test

系统管理指南：名称和目录服务（DNS、NIS 和 LDAP）

第 14 章 LDAP 一般参考（参考）

本章包含以下主题：

  1. 空白核对表

  2. LDAP 升级信息

  3. LDAP 命令

  4. pam_ldap 的示例 pam.conf 文件

  5. 为帐户管理配置的 pam_ldap 的示例 pam_conf 文件

  6. LDAP 的 IETF 架构

  7. 目录用户代理配置文件 (DUAProfile) 架构

  8. Solaris 架构

  9. LDAP 的 Internet 打印协议信息

  10. LDAP 的常规目录服务器要求

  11. LDAP 名称服务使用的缺省过滤器

空白核对表

表 14–1 服务器变量定义

变量 

为 _______ 网络定义的变量 

安装目录服务器实例的端口号 (389) 

 

服务器名称  

 

副本服务器（IP 号:端口号） 

 

目录管理器 [dn: cn=directory manager]

 

要为其提供服务的域名  

 

在超时之前处理客户端请求的最长时间（以秒为单位） 

 

为每个搜索请求返回的最多项数 

 

表 14–2 客户机配置文件变量定义

变量 

为 ________ 网络定义的变量 

配置文件名 

 

服务器列表（缺省值为本地子网） 

 

首选服务器列表（按照对服务器进行查找的顺序列出） 

 

搜索范围（沿着目录树向下查找的层数："One" 或 "Sub"）

 

用于获取服务器访问权限的凭证。缺省值为 anonymous

 

是否遵循引用（主服务器不可用时指向另一台服务器的指针）？缺省值为 no。

 

等待服务器返回信息的搜索时间限制（以秒为单位，缺省值为 30）。

 

与服务器进行联系时的绑定时间限制（以秒为单位，缺省值为 30）。

 

验证方法（缺省值为 none）。

 

LDAP 升级信息

本节提供从 Solaris 8 发行版升级到 Solaris 9 或更高发行版时需要考虑的内容。

兼容性

配置了 Solaris 9 或更高 Solaris 软件发行版的客户机与设置为可为 Solaris 8 客户机（仅支持1.0 版的配置文件）提供服务的目录服务器完全兼容。 但是，为了使用 Solaris 9 和更高发行版中的新功能并使用较新的安全模型，必须使用 2.0 版配置文件。

服务器可以同时为旧客户机和新客户机提供服务。只要架构映射未启用，而且未将 2.0 版文件配置为使用具有 serviceSearchDescriptors 属性的特殊过滤器，则不同的客户机就会从服务器得到相同的结果。 显然，如果服务器不使用缺省架构，旧客户机就无法使用该服务器，因为 Solaris 8 客户机不能任意映射非缺省架构。

运行 ldap_cachemgr 守护进程

从 Solaris 9 发行版开始，ldap_cachemgr 守护进程必须一直运行。该守护进程是客户机正常运行所必需的。在使用服务管理工具的 svcadm 命令启动 LDAP 客户机时，会自动调用 ldap_cachemgr 守护进程。有关更多信息，请参见 ldap_cachemgr(1M) 手册页。

新的 automount 架构

从 Solaris 9 发行版开始，在缺省情况下，Solaris 软件对 automount 项使用一个新架构。新架构替代了 Solaris 8 客户机使用的普通 NIS 映射架构。 这意味着，如果用 Solaris 9 或更高版本软件中的工具设置服务器，Solaris 8 客户机将看不到 automount 项。 对于正在设置的服务器将同时为 Solaris 8 客户机和更高软件版本的 Solaris 客户机提供服务的站点，在添加自动挂载程序项之前，可以创建一个配置文件来将新架构映射到旧架构。 这将确保 ldapaddent(1M) 使用旧架构添加项。 但请注意，这还意味着所有基于 Solaris 9 或更高版本软件的客户机都必须使用映射了 automount 架构的配置文件。

只有向配置文件中添加下列映射属性后，该映射才能生效：


attributeMap: 		automount:automountMapName=nisMapName

attributeMap: 		automount:automountKey=cn

attributeMap: 		automount:automountInformation=nisMapEntry

objectclassMap: 	  automount:automountMap=nisMap

objectclassMap: 	  automount:automount=nisObject

pam_ldap 方面的更改

Solaris 10 OS 发行版中对 pam_ldap 引进了几项改动，下面的内容介绍了这些改动。另请参见 pam_ldap(5) 手册页以获得更多信息。

升级到此发行版不会自动更新现有的 pam.conf 文件以反映上述更改。如果现有的 pam.conf 文件中包含 pam_ldap 配置，则在升级之后，系统将通过 CLEANUP 文件通知您。您将需要检查 pam.conf 文件并根据需要修改它。

因为在同一个栈中还使用了其他相关模块，而且还会存在第三方模块，所以不可能为上面列出的更改提供全新的自动更新（主要是口令提示和口令更新）。

有关更多信息，请参见 pam_passwd_auth(5)、pam_authtok_get (5)、pam_authtok_store(5) 和 pam.conf(4) 手册页。

LDAP 命令

Solaris 系统中存在两组与 LDAP 相关的命令。一组命令是常规 LDAP 工具，它们不要求用 LDAP 名称服务配置客户机。另一组命令使用客户机上的常见 LDAP 配置，因而只有客户机使用 LDAP 作为其名称服务时才使用。

常规 LDAP 工具

LDAP 命令行工具支持一组常见的选项（包括验证和绑定参数）。下列工具支持用常见的文本格式来表示名为 LDAP 数据交换格式 (LDAP Data Interchange Format, LDIF) 的目录信息。可使用这些命令直接处理目录项。

需要 LDAP 名称服务的 LDAP 工具

表 14–3 LDAP 工具

工具 

功能 

ldapaddent(1M)

用于根据相应的 /etc 文件在 LDAP 容器中创建项。此工具允许根据文件填充目录。例如，它读取 /etc/passwd 格式的文件，并填充目录中的 passwd 项。

ldaplist(1)

用于列出目录中各个服务的内容。 

idsconfig(1M)

用于设置 Sun Java System Directory Server，使其为 LDAP 名称服务客户机提供服务。 

pam_ldap 的示例 pam.conf 文件


#

# Authentication management

#

# login service (explicit because of pam_dial_auth)

#

login	auth requisite		pam_authtok_get.so.1

login	auth required		pam_dhkeys.so.1

login	auth required		pam_dial_auth.so.1

login	auth required		pam_unix_cred.so.1

login	auth sufficient		pam_unix_auth.so.1

login	auth required		pam_ldap.so.1

#

# rlogin service (explicit because of pam_rhost_auth)

#

rlogin	auth sufficient		pam_rhosts_auth.so.1

rlogin	auth requisite		pam_authtok_get.so.1

rlogin	auth required		pam_dhkeys.so.1

rlogin	auth required		pam_unix_cred.so.1

rlogin	auth sufficient		pam_unix_auth.so.1

rlogin	auth required		pam_ldap.so.1

#

# rsh service (explicit because of pam_rhost_auth,

# and pam_unix_auth for meaningful pam_setcred)

#

rsh	auth sufficient		pam_rhosts_auth.so.1

rsh	auth required		pam_unix_cred.so.1

#

# PPP service (explicit because of pam_dial_auth)

#

ppp	auth requisite		pam_authtok_get.so.1

ppp	auth required		pam_dhkeys.so.1

ppp	auth required		pam_dial_auth.so.1

ppp	auth sufficient		pam_unix_auth.so.1

ppp	auth required		pam_ldap.so.1

#

# Default definitions for Authentication management

# Used when service name is not explicitly mentioned for authentication

#

other	auth requisite		pam_authtok_get.so.1

other	auth required		pam_dhkeys.so.1

other	auth required		pam_unix_cred.so.1

other	auth sufficient		pam_unix_auth.so.1

other	auth required		pam_ldap.so.1

#

# passwd command (explicit because of a different authentication module)

#

passwd	auth sufficient		pam_passwd_auth.so.1

passwd	auth required		pam_ldap.so.1

#

# cron service (explicit because of non-usage of pam_roles.so.1)

#

cron	account required	pam_unix_account.so.1

#

# Default definition for Account management

# Used when service name is not explicitly mentioned for account management

#

other	account requisite	pam_roles.so.1

other	account required	pam_unix_account.so.1

#

# Default definition for Session management

# Used when service name is not explicitly mentioned for session management

#

other	session required	pam_unix_session.so.1

#

# Default definition for  Password management

# Used when service name is not explicitly mentioned for password management

#

other	password required	pam_dhkeys.so.1

other	password requisite	pam_authtok_get.so.1

other	password requisite	pam_authtok_check.so.1

other	password required	pam_authtok_store.so.1

#

# Support for Kerberos V5 authentication and example configurations can

# be found in the pam_krb5(5) man page under the "EXAMPLES" section.

#

为帐户管理配置的 pam_ldap 的示例 pam_conf 文件

注意 –

启用 pam_ldap 帐户管理后，所有用户在每次登录系统时都必须提供口令。进行验证时必须提供登录口令。因此，使用 rsh、rlogin 或 ssh 等工具进行的不基于口令的登录将会失败。


#

# Authentication management

#

# login service (explicit because of pam_dial_auth)

#

login   auth requisite        pam_authtok_get.so.1

login   auth required         pam_dhkeys.so.1

login   auth required         pam_unix_cred.so.1

login   auth required         pam_dial_auth.so.1

login   auth binding          pam_unix_auth.so.1 server_policy

login   auth required         pam_ldap.so.1

#

# rlogin service (explicit because of pam_rhost_auth)

#

rlogin  auth sufficient       pam_rhosts_auth.so.1

rlogin  auth requisite        pam_authtok_get.so.1

rlogin  auth required         pam_dhkeys.so.1

rlogin  auth required         pam_unix_cred.so.1

rlogin  auth binding          pam_unix_auth.so.1 server_policy

rlogin  auth required         pam_ldap.so.1

#

# rsh service (explicit because of pam_rhost_auth,

# and pam_unix_auth for meaningful pam_setcred)

#

rsh     auth sufficient       pam_rhosts_auth.so.1

rsh     auth required         pam_unix_cred.so.1

rsh     auth binding          pam_unix_auth.so.1 server_policy

rsh     auth required         pam_ldap.so.1

#

# PPP service (explicit because of pam_dial_auth)

#

ppp     auth requisite        pam_authtok_get.so.1

ppp     auth required         pam_dhkeys.so.1

ppp     auth required         pam_dial_auth.so.1

ppp     auth binding          pam_unix_auth.so.1 server_policy

ppp     auth required         pam_ldap.so.1

#

# Default definitions for Authentication management

# Used when service name is not explicitly mentioned for authentication

#

other   auth requisite        pam_authtok_get.so.1

other   auth required         pam_dhkeys.so.1

other   auth required         pam_unix_cred.so.1

other   auth binding          pam_unix_auth.so.1 server_policy

other   auth required         pam_ldap.so.1

#

# passwd command (explicit because of a different authentication module)

#

passwd  auth binding          pam_passwd_auth.so.1 server_policy

passwd  auth required         pam_ldap.so.1

#

# cron service (explicit because of non-usage of pam_roles.so.1)

#

cron    account required      pam_unix_account.so.1

#

# Default definition for Account management

# Used when service name is not explicitly mentioned for account management

#

other   account requisite     pam_roles.so.1

other   account binding       pam_unix_account.so.1 server_policy

other   account required      pam_ldap.so.1

#

# Default definition for Session management

# Used when service name is not explicitly mentioned for session management

#

other   session required      pam_unix_session.so.1

#

# Default definition for  Password management

# Used when service name is not explicitly mentioned for password management

#

other   password required     pam_dhkeys.so.1

other   password requisite    pam_authtok_get.so.1

other   password requisite    pam_authtok_check.so.1

other   password required     pam_authtok_store.so.1 server_policy

#

# Support for Kerberos V5 authentication and example configurations can

# be found in the pam_krb5(5) man page under the "EXAMPLES" section.

#

LDAP 的 IETF 架构

架构是一些定义，用于描述哪些类型的信息可作为项存储在服务器的目录中。

为了使目录服务器支持 Solaris LDAP 名称客户机，本章中定义的架构必须在服务器中进行配置，除非该架构是使用客户机的架构映射功能进行映射的。

IETF 定义了三个必需的 LDAP 架构：RFC 2307 网络信息服务架构、LDAP 邮件组 Internet 草案和 LDAP Internet 打印协议 (Internet Print Protocol, IPP) 草案架构。为了支持名称信息服务，必须将这些架构的定义添加到目录服务器中。还可以从 IETF Web 站点 http://www.ietf.org 访问各种 RFC。

注意 –

Internet 草案是草案文档，有效期最长六个月，随时可能会因其他文档而更新或废弃。

RFC 2307 网络信息服务架构

必须对 LDAP 服务器进行配置，使其支持 修订后的 RFC 2307。

nisSchema OID 是 1.3.6.1.1。RFC 2307 属性如下所示：


( nisSchema.1.0 NAME 'uidNumber'

DESC 'An integer uniquely identifying a user in an

		administrative domain'

EQUALITY integerMatch SYNTAX 'INTEGER' SINGLE-VALUE )

 

( nisSchema.1.1 NAME 'gidNumber'

DESC 'An integer uniquely identifying a group in an

		administrative domain'

EQUALITY integerMatch SYNTAX 'INTEGER' SINGLE-VALUE )

 

( nisSchema.1.2 NAME 'gecos'

DESC 'The GECOS field; the common name'

EQUALITY caseIgnoreIA5Match

SUBSTRINGS caseIgnoreIA5SubstringsMatch

SYNTAX 'IA5String' SINGLE-VALUE )

 

( nisSchema.1.3 NAME 'homeDirectory'

DESC 'The absolute path to the home directory'

EQUALITY caseExactIA5Match

SYNTAX 'IA5String' SINGLE-VALUE )

 

( nisSchema.1.4 NAME 'loginShell'

DESC 'The path to the login shell'

EQUALITY caseExactIA5Match

SYNTAX 'IA5String' SINGLE-VALUE )

