2

The Solaris box is configured to use LDAP and has no local user accounts.

This is the output of the nsswitch.conf file:

bash-3.2$ less /etc/nsswitch.conf
passwd:     files [NOTFOUND=continue] ldap
group:      files ldap
hosts:      files dns
ipnodes:    files
networks:   files
protocols:  files
rpc:        files
ethers:     files
netmasks:   files
bootparams: files
publickey:  files
automount:  files ldap
netgroup:   ldap
aliases:    files
services:   files
sendmailvars:   files
printers:   user files ldap
auth_attr:  files
prof_attr:  files
project:    files
sudoers:    ldap

So Solaris will look-up users and groups in the LDAP. But where exactly are the LDAP service/server details configured?


References:

  1. /etc/nsswitch.conf

1 Answer 1

4

You can see the client configuration which is stored in the /var/ldap directory by running the ldapclient list command, eg:

# ldapclient list
NS_LDAP_FILE_VERSION= 2.0
NS_LDAP_BINDDN= cn=proxyagent,ou=profile,dc=west,dc=example,dc=com
NS_LDAP_BINDPASSWD= {NS1}4a3788e8c053424f
NS_LDAP_SERVERS= 192.168.0.1, 192.168.0.10
NS_LDAP_SEARCH_BASEDN= dc=west,dc=example,dc=com
NS_LDAP_AUTH= simple
NS_LDAP_SEARCH_REF= TRUE
NS_LDAP_SEARCH_SCOPE= one
NS_LDAP_SEARCH_TIME= 30
NS_LDAP_SERVER_PREF= 192.168.0.1
NS_LDAP_PROFILE= pit1
NS_LDAP_CREDENTIAL_LEVEL= proxy
NS_LDAP_SERVICE_SEARCH_DESC= passwd:ou=people,?sub
NS_LDAP_SERVICE_SEARCH_DESC= group:ou=group,dc=west,dc=example,dc=com?one
NS_LDAP_BIND_TIME= 5

The /usr/lib/ldap/ldap_cachemgr -g command will also give you some details about the connection.

Note that some parts of the configuration might be on the directory server itself if profiles are used.

2
  • Thanks. Seems that only root(SuperUser) can run ldapclient. Are there any alternatives besides the above..? /usr/lib/ldap/ldap_cachemgr -g works for non-sudo users though..
    – Kent Pawar
    May 16, 2013 at 6:53
  • 1
    No alternative and that is by design. The ldap configuration is considered to be sensitive and thus protected from casual users view. It is stored in the /var/ldap/ldap_client_file and /var/ldap/ldap_client_cred files which are not readable but by root.
    – jlliagre
    May 16, 2013 at 23:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .