| blob | 36d73ad696f6584adbbdd8bf02421c9424f1f517 |
1 '\" te
2 .\" Copyright (C) 1990, Regents of the University of Michigan. All Rights Reserved.
3 .\" Portions Copyright (C) 2006, Sun Microsystems, Inc. All Rights Reserved.
4 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
5 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
6 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
7 .TH LDAP 1 "Mar 6, 2017"
8 .SH NAME
9 ldap \- LDAP as a naming repository
10 .SH DESCRIPTION
11 .LP
12 LDAP refers to Lightweight Directory Access Protocol, which is an industry
13 standard for accessing directory servers. By initializing the client using
14 \fBldapclient\fR(8) and using the keyword \fBldap\fR in the name service
15 switch file, \fB/etc/nsswitch.conf\fR, Solaris clients can obtain naming
16 information from an LDAP server. Information such as usernames, hostnames, and
17 passwords are stored on the LDAP server in a Directory Information Tree or
18 \fBDIT\fR. The \fBDIT\fR consists of entries which in turn are composed of
19 attributes. Each attribute has a type and one or more values.
20 .sp
21 .LP
22 Solaris LDAP clients use the LDAP v3 protocol to access naming information from
23 LDAP servers. The LDAP server must support the object classes and attributes
24 defined in \fIRFC2307bis (draft)\fR, which maps the naming service model on to
25 LDAP. As an alternate to using the schema defined in \fIRFC2307bis (draft)\fR,
26 the system can be configured to use other schema sets and the schema mapping
27 feature is configured to map between the two. Refer to the \fISystem
28 Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP)\fR for
29 more details.
30 .sp
31 .LP
32 The \fBldapclient\fR(8) utility can make a Solaris machine an LDAP client by
33 setting up the appropriate directories, files, and configuration information.
34 The LDAP client caches this configuration information in local cache files.
35 This configuration information is accessed through the \fBldap_cachemgr\fR(8)
36 daemon. This daemon also refreshes the information in the configuration files
37 from the LDAP server, providing better performance and security. The
38 \fBldap_cachemgr\fR must run at all times for the proper operation of the
39 naming services.
40 .sp
41 .LP
42 There are two types of configuration information, the information available
43 through a profile, and the information configured per client. The profile
44 contains all the information as to how the client accesses the directory. The
45 credential information for proxy user is configured on a per client basis and
46 is not downloaded through the profile.
47 .sp
48 .LP
49 The profile contains server-specific parameters that are required by all
50 clients to locate the servers for the desired LDAP domain. This information
51 could be the server's IP address and the search base Distinguished Name (DN),
52 for instance. It is configured on the client from the default profile during
53 client initialization and is periodically updated by the \fBldap_cachemgr\fR
54 daemon when the expiration time has elapsed.
55 .sp
56 .LP
57 Client profiles can be stored on the LDAP server and can be used by the
58 \fBldapclient\fR utility to initialize an LDAP client. Using the client profile
59 is the easiest way to configure a client machine. See \fBldapclient\fR(8).
60 .sp
61 .LP
62 Credential information includes client-specific parameters that are used by a
63 client. This information could be the Bind DN (LDAP "login" name) of the client
64 and the password. If these parameters are required, they are manually defined
65 during the initialization through \fBldapclient\fR(8).
66 .sp
67 .LP
68 The naming information is stored in containers on the LDAP server. A container
69 is a non-leaf entry in the DIT that contains naming service information.
70 Containers are similar to maps in NIS. A default mapping
71 between the NIS databases and the containers in LDAP is presented below. The
72 location of these containers as well as their names can be overridden through
73 the use of \fBserviceSearchDescriptors\fR. For more information, see
74 \fBldapclient\fR(8).
75 .sp
77 .sp
78 .TS
79 box;
80 c | c | c
81 l | l | l .
82 Database Object Class Container
83 _
84 passwd posixAccount ou=people,dc=...
85 shadowAccount
86 _
87 group posixGroup ou=Group,dc=...
88 _
89 services ipService ou=Services,dc=...
90 _
91 protocols ipProtocol ou=Protocols,dc=...
92 _
93 rpc oncRpc ou=Rpc,dc=...