 

( nisSchema.1.5 NAME 'shadowLastChange'

EQUALITY integerMatch

SYNTAX 'INTEGER' SINGLE-VALUE )

 

( nisSchema.1.6 NAME 'shadowMin'

EQUALITY integerMatch

SYNTAX 'INTEGER' SINGLE-VALUE )

 

( nisSchema.1.7 NAME 'shadowMax'

EQUALITY integerMatch

SYNTAX 'INTEGER' SINGLE-VALUE )

 

( nisSchema.1.8 NAME 'shadowWarning'

EQUALITY integerMatch

SYNTAX 'INTEGER' SINGLE-VALUE )

 

( nisSchema.1.9 NAME 'shadowInactive'

EQUALITY integerMatch

SYNTAX 'INTEGER' SINGLE-VALUE )

 

( nisSchema.1.10 NAME 'shadowExpire'

EQUALITY integerMatch

SYNTAX 'INTEGER' SINGLE-VALUE )

 

( nisSchema.1.11 NAME 'shadowFlag'

EQUALITY integerMatch

SYNTAX 'INTEGER' SINGLE-VALUE )

 

( nisSchema.1.12 NAME 'memberUid'

EQUALITY caseExactIA5Match

SUBSTRINGS caseExactIA5SubstringsMatch

SYNTAX 'IA5String' )

 

( nisSchema.1.13 NAME 'memberNisNetgroup'

EQUALITY caseExactIA5Match

SUBSTRINGS caseExactIA5SubstringsMatch

SYNTAX 'IA5String' )

 

( nisSchema.1.14 NAME 'nisNetgroupTriple'

DESC 'Netgroup triple'

SYNTAX 'nisNetgroupTripleSyntax' )

 

( nisSchema.1.15 NAME 'ipServicePort'

EQUALITY integerMatch

SYNTAX 'INTEGER' SINGLE-VALUE )

 

( nisSchema.1.16 NAME 'ipServiceProtocol'

SUP name )

 

( nisSchema.1.17 NAME 'ipProtocolNumber'

EQUALITY integerMatch

SYNTAX 'INTEGER' SINGLE-VALUE )

 

( nisSchema.1.18 NAME 'oncRpcNumber'

EQUALITY integerMatch

SYNTAX 'INTEGER' SINGLE-VALUE )



( nisSchema.1.19 NAME 'ipHostNumber'

DESC 'IP address as a dotted decimal, eg. 192.168.1.1

	     omitting leading zeros'

SUP name )

 

( nisSchema.1.20 NAME 'ipNetworkNumber'

DESC 'IP network as a dotted decimal, eg. 192.168,

     	omitting leading zeros'

SUP name SINGLE-VALUE )

 

( nisSchema.1.21 NAME 'ipNetmaskNumber'

DESC 'IP netmask as a dotted decimal, eg. 255.255.255.0,

	      omitting leading zeros'

EQUALITY caseIgnoreIA5Match

SYNTAX 'IA5String{128}' SINGLE-VALUE )

 

( nisSchema.1.22 NAME 'macAddress'

DESC 'MAC address in maximal, colon separated hex

      notation, eg. 00:00:92:90:ee:e2'

EQUALITY caseIgnoreIA5Match

SYNTAX 'IA5String{128}' )

 

( nisSchema.1.23 NAME 'bootParameter'

DESC 'rpc.bootparamd parameter'

SYNTAX 'bootParameterSyntax' )

 

( nisSchema.1.24 NAME 'bootFile'

DESC 'Boot image name'

EQUALITY caseExactIA5Match

SYNTAX 'IA5String' )

 

( nisSchema.1.26 NAME 'nisMapName'

SUP name )

 

( nisSchema.1.27 NAME 'nisMapEntry'

EQUALITY caseExactIA5Match

SUBSTRINGS caseExactIA5SubstringsMatch

SYNTAX 'IA5String{1024}' SINGLE-VALUE )

 

( nisSchema.1.28 NAME 'nisPublicKey'

DESC 'NIS public key'

SYNTAX 'nisPublicKeySyntax' )

 

( nisSchema.1.29 NAME 'nisSecretKey'

DESC 'NIS secret key'

SYNTAX 'nisSecretKeySyntax' )

 

( nisSchema.1.30 NAME 'nisDomain'

DESC 'NIS domain'

SYNTAX 'IA5String' )



( nisSchema.1.31 NAME 'automountMapName'

DESC 'automount Map Name'

EQUALITY caseExactIA5Match

SUBSTR caseExactIA5SubstringsMatch

SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )



( nisSchema.1.32 NAME 'automountKey'

DESC 'Automount Key value'

EQUALITY caseExactIA5Match

SUBSTR caseExactIA5SubstringsMatch

SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )



( nisSchema.1.33 NAME 'automountInformation'

DESC 'Automount information'

EQUALITY caseExactIA5Match

SUBSTR caseExactIA5SubstringsMatch

SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )

nisSchema OID 是 1.3.6.1.1。RFC 2307 objectClasses 如下所示：


( nisSchema.2.0 NAME 'posixAccount' SUP top AUXILIARY

  DESC 'Abstraction of an account with POSIX attributes'

  MUST ( cn $ uid $ uidNumber $ gidNumber $ homeDirectory )

  MAY ( userPassword $ loginShell $ gecos $ description ) )

 

( nisSchema.2.1 NAME 'shadowAccount' SUP top AUXILIARY

  DESC 'Additional attributes for shadow passwords'

  MUST uid

  MAY ( userPassword $ shadowLastChange $ shadowMin

        shadowMax $ shadowWarning $ shadowInactive $

        shadowExpire $ shadowFlag $ description ) )

 

( nisSchema.2.2 NAME 'posixGroup' SUP top STRUCTURAL

  DESC 'Abstraction of a group of accounts'

  MUST ( cn $ gidNumber )

  MAY ( userPassword $ memberUid $ description ) )

 

( nisSchema.2.3 NAME 'ipService' SUP top STRUCTURAL

  DESC 'Abstraction an Internet Protocol service.

        Maps an IP port and protocol (such as tcp or udp)

        to one or more names; the distinguished value of

        the cn attribute denotes the service's canonical

        name'

  MUST ( cn $ ipServicePort $ ipServiceProtocol )

  MAY ( description ) )

 

( nisSchema.2.4 NAME 'ipProtocol' SUP top STRUCTURAL

  DESC 'Abstraction of an IP protocol. Maps a protocol number

        to one or more names. The distinguished value of the cn

        attribute denotes the protocol's canonical name'

  MUST ( cn $ ipProtocolNumber )

  MAY  description )

 

( nisSchema.2.5 NAME 'oncRpc' SUP top STRUCTURAL

  DESC 'Abstraction of an Open Network Computing (ONC)

        [RFC1057] Remote Procedure Call (RPC) binding.

        This class maps an ONC RPC number to a name.

