Using Service Search Descriptors to Modify Client Access to Various Services
A service search descriptor (SSD) changes the default search request for a given operation in LDAP to a search you define. SSDs are particularly useful if, for example, you have been using LDAP
with customized container definitions or another operating system and are now transitional to Solaris 9. Using SSDs, you can configure Solaris 9 LDAP naming services without having to change your existing LDAP database and data.
Setting Up SSDs Using idsconfig
Assume your predecessor at Example, Inc. had configured LDAP, storing users in ou=Users container. You are now upgrading to Solaris 9. By definition, Solaris 9 LDAP assumes that user entries are stored in ou=People container. Thus, when it comes to searching
the passwd service, LDAP will search the ou=people level of the DIT and not find the correct values.
One laborious solution to the above problem would be to completely overwrite Example, Inc.'s existing DIT and to rewrite all the exiting applications on Example, Inc.'s network so that they are compatible with the new LDAP naming service. A second, far preferable solution would be to use an SSD
that would tell LDAP to look for user info in an ou=Users container instead the default ou=people container.
You would define the necessary SSD during the configuration of the Sun ONE Directory Server using idsconfig. The prompt line appears as follows.
Do you wish to setup Service Search Descriptors (y/n/h? y
A Add a Service Search Descriptor
D Delete a SSD
M Modify a SSD
P Display all SSD's
H Help
X Clear all SSD's
Q Exit menu
Enter menu choice: [Quit] a
Enter the service id: passwd
Enter the base: service ou=user,dc=west,dc=example,dc=com
Enter the scope: one[default]
A Add a Service Search Descriptor
D Delete a SSD
M Modify a SSD
P Display all SSD's
H Help
X Clear all SSD's
Q Exit menu
Enter menu choice: [Quit] p
Current Service Search Descriptors:
==================================
Passwd:ou=Users,ou=west,ou=example,ou=com?
Hit return to continue.
A Add a Service Search Descriptor
D Delete a SSD
M Modify a SSD
P Display all SSD's
H Help
X Clear all SSD's
Q Exit menu
Enter menu choice: [Quit] q
|
Running idsconfig
Note - You do not need special rights to run idsconfig, nor do you need to be an LDAP naming client. Remember to create a checklist as mentioned in Creating a Checklist Based on Your Server Installation in preparation for running idsconfig. You do not have to run idsconfig from a server or an LDAP naming service client machine. You can run idsconfig from any Solaris machine on the network.
 Caution - idsconfig sends the Directory Manager's password in the clear. If you do not want this to happen, you must run idsconfig on the directory server itself, not on a client.
 How to Configure Sun ONE Directory Server Using idsconfig
Make sure the target Sun ONE Directory Server is up and running. Run idsconfig. # /usr/lib/ldap/idsconfig
|
Answer the questions prompted. Note that 'no' [n] is the default user input. If you need clarification on any given question, type
and a brief help paragraph will appear.
Refer to the following example run of idsconfig using the definitions listed in the server and client checklists at the beginning of this chapter in Creating a Checklist Based on Your Server Installation. It is an example of a simple setup, without modifying many of the defaults. The most complicated
method of modifying client profiles is by creating SSDs. Refer to Using Service Search Descriptors to Modify Client Access to Various Services for a detailed discussion.
A carriage return sign after the prompt means that you are accepting the [default] by hitting enter.
Example 15-1 Running idsconfig for the Example, Inc. Network
# usr/lib/ldap/idsconfig
It is strongly recommended that you BACKUP the directory server
before running idsconfig.
Hit Ctrl-C at any time before the final confirmation to exit.