94 _
95 hosts ipHost ou=Hosts,dc=...
96 ipnodes ipHost ou=Hosts,dc=...
97 _
98 ethers ieee802Device ou=Ethers,dc=...
99 _
100 bootparams bootableDevice ou=Ethers,dc=...
101 _
102 networks ipNetwork ou=Networks,dc=...
103 netmasks ipNetwork ou=Networks,dc=...
104 _
105 netgroup nisNetgroup ou=Netgroup,dc=...
106 _
107 aliases mailGroup ou=Aliases,dc=...
108 _
109 publickey nisKeyObject
110 _
111 generic nisObject nisMapName=...,dc=...
112 _
113 printers printerService ou=Printers,dc=...
114 _
115 auth_attr SolarisAuthAttr ou=SolarisAuthAttr,dc=...
116 _
117 prof_attr SolarisProfAttr ou=SolarisProfAttr,dc=...
118 _
119 exec_attr SolarisExecAttr ou=SolarisProfAttr,dc=...
120 _
121 user_attr SolarisUserAttr ou=people,dc=...
122 .TE
124 .sp
125 .LP
126 The security model for clients is defined by a combination of the credential
127 level to be used, the authentication method, and the PAM modules to be used.
128 The credential level defines what credentials the client should use to
129 authenticate to the directory server, and the authentication method defines the
130 method of choice. Both these can be set with multiple values. The Solaris LDAP
131 supports the following values for credential level :
132 .br
133 .in +2
134 \fBanonymous\fR
135 .in -2
136 .br
137 .in +2
138 \fBproxy\fR
139 .in -2
140 .br
141 .in +2
142 \fBself\fR
143 .in -2
144 .sp
145 .LP
146 The Solaris LDAP supports the following values for authentication method:
147 .br
148 .in +2
149 \fBnone\fR
150 .in -2
151 .br
152 .in +2
153 \fBsimple\fR
154 .in -2
155 .br
156 .in +2
157 \fBsasl/CRAM-MD5\fR
158 .in -2
159 .br
160 .in +2
161 \fBsasl/DIGEST-MD5\fR
162 .in -2
163 .br
164 .in +2
165 \fBsasl/GSSAPI\fR
166 .in -2
167 .br
168 .in +2
169 \fBtls:simple\fR
170 .in -2
171 .br
172 .in +2
173 \fBtls:sasl/CRAM-MD5\fR
174 .in -2
175 .br
176 .in +2
177 \fBtls:sasl/DIGEST-MD5\fR
178 .in -2
179 .sp
180 .LP
181 When the credential level is configured as \fBself\fR, DNS must be configured
182 and the authentication method must be \fBsasl/GSSAPI\fR. The \fBhosts\fR and
183 \fBipnodes\fR in \fB/etc/nsswitch.conf\fR must be configured to use DNS, for
184 example \fBhosts: dns files\fR and \fBipnodes: dns files\fR.
185 .sp
186 .LP
187 \fBsasl/GSSAPI\fR automatically uses \fBGSSAPI\fR confidentiality and integrity
188 options, if they are configured on the directory server.
189 .sp
190 .LP
191 The credential level of \fBself\fR enables per-user naming service lookups, or
192 lookups that use the \fBGSSAPI\fR credentials of the user when connecting to
193 the directory server. Currently the only \fBGSSAPI\fR mechanism supported in
194 this model is Kerberos V5. Kerberos must be configured before you can use this
195 credential level. See \fBkerberos\fR(5) for details.
196 .sp
197 .LP
198 More protection can be provided by means of access control, allowing the server
199 to grant access for certain containers or entries. Access control is specified
200 by Access Control Lists (ACLs) that are defined and stored in the LDAP server.
201 The Access Control Lists on the LDAP server are called Access Control
202 Instructions (ACIs) by the SunOne Directory Server. Each ACL or ACI
203 specifies one or more directory objects, for example, the \fBcn\fR attribute in
204 a specific container, one or more clients to whom you grant or deny access, and
205 one or more access rights that determine what the clients can do to or with the
206 objects. Clients can be users or applications. Access rights can be specified
207 as read and write, for example. Refer to the \fISystem Administration Guide:
208 Naming and Directory Services (DNS, NIS, and LDAP)\fR regarding the
209 restrictions on ACLs and ACIs when using LDAP as a naming repository.