        The distinguished value of the cn attribute denotes

        the RPC service's canonical name'

  MUST ( cn $ oncRpcNumber $ description )

  MAY  description )

 

( nisSchema.2.6 NAME 'ipHost' SUP top AUXILIARY

  DESC 'Abstraction of a host, an IP device. The distinguished

        value of the cn attribute denotes the host's canonical

        name. Device SHOULD be used as a structural class'

  MUST ( cn $ ipHostNumber )

  MAY ( l $ description $ manager $ userPassword ) )

 

( nisSchema.2.7 NAME 'ipNetwork' SUP top STRUCTURAL

  DESC 'Abstraction of a network. The distinguished value of

        the cn attribute denotes the network's canonical name'

  MUST ipNetworkNumber

  MAY ( cn $ ipNetmaskNumber $ l $ description $ manager ) )

 

( nisSchema.2.8 NAME 'nisNetgroup' SUP top STRUCTURAL

  DESC 'Abstraction of a netgroup. May refer to other netgroups'

  MUST cn

  MAY ( nisNetgroupTriple $ memberNisNetgroup $ description ) )



( nisSchema.2.9 NAME 'nisMap' SUP top STRUCTURAL

  DESC 'A generic abstraction of a NIS map'

  MUST nisMapName

  MAY description )

 

( nisSchema.2.10 NAME 'nisObject' SUP top STRUCTURAL

  DESC 'An entry in a NIS map'

  MUST ( cn $ nisMapEntry $ nisMapName )

  MAY description )



( nisSchema.2.11 NAME 'ieee802Device' SUP top AUXILIARY

  DESC 'A device with a MAC address; device SHOULD be

        used as a structural class'

  MAY macAddress )

 

( nisSchema.2.12 NAME 'bootableDevice' SUP top AUXILIARY

  DESC 'A device with boot parameters; device SHOULD be

  used as a structural class'

  MAY ( bootFile $ bootParameter ) )

 

( nisSchema.2.14 NAME 'nisKeyObject' SUP top AUXILIARY

  DESC 'An object with a public and secret key'

  MUST ( cn $ nisPublicKey $ nisSecretKey )

  MAY ( uidNumber $ description ) )

 

( nisSchema.2.15 NAME 'nisDomainObject' SUP top AUXILIARY

  DESC 'Associates a NIS domain with a naming context'

  MUST nisDomain )



( nisSchema.2.16 NAME 'automountMap' SUP top STRUCTURAL

  MUST ( automountMapName )

  MAY description )



( nisSchema.2.17 NAME 'automount' SUP top STRUCTURAL

  DESC 'Automount information'

  MUST ( automountKey $ automountInformation )

  MAY description )

邮件别名架构

邮件别名 信息使用由 LDAP 邮件组 Internet 草案（以前称为 draft-steinback-ldap-mailgroups 草案）定义的架构。Solaris LDAP 客户机将继续对邮件别名信息使用此架构，直到有新的架构可用。

原来的 LDAP 邮件组架构中包含大量属性和对象类。Solaris 客户机仅使用下面列出的两个属性和一个对象类：

邮件别名 属性如下所示：


( 0.9.2342.19200300.100.1.3

  NAME 'mail'

  DESC 'RFC822 email address for this person'

  EQUALITY caseIgnoreIA5Match

  SYNTAX 'IA5String(256)'

  SINGLE-VALUE )

 

( 2.16.840.1.113730.3.1.30

  NAME 'mgrpRFC822MailMember'

  DESC 'RFC822 mail address of email only member of group'

  EQUALITY CaseIgnoreIA5Match

  SYNTAX 'IA5String(256)' )

邮件别名 objectClass 如下所示：


( 2.16.840.1.113730.3.2.4

  NAME 'mailGroup'

  SUP top

  STRUCTURAL

  MUST mail

  MAY ( cn $ mailAlternateAddress $ mailHost $ mailRequireAuth $

   mgrpAddHeader $ mgrpAllowedBroadcaster $ mgrpAllowedDomain $

   mgrpApprovePassword $ mgrpBroadcasterModeration $ mgrpDeliverTo $

   mgrpErrorsTo $ mgrpModerator $ mgrpMsgMaxSize $

   mgrpMsgRejectAction $ mgrpMsgRejectText $ mgrpNoMatchAddrs $

   mgrpRemoveHeader $ mgrpRFC822MailMember ))

目录用户代理配置文件 (DUAProfile) 架构

DUAConfSchemaOID 是 1.3.6.1.4.1.11.1.3.1。


DESC 'Default LDAP server host address used by a DUA'

            EQUALITY caseIgnoreMatch

            SYNTAX 1.3.6.1.4.1.1466.115.121.1.15

            SINGLE-VALUE )



          ( DUAConfSchemaOID.1.1 NAME 'defaultSearchBase'

            DESC 'Default LDAP base DN used by a DUA'

            EQUALITY distinguishedNameMatch

            SYNTAX 1.3.6.1.4.1.1466.115.121.1.12

            SINGLE-VALUE )



          ( DUAConfSchemaOID.1.2 NAME 'preferredServerList'

            DESC 'Preferred LDAP server host addresses to be used by a

            DUA'

            EQUALITY caseIgnoreMatch

            SYNTAX 1.3.6.1.4.1.1466.115.121.1.15

            SINGLE-VALUE )



          ( DUAConfSchemaOID.1.3 NAME 'searchTimeLimit'

            DESC 'Maximum time in seconds a DUA should allow for a

            search to complete'

            EQUALITY integerMatch

            SYNTAX 1.3.6.1.4.1.1466.115.121.1.27

            SINGLE-VALUE )



          ( DUAConfSchemaOID.1.4 NAME 'bindTimeLimit'

            DESC 'Maximum time in seconds a DUA should allow for the

            bind operation to complete'

            EQUALITY integerMatch

            SYNTAX 1.3.6.1.4.1.1466.115.121.1.27

            SINGLE-VALUE )



          ( DUAConfSchemaOID.1.5 NAME 'followReferrals'

            DESC 'Tells DUA if it should follow referrals

            returned by a DSA search result'

            EQUALITY caseIgnoreIA5Match

            SYNTAX 1.3.6.1.4.1.1466.115.121.1.7

            SINGLE-VALUE )



          ( DUAConfSchemaOID.1.6 NAME 'authenticationMethod'

            DESC 'A keystring which identifies the type of

            authentication method used to contact the DSA'

            EQUALITY caseIgnoreMatch

            SYNTAX 1.3.6.1.4.1.1466.115.121.1.15

            SINGLE-VALUE )



          ( DUAConfSchemaOID.1.7 NAME 'profileTTL'

            DESC 'Time to live, in seconds, before a client DUA

            should re-read this configuration profile' 

				'serviceSearchDescriptor'

            DESC 'LDAP search descriptor list used by a DUA'

            EQUALITY caseExactMatch

            SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )



          ( DUAConfSchemaOID.1.9 NAME 'attributeMap'

            DESC 'Attribute mappings used by a DUA'

            EQUALITY caseIgnoreIA5Match

            SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )



          ( DUAConfSchemaOID.1.10 NAME 'credentialLevel'

            DESC 'Identifies type of credentials a DUA should

            use when binding to the LDAP server'

            EQUALITY caseIgnoreIA5Match

            SYNTAX 1.3.6.1.4.1.1466.115.121.1.26

            SINGLE-VALUE )



          ( DUAConfSchemaOID.1.11 NAME 'objectclassMap'

            DESC 'Objectclass mappings used by a DUA'

            EQUALITY caseIgnoreIA5Match

            SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )



          ( DUAConfSchemaOID.1.12 NAME 'defaultSearchScope' SINGLE-VALUE )



          ( DUAConfSchemaOID.1.13 NAME 'serviceCredentialLevel'

            DESC 'Identifies type of credentials a DUA

            should use when binding to the LDAP server for a

            specific service'

            EQUALITY caseIgnoreIA5Match

            SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )



          ( DUAConfSchemaOID.1.15 NAME 'serviceAuthenticationMethod'

            DESC 'Authentication Method used by a service of the DUA'

            EQUALITY caseIgnoreMatch

            SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )



			  ( DUAConfSchemaOID.2.4 NAME 'DUAConfigProfile'

			  	 SUP top STRUCTURAL

				 DESC 'Abstraction of a base configuration for a DUA'

				 MUST ( cn )

				 MAY ( defaultServerList $ preferredServerList $

                defaultSearchBase $ defaultSearchScope $

                searchTimeLimit $ bindTimeLimit $

                credentialLevel $ authenticationMethod $

                followReferrals $ serviceSearchDescriptor $

                serviceCredentialLevel $ serviceAuthenticationMethod $

                objectclassMap $ attributeMap $

                profileTTL ) )

Solaris 架构

Solaris 平台所需的架构有：

Solaris 项目架构

/etc/project 是与项目相关联的属性的本地源。有关更多信息，请参见 project(4)。

项目属性如下所示：


( 1.3.6.1.4.1.42.2.27.5.1.1 NAME 'SolarisProjectID'

  DESC 'Unique ID for a Solaris Project entry'

  EQUALITY integerMatch

  SYNTAX INTEGER SINGLE )



( 1.3.6.1.4.1.42.2.27.5.1.2 NAME 'SolarisProjectName'

  DESC 'Name of a Solaris Project entry'

  EQUALITY caseExactIA5Match

  SYNTAX IA5String SINGLE )



( 1.3.6.1.4.1.42.2.27.5.1.3 NAME 'SolarisProjectAttr'

  DESC 'Attributes of a Solaris Project entry'

  EQUALITY caseExactIA5Match

  SYNTAX IA5String )



( 1.3.6.1.4.1.42.2.27.5.1.30 NAME 'memberGid'

  DESC 'Posix Group Name'

  EQUALITY caseExactIA5Match

  SYNTAX 'IA5String' )

项目objectClass 如下所示：


( 1.3.6.1.4.1.42.2.27.5.2.1 NAME 'SolarisProject'

  SUP top STRUCTURAL

  MUST ( SolarisProjectID $ SolarisProjectName )

  MAY ( memberUid $ memberGid $ description $ SolarisProjectAttr ) )

基于角色的访问控制和执行配置文件架构

/etc/user_attr 是与用户和角色相关联的扩展属性的本地源。有关更多信息，请参见 user_attr(4)。

基于角色的访问控制 属性如下所示：


( 1.3.6.1.4.1.42.2.27.5.1.4 NAME 'SolarisAttrKeyValue'

  DESC 'Semi-colon separated key=value pairs of attributes'

  EQUALITY caseIgnoreIA5Match

  SUBSTRINGS caseIgnoreIA5Match

  SYNTAX 'IA5String' SINGLE-VALUE )

 

( 1.3.6.1.4.1.42.2.27.5.1.7 NAME 'SolarisAttrShortDesc'

  DESC 'Short description about an entry, used by GUIs'

  EQUALITY caseIgnoreIA5Match

  SYNTAX 'IA5String' SINGLE-VALUE )

 

( 1.3.6.1.4.1.42.2.27.5.1.8 NAME 'SolarisAttrLongDesc'

  DESC 'Detail description about an entry'

  EQUALITY caseIgnoreIA5Match

  SYNTAX 'IA5String' SINGLE-VALUE )

 

( 1.3.6.1.4.1.42.2.27.5.1.9 NAME 'SolarisKernelSecurityPolicy'

  DESC 'Solaris  kernel security policy'

  EQUALITY caseIgnoreIA5Match

  SYNTAX 'IA5String' SINGLE-VALUE )

 

( 1.3.6.1.4.1.42.2.27.5.1.10 NAME 'SolarisProfileType'

  DESC 'Type of object defined in profile'

  EQUALITY caseIgnoreIA5Match

  SYNTAX 'IA5String' SINGLE-VALUE )

 

( 1.3.6.1.4.1.42.2.27.5.1.11 NAME 'SolarisProfileId'

  DESC 'Identifier of object defined in profile'

  EQUALITY caseExactIA5Match

  SYNTAX 'IA5String' SINGLE-VALUE )

 

( 1.3.6.1.4.1.42.2.27.5.1.12 NAME 'SolarisUserQualifier'

  DESC 'Per-user login attributes'

  EQUALITY caseIgnoreIA5Match

  SYNTAX 'IA5String' SINGLE-VALUE )

 

( 1.3.6.1.4.1.42.2.27.5.1.13 NAME 'SolarisReserved1'

  DESC 'Reserved for future use'

  EQUALITY caseIgnoreIA5Match

  SYNTAX 'IA5String' SINGLE-VALUE )

 

( 1.3.6.1.4.1.42.2.27.5.1.14 NAME 'SolarisReserved2'

  DESC 'Reserved for future use'

  EQUALITY caseIgnoreIA5Match

  SYNTAX 'IA5String' SINGLE-VALUE )

基于角色的访问控制 objectClassses 如下所示：


( 1.3.6.1.4.1.42.2.27.5.2.3 NAME 'SolarisUserAttr' SUP top AUXILIARY

  DESC 'User attributes'

  MAY ( SolarisUserQualifier $ SolarisAttrReserved1 $ \

        SolarisAttrReserved2 $ SolarisAttrKeyValue ) )

 

( 1.3.6.1.4.1.42.2.27.5.2.4 NAME 'SolarisAuthAttr' SUP top STRUCTURAL

  DESC 'Authorizations data'

  MUST cn

  MAY ( SolarisAttrReserved1 $ SolarisAttrReserved2 $ \

        SolarisAttrShortDesc $ SolarisAttrLongDesc $ \

        SolarisAttrKeyValue ) )

 

( 1.3.6.1.4.1.42.2.27.5.2.5 NAME 'SolarisProfAttr' SUP top STRUCTURAL

  DESC 'Profiles data'

  MUST cn

  MAY ( SolarisAttrReserved1 $ SolarisAttrReserved2 $ \

        SolarisAttrLongDesc $ SolarisAttrKeyValue ) )

 

( 1.3.6.1.4.1.42.2.27.5.2.6 NAME 'SolarisExecAttr' SUP top AUXILIARY

  DESC 'Profiles execution attributes'

  MAY ( SolarisKernelSecurityPolicy $ SolarisProfileType $ \

        SolarisAttrReserved1 $ SolarisAttrReserved2 $ \

        SolarisProfileId $ SolarisAttrKeyValue ) )

LDAP 的 Internet 打印协议信息

以下各节提供有关 Internet 打印协议和 Sun 打印机的属性和 ObjectClasses 的信息。

Internet 打印协议 (Internet Print Protocol, IPP) 属性


( 1.3.18.0.2.4.1140 

NAME 'printer-uri' 

DESC 'A URI supported by this printer.  

This URI SHOULD be used as a relative distinguished name (RDN).  

If printer-xri-supported is implemented, then this URI value 

MUST be listed in a member value of printer-xri-supported.' 

EQUALITY caseIgnoreMatch 

ORDERING caseIgnoreOrderingMatch 

SUBSTR caseIgnoreSubstringsMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
 

( 1.3.18.0.2.4.1107 

NAME 'printer-xri-supported' 

DESC 'The unordered list of XRI (extended resource identifiers) supported 

by this printer.  

Each member of the list consists of a URI (uniform resource identifier) 

followed by optional authentication and security metaparameters.' 

EQUALITY caseIgnoreMatch 

ORDERING caseIgnoreOrderingMatch 

SUBSTR caseIgnoreSubstringsMatch 

SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
 

( 1.3.18.0.2.4.1135 

NAME 'printer-name' 

DESC 'The site-specific administrative name of this printer, more end-user 

friendly than a URI.' 

EQUALITY caseIgnoreMatch 

ORDERING caseIgnoreOrderingMatch 

SUBSTR caseIgnoreSubstringsMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}  SINGLE-VALUE )
 

( 1.3.18.0.2.4.1119 

NAME 'printer-natural-language-configured' 

DESC 'The configured language in which error and status messages will be 

generated (by default) by this printer.  

Also, a possible language for printer string attributes set by operator, 

system administrator, or manufacturer.  

Also, the (declared) language of the "printer-name", "printer-location", 

"printer-info", and "printer-make-and-model" attributes of this printer. 

For example: "en-us" (US English) or "fr-fr" (French in France) Legal values of 

language tags conform to [RFC3066] "Tags for the Identification of Languages".' 

EQUALITY caseIgnoreMatch 

ORDERING caseIgnoreOrderingMatch 

SUBSTR caseIgnoreSubstringsMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}  SINGLE-VALUE )
 

( 1.3.18.0.2.4.1136 

NAME 'printer-location' 

DESC 'Identifies the location of the printer. This could include

things like: "in Room 123A", "second floor of building XYZ".' 

EQUALITY caseIgnoreMatch 

ORDERING caseIgnoreOrderingMatch 

SUBSTR caseIgnoreSubstringsMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE )
 

( 1.3.18.0.2.4.1139 

NAME 'printer-info' 

DESC 'Identifies the descriptive information about this printer.  

This could include things like: "This printer can be used for 

printing color transparencies for HR presentations", or 

"Out of courtesy for others, please print only small (1-5 page) 

jobs at this printer", or even "This printer is going away on July 1, 1997, 

please find a new printer".' 

EQUALITY caseIgnoreMatch 

ORDERING caseIgnoreOrderingMatch 

SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} 

SINGLE-VALUE )
 

( 1.3.18.0.2.4.1134 

NAME 'printer-more-info' 

DESC 'A URI used to obtain more information about this specific printer.  

For example, this could be an HTTP type URI referencing an HTML page 

accessible to a Web Browser.  

The information obtained from this URI is intended for end user consumption.' 

EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch 

SUBSTR caseIgnoreSubstringsMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
 

( 1.3.18.0.2.4.1138 

NAME 'printer-make-and-model' 

DESC 'Identifies the make and model of the device.  

The device manufacturer MAY initially populate this attribute.' 

EQUALITY caseIgnoreMatch 

ORDERING caseIgnoreOrderingMatch 

SUBSTR caseIgnoreSubstringsMatch 

SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}  SINGLE-VALUE )
 

( 1.3.18.0.2.4.1133 

NAME 'printer-ipp-versions-supported' 

DESC 'Identifies the IPP protocol version(s) that this printer supports, 

including major and minor versions, 

i.e., the version numbers for which this Printer implementation meets 

the conformance requirements.' 

EQUALITY caseIgnoreMatch 

ORDERING caseIgnoreOrderingMatch 

SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} )
 

( 1.3.18.0.2.4.1132 

NAME 'printer-multiple-document-jobs-supported' 

DESC 'Indicates whether or not the printer supports more than one 

document per job, i.e., more than one Send-Document or Send-Data 

operation with document data.' 

EQUALITY booleanMatch 

SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
 

( 1.3.18.0.2.4.1109 

NAME 'printer-charset-configured' 

DESC 'The configured charset in which error and status messages will be 

generated (by default) by this printer.  

Also, a possible charset for printer string attributes set by operator, 

system administrator, or manufacturer.  

For example: "utf-8" (ISO 10646/Unicode) or "iso-8859-1" (Latin1).  

Legal values are defined by the IANA Registry of Coded Character Sets and 

the "(preferred MIME name)" SHALL be used as the tag.  

For coherence with IPP Model, charset tags in this attribute SHALL be 

lowercase normalized.  

This attribute SHOULD be static (time of registration) and SHOULD NOT be

dynamically refreshed attributetypes: (subsequently).' 

EQUALITY caseIgnoreMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{63} SINGLE-VALUE )
 

( 1.3.18.0.2.4.1131 

NAME 'printer-charset-supported' 

DESC 'Identifies the set of charsets supported for attribute type values of 

type Directory String for this directory entry.  

For example: "utf-8" (ISO 10646/Unicode) or "iso-8859-1" (Latin1).  

Legal values are defined by the IANA Registry of Coded Character Sets and 

the preferred MIME name.' 

EQUALITY caseIgnoreMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{63} )
 

( 1.3.18.0.2.4.1137 

NAME 'printer-generated-natural-language-supported' 

DESC 'Identifies the natural language(s) supported for this directory entry.  

For example: "en-us" (US English) or "fr-fr" (French in France).  

Legal values conform to [RFC3066], Tags for the Identification of Languages.' 

EQUALITY caseIgnoreMatch 

ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{63} )
 

( 1.3.18.0.2.4.1130 

NAME 'printer-document-format-supported' 

DESC 'The possible document formats in which data may be interpreted 

and printed by this printer.  

Legal values are MIME types come from the IANA Registry of Internet Media Types.' 

EQUALITY caseIgnoreMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} )
 

( 1.3.18.0.2.4.1129 

NAME 'printer-color-supported' 

DESC 'Indicates whether this printer is capable of any type of color printing 

at all, including highlight color.' 

EQUALITY booleanMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.7  SINGLE-VALUE )
 

( 1.3.18.0.2.4.1128 

NAME 'printer-compression-supported' 

DESC 'Compression algorithms supported by this printer.  

For example: "deflate, gzip".  Legal values include; "none", "deflate" 

attributetypes: (public domain ZIP), "gzip" (GNU ZIP), "compress" (UNIX).' 

EQUALITY caseIgnoreMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255} )
 

( 1.3.18.0.2.4.1127 

NAME 'printer-pages-per-minute' 

DESC 'The nominal number of pages per minute which may be output by this 

printer (e.g., a simplex or black-and-white printer).  

