Environment
SuSE Linux 10.x
Novell eDirectory 8.7.3.x
Situation
This TID walks you through the configuration of all necessary components to enable LDAP authentication from a SLES 9 or SuSE Linux 10.x workstation to a SLES 9 server running eDirectory 8.7.3.x
Resolution
Configuration of the LDAP Server
Verify that eDirectory is installed, running and current with: ndsstat
Verify that the box running eDirectory is a SLES9 server with: cat /etc/SuSE-release
Extend eDirectory with RFC2307 schema. Hint:By default eDirectory places the file at /usr/lib/nds-schema/rfc2307-usergroup.sch on the server when eDirectory is installed.
Prepare the user objects for use as accounts on Linux
Determine available UIDs and GIDs from the passwrd file on the SLES9 server.
#This LDIF file was generated by Novell's ICE and the LDIF destination handler.
loginShell: loginshell=/bin/bash
#This LDIF file was generated by Novell's ICE and the LDIF destination handler.
objectClass: organizationalPerson
objectClass: ndsLoginProperties
Prepare the SuSE Linux Workstations and/or Servers that will allow authentication via LDAP.
nss_map_attribute uniqueMember member
pam_filter objectclass=posixAccount
Dynamically Creating User Home Directories
session required /lib/security/pam_mkhomedir.so skel=/etc/skel umask=0022
session required /lib/security/pam_mkhomedir.so skel=/etc/skel umask=0022
Note: If you don't want LUM enabled users
to be able to read other users' home directories,
perform
Additional Information
Verify the SLES server speaks LDAP :
ldapconfig get -a [eDirectory user to bind as] -w [password] | grep "TCP Port”
example ldapconfig get -a cn=admin.o=novell -w novell | grep "TCP Port"
You should see something like: LDAP TCP Port: 389
If you like, you can just type ldapconfig get and you will be prompted for everything else
Verify LDAP port 389 is available:
Type netstat -an | grep [port found in step 1.1.a]
example. netstat -an | grep 389
You should see something like: tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN
Verify the SLES eDirectory server is being queried for name service
-rw-r----- 1 john users 0 Jan 1 12:00 test
to determine whether the the name service is using LDAP.