10-26-2009 01:00 AM
I have a HPUX Itanium system wanted to authenticate it thru Windows Active Directory server. Can someone advice me on this.
Thanks in advance.
Solved! Go to Solution.
10-26-2009 02:40 AM
you need to install and configure LDAP-UX services on HP-UX system. From the manual already mentioned (which is the best point to start) check also for Windows requirements, for example it asks for SFU utilities on Windows system.
10-26-2009 07:02 AM
10-27-2009 04:07 AM
You don't need MS SFU if your AD is 2003 R2 or above, the schema changes are already present. You will need it if you don't, however, you would be better off delaying until you upgrade to AD 2003R2, than you would to deploy LDAP-UX, then upgrade.
Technically Kerberos is the authentication method.
PAM_authz provides authorization (are you in the right group, and allowed to log into this host? Otherwise >ALL< AD users can log in...)
The LDAP-UX piece provides users and groups from the AD.
That step-by-step guide that Eric posted is pretty good (it's also very new). I wish it was around when I originally implemented.
The Instalilng and Configuring guide is also quite good and covers a lot of the possible issues, specific to many different environments. For Kerberos, I really like this test resource:
This doc: DOC ID: PAMKKBAN00000983 - A Basic Step-by-Step Summary of Kerberos v5.1 Setup on HPUX platform.
A copy of which is at the link below:
I actually worked with the author on backline support issues once. Very bright fellow.
Interestingly enough, I was forced to temporarily disable the LDAP client daemon temporarily for a short time. As long as the users and group data is sychronised to the host in some way, the users can fully log in using Kerberos only. The trick is, if there's no naming service (LDAP-UX to provide user and group data, /etc/files, etc.) you can't log in.
Remember, LDAP is only a directory, it only provides identity, not authentications (Kerboeros), or authorization (pam_authz, sudo, etc.).
10-27-2009 04:51 AM
Understand that in the Windows 2003 integration, only R2 will work for LDAP integration. Substantial patching is required on the windows side for this to work.
So work with the windows team and see that it is properly patched.
Part of the setup requires admin rights on the windows domain controller, so you'll need to work with the windows admins closely to get this done.
it is not easy. Budget some time to get this done.
Owner of ISN Corporation
11-12-2009 05:09 AM
The one additional note is that basic domain admin privileges are not enough, you also need to have Schema Admin enabled on the domain admin account during the first install.
Your Windows administrators will be very skittish about enabling any changes to the schema.
This one is pretty benign, however updating it, which includes enabling SSL or SASL style encryption, or changing the LDAP server search order will require you to use ADSIEdit (windows, from the ResKit) or ldapmodify (comes with LDAP-UX) to implement the changes. At this point, you are directly editing the schema.