1

I have configured Solaris to use ldap users. The ldap server is Samba4 DC, the client is Solaris 11.4.

I have "join" the server with this command

ldapclient manual \
 -a credentialLevel=proxy \
 -a authenticationMethod=sasl/gssapi \
 -a proxyDN=cn=proxyldap,cn=Users,dc=mydom,dc=priv \
 -a proxyPassword=******* \
 -a defaultSearchBase=dc=mydom,dc=priv \
 -a debugLevel=6 \
 -a domainName=mydom.priv \
 -a "defaultServerList=10.3.0.4" \
 -a attributeMap=group:userpassword=unixUserPassword\
 -a attributeMap=group:gidnumber=gidNumber \
 -a attributeMap=passwd:cn=cn \
 -a attributeMap=passwd:gidnumber=gidNumber \
 -a attributeMap=passwd:uidnumber=uidNumber \
 -a attributeMap=passwd:homedirectory=homeDirectory \
 -a attributeMap=passwd:loginshell=loginShell \
 -a attributeMap=shadow:userpassword=unixUserPassword \
 -a objectClassMap=group:posixGroup=group \
 -a objectClassMap=passwd:posixAccount=user \
 -a serviceSearchDescriptor=passwd:dc=mydom,dc=priv?sub \
 -a serviceSearchDescriptor=group:dc=mydom,dc=priv?sub 

Configure return OK

finger works, searching for user "pino" on Solaris

finger pino
Login name: pino                        In real life: pino
Directory: /home/pino                   Shell: /bin/bash
Never logged in.
No unread mail
No Plan.

ldaplist return error!

ldaplist passwd
ldaplist: libsldap.so.1 internal error

ldaplist -a sasl/GSSAPI passwd
ldaplist: (standalone auth error)
Configuration syntax error: Unable to set parameter from a client in __ns_ldap_setParam()

getent passwd works but only at 50%

getent passwd |grep pino
pino:x:3000014:100:pino:/home/pino:/bin/bash

getent passwd pino

id doesn't work

id pino
id: invalid user name: "pino"

What I miss?

/etc/nsswitch.conf is ok

cp /etc/nsswitch.ldap /etc/nsswitch.conf
2
  • Can LDAP users log in? Jan 22, 2021 at 17:20
  • Of course not, no id, no login
    – elbarna
    Jan 22, 2021 at 19:59

1 Answer 1

0

Solution/Workaround found but only at 50%

With this configuration(and Samba accept non encrypted gssapi strong auth) all commands works fine(ldaplist ok, id ok, su ok).

   ldapclient -v manual \
     -a credentialLevel=proxy \
     -a authenticationMethod=simple \
     -a proxyDN=cn=proxyldap,cn=Users,dc=mydom,dc=priv \
     -a proxyPassword=******* \
     -a defaultSearchBase=dc=mydom,dc=priv \
     -a debugLevel=6 \
     -a domainName=mydom.priv \
     -a "defaultServerList=10.3.0.4" \
     -a attributeMap=group:userpassword=unixUserPassword\
     -a attributeMap=group:gidnumber=gidNumber \
     -a attributeMap=passwd:cn=cn \
     -a attributeMap=passwd:gidnumber=gidNumber \
     -a attributeMap=passwd:uidnumber=uidNumber \
     -a attributeMap=passwd:homedirectory=HomeDirectory \
     -a attributeMap=passwd:unixhomedirectory=unixHomeDirectory \
     -a attributeMap=passwd:loginshell=loginShell \
     -a attributeMap=passwd:gecos=gecos \
     -a attributeMap=shadow:userpassword=unixUserPassword \
     -a objectClassMap=group:posixGroup=group \
     -a objectClassMap=passwd:posixAccount=user \
     -a objectClassMap=shadow:shadowAccount=user \
     -a serviceSearchDescriptor=passwd:dc=mydom,dc=priv?sub \
     -a serviceSearchDescriptor=group:dc=mydom,dc=priv?sub

but if I want to enable strong auth on Samba and gssapi auth on Solaris..

   ldapclient -v manual \
     -a credentialLevel=proxy \
     -a authenticationMethod=sasl/gssapi \
     -a proxyDN=cn=proxyldap,cn=Users,dc=mydom,dc=priv \
     -a proxyPassword=******* \
     -a defaultSearchBase=dc=mydom,dc=priv \
     -a debugLevel=6 \
     -a domainName=mydom.priv \
     -a "defaultServerList=10.3.0.4" \
     -a attributeMap=group:userpassword=unixUserPassword\
     -a attributeMap=group:gidnumber=gidNumber \
     -a attributeMap=passwd:cn=cn \
     -a attributeMap=passwd:gidnumber=gidNumber \
     -a attributeMap=passwd:uidnumber=uidNumber \
     -a attributeMap=passwd:homedirectory=HomeDirectory \
     -a attributeMap=passwd:unixhomedirectory=unixHomeDirectory \
     -a attributeMap=passwd:loginshell=loginShell \
     -a attributeMap=passwd:gecos=gecos \
     -a attributeMap=shadow:userpassword=unixUserPassword \
     -a objectClassMap=group:posixGroup=group \
     -a objectClassMap=passwd:posixAccount=user \
     -a objectClassMap=shadow:shadowAccount=user \
     -a serviceSearchDescriptor=passwd:dc=mydom,dc=priv?sub \
     -a serviceSearchDescriptor=group:dc=mydom,dc=priv?sub

All return on error. A good solution can be using of starttls, but I want to use sasl. I have created the principals for proxyldap user on samba server

#!/bin/sh
NAME=proxyldap
SERV=ldap
HOST=solaris11
DOMAIN=mydom.priv
samba-tool user delete $NAME
samba-tool user create $NAME 22unix33AA@@@@
net ads enctypes set $NAME 24
samba-tool spn add $SERV/$DOMAIN $NAME
samba-tool spn add $SERV/$HOST.$DOMAIN $NAME
samba-tool domain exportkeytab $HOST.keytab --principal=$SERV/$DOMAIN
samba-tool domain exportkeytab $HOST.keytab --principal=$SERV/$HOST.$DOMAIN

copied the tabs on krb5.keytab on solaris

(echo rkt solaris1.keytab; echo wkt /etc/krb5/krb5.keytab )|ktutil
  644  (echo rkt solaris2.keytab; echo wkt /etc/krb5/krb5.keytab )|ktutil

but nothing works. Clear or nothing, what I miss? ATM I accept this sad solution, if someone know a better working solution, put it please and I will accept the answer as definitive solution.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .