-scripts/st-ldap.xml :-

  <?xml version="1.0"?>

  <!DOCTYPE service_bundle SYSTEM "/usr/share/lib/xml/dtd/service_bundle.dtd.1">

  <service_bundle type='manifest' name='Lstunnel-ldap'>

  <service
          name='site/Lstunnel-ldap'
          type='service'
          version='1'>

          <create_default_instance enabled='true' />

          <dependent
            name='exim_multi-user-server'
            grouping='require_all'
            restart_on='none'>
            <service_fmri value='svc:/milestone/multi-user-server' />
          </dependent>


          <exec_method
                  type='method'
                  name='start'
                  exec='/ISOadm/nw-sun/sbin/stunnel /opt/etc/st-ldap.conf'
                  timeout_seconds='0' />

          <exec_method
                  type='method'
                  name='stop'
                  exec=':kill -15'
                  timeout_seconds='3' />
  
  </service>
  </service_bundle>

This can be imported with svccfg import st-ldap.xml. Once imported start with svcadm enable Lstunnel-ldap.

For Solaris 9 copy ISOadm/nw-sun/site-scripts/LDAPclient/ldap.client to /etc/init.d, and run /etc/init.d/ldap.client start

Configure PAM

For Solaris 9 and 10 replace /etc/pam.conf with, the appropiate files from /ISOadm/nw-sun/site-scripts/LDAPclinet. select pam9.conf for Solaris 9, pam10.conf for Solaris 10]

The following is the corerct pam.conf for Solaris 10, for Solaris 9 all lines contained cred are omitted.

#
# Authentication management
#
# login service (explicit because of pam_dial_auth)
#
login   auth requisite        pam_authtok_get.so.1
login   auth required         pam_dhkeys.so.1
login   auth required         pam_unix_cred.so.1
login   auth required         pam_dial_auth.so.1
login   auth binding          pam_unix_auth.so.1 server_policy
login   auth required         pam_ldap.so.1
#
# rlogin service (explicit because of pam_rhost_auth)
#
rlogin  auth sufficient       pam_rhosts_auth.so.1
rlogin  auth requisite        pam_authtok_get.so.1
rlogin  auth required         pam_dhkeys.so.1
rlogin  auth required         pam_unix_cred.so.1
rlogin  auth binding          pam_unix_auth.so.1 server_policy
rlogin  auth required         pam_ldap.so.1
#
# rsh service (explicit because of pam_rhost_auth,
# and pam_unix_auth for meaningful pam_setcred)
#
rsh     auth sufficient       pam_rhosts_auth.so.1
rsh     auth required         pam_unix_cred.so.1
rsh     auth binding          pam_unix_auth.so.1 server_policy
rsh     auth required         pam_ldap.so.1
#
# PPP service (explicit because of pam_dial_auth)
#
ppp     auth requisite        pam_authtok_get.so.1
ppp     auth required         pam_dhkeys.so.1
ppp     auth required         pam_dial_auth.so.1
ppp     auth binding          pam_unix_auth.so.1 server_policy
ppp     auth required         pam_ldap.so.1
#
# Default definitions for Authentication management
# Used when service name is not explicitly mentioned for authentication
#
other   auth requisite        pam_authtok_get.so.1
other   auth required         pam_dhkeys.so.1
other   auth required         pam_unix_cred.so.1
other   auth binding          pam_unix_auth.so.1 server_policy
other   auth required         pam_ldap.so.1
#
# passwd command (explicit because of a different authentication module)
#
passwd  auth binding          pam_passwd_auth.so.1 server_policy
passwd  auth required         pam_ldap.so.1
#
# cron service (explicit because of non-usage of pam_roles.so.1)
#
cron    account required      pam_unix_account.so.1
#
# Default definition for Account management
# Used when service name is not explicitly mentioned for account management
#
other   account requisite     pam_roles.so.1
other   account binding       pam_unix_account.so.1 server_policy
other   account required      pam_ldap.so.1
#
# Default definition for Session management
# Used when service name is not explicitly mentioned for session management
#
other   session required      pam_unix_session.so.1
#
# Default definition for  Password management
# Used when service name is not explicitly mentioned for password management
#
other   password required     pam_dhkeys.so.1
other   password requisite    pam_authtok_get.so.1
other   password requisite    pam_authtok_check.so.1
other   password required     pam_authtok_store.so.1 server_policy
#
# Support for Kerberos V5 authentication and example configurations can
# be found in the pam_krb5(5) man page under the "EXAMPLES" section.
#

Instead of just looking in /etc/passwd, this checks there and checks in the LDAP server. The /etc/passwd file takes priority.