Do you wish to continue with server setup (y/n/h)? [n] Y
|
Enter the directory server's
hostname to setup: myserver
|
Enter the port number for directory server (h=help): [389]
Enter the directory manager DN: [cn=Directory Manager]
Enter passwd for cn=Directory Manager :
Enter the domainname to be served (h=help): [west.example.com]
Enter LDAP Base DN (h=help): [dc=west,dc=example,dc=com]
Enter the profile name (h=help): [default]
Default server list (h=help): [192.168.0.0]
Preferred server list (h=help):
Choose desired search scope (one, sub, h=help): [one]
The following are the supported credential levels:
1 anonymous
2 proxy
3 proxy anonymous
Choose Credential level [h=help]: [1] 2
|
The following are the supported Authentication Methods:
1 none
2 simple
3 sasl/DIGEST-MD5
4 tls:simple
5 tls:sasl/DIGEST-MD5
Choose Authentication Method (h=help): [1] 2
|
Current authenticationMethod: simple
Do you want to add another Authentication Method? N
|
Do you want the clients to follow referrals (y/n/h)? [n] Y
|
Do you want to modify the server timelimit value (y/n/h)? [n] Y
|
Enter the time limit for iDS (current=3600): [-1]
|
Do you want to modify the server sizelimit value (y/n/h)? [n] Y
|
Enter the size limit for iDS (current=2000): [-1]
|
Do you want to store passwords in "crypt" format (y/n/h)? [n] Y
|
Do you want to setup a Service Authentication Methods (y/n/h)? [n]
Client search time limit in seconds (h=help): [30]
Profile Time To Live in seconds (h=help): [43200]
|
Bind time limit in seconds (h=help): [10] 2
|
Do you wish to setup Service Search Descriptors (y/n/h)? [n]
Summary of Configuration
1 Domain to serve : west.example.com
2 Base DN to setup : dc=west,dc=example,dc=com
3 Profile name to create : default
4 Default Server List : 192.168.0.0
5 Preferred Server List :
6 Default Search Scope : one
7 Credential Level : proxy
8 Authentication Method : simple
9 Enable Follow Referrals : TRUE
10 iDS Time Limit : -1
11 iDS Size Limit : -1
12 Enable crypt password storage : TRUE
13 Service Auth Method pam_ldap :
14 Service Auth Method keyserv :
15 Service Auth Method passwd-cmd:
16 Search Time Limit : 30
17 Profile Time to Live : 43200
18 Bind Limit : 2
19 Service Search Descriptors Menu
Enter config value to change: (1-19 0=commit changes) [0]
Enter DN for proxy agent:[cn=proxyagent,ou=profile,dc=west,dc=example,dc=com]
Enter passwd for proxyagent:
Re-enter passwd:
|
WARNING: About to start committing changes. (y=continue, n=EXIT) Y
|
1. Changed timelimit to -1 in cn=config.
2. Changed sizelimit to -1 in cn=config.
3. Changed passwordstoragescheme to "crypt" in cn=config.
4. Schema attributes have been updated.
5. Schema objectclass definitions have been added.
6. Created DN component dc=west.
7. NisDomainObject added to dc=west,dc=example,dc=com.
8. Top level "ou" containers complete.
9. Nis maps: auto_home auto_direct auto_master auto_shared processed.
10. ACI for dc=west,dc=example,dc=com modified to disable self modify.
11. Add of VLV Access Control Information (ACI).
12. Proxy Agent cn=proxyagent,ou=profile,dc=west,dc=example,dc=com added.
13. Give cn=proxyagent,ou=profile,dc=west,dc=example,dc=com read permission for
password.
14. Generated client profile and loaded on server.
15. Processing eq,pres indexes:
ipHostNumber (eq,pres) Finished indexing.
uidNumber (eq,pres) Finished indexing.
ipNetworkNumber (eq,pres) Finished indexing.
gidnumber (eq,pres) Finished indexing.
oncrpcnumber (eq,pres) Finished indexing.
16. Processing eq,pres,sub indexes:
membernisnetgroup (eq,pres,sub) Finished indexing.
nisnetgrouptriple (eq,pres,sub) Finished indexing.
17. Processing VLV indexes:
west.example.com.getgrent vlv_index Entry created
west.example.com.gethostent vlv_index Entry created
west.example.com.getnetent vlv_index Entry created
west.example.com.getpwent vlv_index Entry created
west.example.com.getrpcent vlv_index Entry created
west.example.com.getspent vlv_index Entry created
idsconfig: Setup of directory server ipdserver is complete.
Note: idsconfig has created entries for VLV indexes. Use the
directoryserver(1m) script on ipdserver to stop
the server and then enter the following vlvindex
sub-commands to create the actual VLV indexes:
directoryserver -s ipdserver vlvindex -n userRoot -T west.example.com.getgrent
directoryserver -s ipdserver vlvindex -n userRoot -T west.example.com.gethostent
directoryserver -s ipdserver vlvindex -n userRoot -T west.example.com.getnetent
directoryserver -s ipdserver vlvindex -n userRoot -T west.example.com.getpwent
directoryserver -s ipdserver vlvindex -n userRoot -T west.example.com.getrpcent
directoryserver -s ipdserver vlvindex -n userRoot -T west.example.com.getspent
|
| 
Previous Contents Index Next 