210 .sp
211 .LP
212 A sample \fBnsswitch.conf\fR(4) file called \fBnsswitch.ldap\fR is provided in
213 the \fB/etc\fR directory. This is copied to \fB/etc/nsswitch.conf\fR by the
214 \fBldapclient\fR(8) utility. This file uses LDAP as a repository for the
215 different databases in the \fBnsswitch.conf\fR file.
216 .sp
217 .LP
218 The following is a list of the user commands related to LDAP:
219 .sp
220 .ne 2
221 .na
222 \fB\fBidsconfig\fR(8)\fR
223 .ad
224 .RS 18n
225 Prepares a SunOne Directory Server to be ready to support Solaris LDAP clients.
226 .RE
228 .sp
229 .ne 2
230 .na
231 \fB\fBldapaddent\fR(8)\fR
232 .ad
233 .RS 18n
234 Creates LDAP entries from corresponding \fB/etc\fR files.
235 .RE
237 .sp
238 .ne 2
239 .na
240 \fB\fBldapclient\fR(8)\fR
241 .ad
242 .RS 18n
243 Initializes LDAP clients, or generates a configuration profile to be stored in
244 the directory.
245 .RE
247 .sp
248 .ne 2
249 .na
250 \fB\fBldaplist\fR(1)\fR
251 .ad
252 .RS 18n
253 Lists the contents of the LDAP naming space.
254 .RE
256 .SH FILES
257 .ne 2
258 .na
259 \fB\fB/var/ldap/ldap_client_cred\fR\fR
260 .ad
261 .br
262 .na
263 \fB\fB/var/ldap/ldap_client_file\fR\fR
264 .ad
265 .RS 30n
266 Files that contain the LDAP configuration of the client. Do not manually modify
267 these files. Their content is not guaranteed to be human readable. Use
268 \fBldapclient\fR(8) to update them.
269 .RE
271 .sp
272 .ne 2
273 .na
274 \fB\fB/etc/nsswitch.conf\fR\fR
275 .ad
276 .RS 30n
277 Configuration file for the name-service switch.
278 .RE
280 .sp
281 .ne 2
282 .na
283 \fB\fB/etc/nsswitch.ldap\fR\fR
284 .ad
285 .RS 30n
286 Sample configuration file for the name-service switch configured with LDAP and
287 files.
288 .RE
290 .sp
291 .ne 2
292 .na
293 \fB\fB/etc/pam.conf\fR\fR
294 .ad
295 .RS 30n
296 PAM framework configuration file.
297 .RE
299 .SH SEE ALSO
300 .LP
301 \fBldaplist\fR(1), \fBidsconfig\fR(8), \fBldap_cachemgr\fR(8),
302 \fBldapaddent\fR(8), \fBldapclient\fR(8), \fBnsswitch.conf\fR(4),
303 \fBpam.conf\fR(4), \fBkerberos\fR(5)\fBpam_authtok_check\fR(5),
304 \fBpam_authtok_get\fR(5), \fBpam_authtok_store\fR(5), \fBpam_dhkeys\fR(5),
305 \fBpam_ldap\fR(5), \fBpam_passwd_auth\fR(5), \fBpam_unix_account\fR(5),
306 \fBpam_unix_auth\fR(5), \fBpam_unix_session\fR(5)
307 .sp
308 .LP
309 \fISystem Administration Guide: Naming and Directory Services (DNS, NIS, and
310 LDAP)\fR
311 .SH NOTES
312 .LP
313 The \fBpam_unix\fR(5) module is no longer supported. Similar functionality is
314 provided by \fBpam_authtok_check\fR(5), \fBpam_authtok_get\fR(5),
315 \fBpam_authtok_store\fR(5), \fBpam_dhkeys\fR(5), \fBpam_passwd_auth\fR(5),
316 \fBpam_unix_account\fR(5), \fBpam_unix_auth\fR(5),
317 and \fBpam_unix_session\fR(5).