Configuring LDAP

Configure the LDAP client daemon manually with the following command, there is a script file in /site-scripts called ldap-mancli which will do the same thing, as long as stunnel is running:-

/usr/sbin/ldapclient manual
                -a defaultServerList=localhost
                -a defaultSearchBase=ou=lan,o=port
                -a defaultSearchScope=sub
                -a authenticationMethod=none
                -a credentialLevel=anonymous
                -a serviceAuthenticationMethod=passwd:simple
                -a serviceAuthenticationMethod=shadow:simple
                -a serviceAuthenticationMethod=pam_ldap:simple
                -a attributeMap=passwd:gecos=fullname
                -a attributeMap=passwd:homeDirectory=unixHome
                -a attributeMap=passwd:uid=cn
                -a serviceSearchDescriptor=shadow:ou=lan,o=port?sub
                -a serviceSearchDescriptor=passwd:ou=lan,o=port?sub

To restrict the ability to login to members of a group, add "?groupMembership=cn=gp-ac-pepitas,ou=sysperms,ou=ns,ou=lan,o=port" to the end of the "serviceSearchDescriptor".

Cleaning Up

The ldapclient command makes some changes we don't like, so edit /etc/nsswitch.conf and remove the 'ldap' word from all the name services except for 'passwd' and 'group' (including any "[NOTFOUND=return]" bits). Double check DNS has files and dns.

Also disable the autofs with svcadm disable autofs as this seems to spring into life.

Remaining Stuff

Map homeDirectory to unixHome for systems where a local home directory is preferred.
Look into setting up autofs for /Network/Servers/{IP}/... so we automount the users home directory.

Debugging

Finding out what is going wrong is kind of tricky as there is very little logging for LDAP. The simplest method of debugging is to change the LDAP server list to "ldap.port.ac.uk" and dump the traffic :-

    ldapclient -v mod -a defaultServerList=ldap.port.ac.uk
    snoop -o ldap.dump -s 0 host hickory-blue

The output file is best inspected on a workstation using Ethereal.

Don't forget to change the server list back again ... because this is plain text LDAP (which is necessary for dumping traffic), the NDS won't allow any authentication.

Working ldapclient list Configuration

# /usr/sbin/ldapclient list
NS_LDAP_FILE_VERSION= 2.0
NS_LDAP_SERVERS= localhost
NS_LDAP_SEARCH_BASEDN= ou=lan,o=port
NS_LDAP_AUTH= none
NS_LDAP_SEARCH_SCOPE= sub
NS_LDAP_CACHETTL= 0
NS_LDAP_CREDENTIAL_LEVEL= anonymous
NS_LDAP_SERVICE_SEARCH_DESC= shadow:ou=lan,o=port?sub
NS_LDAP_SERVICE_SEARCH_DESC= passwd:ou=lan,o=port?sub
NS_LDAP_ATTRIBUTEMAP= passwd:homeDirectory=unixHome
NS_LDAP_ATTRIBUTEMAP= passwd:gecos=description
NS_LDAP_ATTRIBUTEMAP= passwd:uid=cn
NS_LDAP_SERVICE_AUTH_METHOD= passwd:simple
NS_LDAP_SERVICE_AUTH_METHOD= pam_ldap:simple
NS_LDAP_SERVICE_AUTH_METHOD= shadow:simple

-- MikeMeredith - 23 May 2005

[Oct 27, 2005] Linux.com Advanced Linux LDAP authentication By: "American" Dave Kline

LDAP for Solaris 8

News	Recommended Links	Books	LDAP Client	Selected Blueprints	Solaris LDAP Directory Structure	FAQs
LDAP Utilities			Tips	History	Humor	Etc