This attribute is informative, NOT a service guarantee.  

Typically, it is the value used in marketing literature to describe this printer.' 

EQUALITY integerMatch 

ORDERING integerOrderingMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.27  SINGLE-VALUE )
 

( 1.3.18.0.2.4.1126 NAME 'printer-pages-per-minute-color' 

DESC 'The nominal number of color pages per minute which may be output by this 

printer (e.g., a simplex or color printer).  

This attribute is informative, NOT a service guarantee.  

Typically, it is the value used in marketing literature to describe this printer.' 

EQUALITY integerMatch 

ORDERING integerOrderingMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.27  SINGLE-VALUE )
 

( 1.3.18.0.2.4.1125 NAME 'printer-finishings-supported' 

DESC 'The possible finishing operations supported by this printer. 

Legal values include; "none", "staple", "punch", "cover", "bind", "saddle-stitch", 

"edge-stitch", "staple-top-left", "staple-bottom-left", "staple-top-right", 

"staple-bottom-right", "edge-stitch-left", "edge-stitch-top", "edge-stitch-right", 

"edge-stitch-bottom", "staple-dual-left", "staple-dual-top", "staple-dual-right", 

"staple-dual-bottom".' 

EQUALITY caseIgnoreMatch 

SUBSTR caseIgnoreSubstringsMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255} )
 

( 1.3.18.0.2.4.1124 NAME 'printer-number-up-supported' 

DESC 'The possible numbers of print-stream pages to impose upon a single side of 

an instance of a selected medium. Legal values include; 1, 2, and 4.  

Implementations may support other values.' 

EQUALITY integerMatch 

ORDERING integerOrderingMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 )
 

( 1.3.18.0.2.4.1123 NAME 'printer-sides-supported' 

DESC 'The number of impression sides (one or two) and the two-sided impression 

rotations supported by this printer.  

Legal values include; "one-sided", "two-sided-long-edge", "two-sided-short-edge".' 

EQUALITY caseIgnoreMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} )
 

( 1.3.18.0.2.4.1122 NAME 'printer-media-supported' 

DESC 'The standard names/types/sizes (and optional color suffixes) of the media 

supported by this printer.  

For example: "iso-a4",  "envelope", or "na-letter-white".  

Legal values  conform to ISO 10175, Document Printing Application (DPA), and any 

IANA registered extensions.'

EQUALITY caseIgnoreMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255} )
 

( 1.3.18.0.2.4.1117 NAME 'printer-media-local-supported' 

DESC 'Site-specific names of media supported by this printer, in the language in 

"printer-natural-language-configured".  

For example: "purchasing-form" (site-specific name) as opposed to 

(in "printer-media-supported"): "na-letter" (standard keyword from ISO 10175).' 

EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255} )
 

( 1.3.18.0.2.4.1121 NAME 'printer-resolution-supported' 

DESC 'List of resolutions supported for printing documents by this printer.  

Each resolution value is a string with 3 fields:  

1) Cross feed direction resolution (positive integer), 2) Feed direction 

resolution (positive integer), 3) Resolution unit.  

Legal values are "dpi" (dots per inch) and "dpcm" (dots per centimeter).  

Each resolution field is delimited by ">".  For example:  "300> 300> dpi>".' 

EQUALITY caseIgnoreMatch 

SUBSTR caseIgnoreSubstringsMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255} )
 

( 1.3.18.0.2.4.1120 NAME 'printer-print-quality-supported' 

DESC 'List of print qualities supported for printing documents on this printer.  

For example: "draft, normal".  Legal values include; "unknown", "draft", "normal", 

"high".' 

EQUALITY caseIgnoreMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} )
 

( 1.3.18.0.2.4.1110 NAME 'printer-job-priority-supported' 

DESC 'Indicates the number of job priority levels supported.  

An IPP conformant printer which supports job priority must always support a 

full range of priorities from "1" to "100" 

(to ensure consistent behavior), therefore this attribute describes the 

"granularity". 

 Legal values of this attribute are from "1" to "100".' 

EQUALITY integerMatch 

ORDERING integerOrderingMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.27  SINGLE-VALUE )
 

( 1.3.18.0.2.4.1118 

NAME 'printer-copies-supported' 

DESC 'The maximum number of copies of a document that may be printed as a single job.  

A value of "0" indicates no maximum limit.  

A value of "-1" indicates unknown.' 

EQUALITY integerMatch 

ORDERING integerOrderingMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.27  SINGLE-VALUE )
 

( 1.3.18.0.2.4.1111 

NAME 'printer-job-k-octets-supported' 

DESC 'The maximum size in kilobytes (1,024 octets actually) incoming print job that 

this printer will accept.  

A value of "0" indicates no maximum limit.  A value of "-1" indicates unknown.' 

EQUALITY integerMatch 

ORDERING integerOrderingMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.27  SINGLE-VALUE )
 

( 1.3.18.0.2.4.1113 

NAME 'printer-service-person' 

DESC 'The name of the current human service person responsible for servicing this 

printer.  

It is suggested that this string include information that would enable other humans 

to reach the service person, such as a phone number.' 

EQUALITY caseIgnoreMatch 

ORDERING caseIgnoreOrderingMatch 

SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}  

SINGLE-VALUE )
 

( 1.3.18.0.2.4.1114 

NAME 'printer-delivery-orientation-supported' 

DESC 'The possible delivery orientations of pages as they are printed and ejected 

from this printer.  

Legal values include; "unknown", "face-up", and "face-down".' 

EQUALITY caseIgnoreMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} )
 

( 1.3.18.0.2.4.1115 

NAME 'printer-stacking-order-supported' 

DESC 'The possible stacking order of pages as they are printed and ejected from 

this printer. 

Legal values include; "unknown", "first-to-last", "last-to-first".' 

EQUALITY caseIgnoreMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} )
 

( 1.3.18.0.2.4.1116 

NAME 'printer-output-features-supported' 

DESC 'The possible output features supported by this printer. 

Legal values include; "unknown", "bursting", "decollating", "page-collating", 

"offset-stacking".' 

EQUALITY caseIgnoreMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} )
 

( 1.3.18.0.2.4.1108 

NAME 'printer-aliases' 

DESC 'Site-specific administrative names of this printer in addition the printer 

name specified for printer-name.' 

EQUALITY caseIgnoreMatch 

ORDERING caseIgnoreOrderingMatch 

SUBSTR caseIgnoreSubstringsMatch 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} )
 

( 1.3.6.1.4.1.42.2.27.5.1.63 

NAME 'sun-printer-bsdaddr' 

DESC 'Sets the server, print queue destination name and whether the client generates 

protocol extensions. 

"Solaris" specifies a Solaris print server extension. The value is represented b the 

following value: server "," destination ", Solaris".' 

SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE )
 

( 1.3.6.1.4.1.42.2.27.5.1.64 

NAME 'sun-printer-kvp' 

DESC 'This attribute contains a set of key value pairs which may have meaning to the 

print subsystem or may be user defined. 

Each value is represented by the following: key "=" value.' 

SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' )

Internet 打印协议 (Internet Print Protocol, IPP) ObjectClasses 


objectclasses: ( 1.3.18.0.2.6.2549 

NAME 'slpService' 

DESC 'DUMMY definition' 

SUP 'top' MUST (objectclass) MAY ())
 

objectclasses: ( 1.3.18.0.2.6.254 

NAME 'slpServicePrinter' 

DESC 'Service Location Protocol (SLP) information.' 

AUXILIARY SUP 'slpService')
 

objectclasses: ( 1.3.18.0.2.6.258 

NAME 'printerAbstract' 

DESC 'Printer related information.' 

ABSTRACT SUP 'top' MAY ( printer-name 

$ printer-natural-language-configured 

$ printer-location 

$ printer-info 

$ printer-more-info 

$ printer-make-and-model 

$ printer-multiple-document-jobs-supported 

$ printer-charset-configured 

$ printer-charset-supported 

$ printer-generated-natural-language-supported 

$ printer-document-format-supported 

$ printer-color-supported 

$ printer-compression-supported 

$ printer-pages-per-minute 

$ printer-pages-per-minute-color 

$ printer-finishings-supported 

$ printer-number-up-supported 

$ printer-sides-supported 

$ printer-media-supported 

$ printer-media-local-supported 

$ printer-resolution-supported 

$ printer-print-quality-supported 

$ printer-job-priority-supported 

$ printer-copies-supported 

$ printer-job-k-octets-supported 

$ printer-current-operator 

$ printer-service-person 

$ printer-delivery-orientation-supported 

$ printer-stacking-order-supported $ printer! -output-features-supported ))
 

objectclasses: ( 1.3.18.0.2.6.255 

NAME 'printerService' 

DESC 'Printer information.' 

STRUCTURAL SUP 'printerAbstract' MAY ( printer-uri 

$ printer-xri-supported ))
 

objectclasses: ( 1.3.18.0.2.6.257 

NAME 'printerServiceAuxClass' 

DESC 'Printer information.' 

AUXILIARY SUP 'printerAbstract' MAY ( printer-uri $ printer-xri-supported ))
 

objectclasses: ( 1.3.18.0.2.6.256 

NAME 'printerIPP' 

DESC 'Internet Printing Protocol (IPP) information.' 

AUXILIARY SUP 'top' MAY   ( printer-ipp-versions-supported $ 

printer-multiple-document-jobs-supported ))
 

objectclasses: ( 1.3.18.0.2.6.253 

NAME 'printerLPR' 

DESC 'LPR information.' 

AUXILIARY SUP 'top' MUST ( printer-name ) MAY ( printer-aliases))
 

objectclasses: ( 1.3.6.1.4.1.42.2.27.5.2.14 

NAME 'sunPrinter' 

DESC 'Sun printer information' 

SUP 'top' AUXILIARY MUST (objectclass $ printer-name)  MAY 

(sun-printer-bsdaddr $ sun-printer-kvp))

Sun 打印机属性


ATTRIBUTE ( 1.3.6.1.4.1.42.2.27.5.1.63

NAME sun-printer-bsdaddr

DESC 'Sets the server, print queue destination name and whether the 

     client generates protocol extensions. "Solaris" specifies a 

     Solaris print server extension.  The value is represented by 

     the following value: server "," destination ", Solaris".'

EQUALITY caseIgnoreIA5Match

SYNTAX 1.3.6.1.4.1.1466.115.121.1.15   

SINGLE-VALUE

)





ATTRIBUTE ( 1.3.6.1.4.1.42.2.27.5.1.64

NAME sun-printer-kvp

DESC 'This attribute contains a set of key value pairs which may have

      meaning to the print subsystem or may be user defined.  Each

      value is represented by the following: key "=" value.'

EQUALITY caseIgnoreIA5Match 

SYNTAX  1.3.6.1.4.1.1466.115.121.1.15  )

Sun 打印机 ObjectClasses 


OBJECTCLASS ( 1.3.6.1.4.1.42.2.27.5.2.14

NAME sunPrinter

DESC 'Sun printer information'

SUP  top

AUXILIARY

MUST ( printer-name )

MAY  ( sun-printer-bsdaddr $ sun-printer-kvp ))

LDAP 的常规目录服务器要求

为了支持基于 Solaris 9 或更高 Solaris 版本的 LDAP 客户机，无论哪个品牌的服务器都必须支持 LDAP 3.0 版协议以及复合命名和辅助对象类。 另外，还必须至少支持下列控制之一：

如果使用 pam_unix，则服务器必须支持以 UNIX crypt 格式存储口令。

如果使用 TLS，则服务器必须支持 SSL 或 TLS。

LDAP 名称服务使用的缺省过滤器

如果没有使用 SSD 为给定的服务手动指定参数，将使用缺省过滤器。要列出给定服务的缺省过滤器，请使用带 -v 选项的 ldaplist。

在以下示例中，filter=(&(objectclass=iphost)(cn=abcde) 定义了缺省过滤器： 


database=hosts

filter=(&(objectclass=iphost)(cn=abcde)

user data=(&(%s) (cn=abcde))

ldaplist 生成缺省过滤器的以下列表，其中 %s 表示一个字符串，%d 表示一个数字：


hosts

(&(objectclass=iphost)(cn=%s))

--------------

passwd

(&(objectclass=posixaccount)(uid=%s))

--------------

services

(&(objectclass=ipservice)(cn=%s))

--------------

group

(&(objectclass=posixgroup)(cn=%s))

--------------

netgroup

(&(objectclass=nisnetgroup)(cn=%s))

--------------

networks

(&(objectclass=ipnetwork)(ipnetworknumber=%s))

--------------

netmasks

(&(objectclass=ipnetwork)(ipnetworknumber=%s))

--------------

rpc

(&(objectclass=oncrpc)(cn=%s))

--------------

protocols

(&(objectclass=ipprotocol)(cn=%s))

--------------

bootparams

(&(objectclass=bootableDevice)(cn=%s))

--------------

ethers

(&(objectclass=ieee802Device)(cn=%s))

--------------

publickey

(&(objectclass=niskeyobject)(cn=%s))

or

(&(objectclass=niskeyobject)(uidnumber=%d))

--------------

aliases

(&(objectclass=mailGroup)(cn=%s))

--------------

表 14–4 用在 getXbyY 调用中的 LDAP 过滤器

过滤器 

定义 

bootparamByName

(&(objectClass=bootableDevice)(cn=%s))

etherByHost

(&(objectClass=ieee802Device)(cn=%s))

etherByEther

(&(objectClass=ieee802Device)(macAddress=%s))

groupByName

(&(objectClass=posixGroup)(cn=%s))

groupByGID

(&(objectClass=posixGroup)(gidNumber=%ld))

groupByMember

(&(objectClass=posixGroup)(memberUid=%s))

hostsByName

(&(objectClass=ipHost)(cn=%s))

hostsByAddr

(&(objectClass=ipHost)(ipHostNumber=%s))

keyByUID

(&(objectClass=nisKeyObject)(uidNumber=%s))

keyByHost

(&(objectClass=nisKeyObject)(cn=%s))

netByName

(&(objectClass=ipNetwork)(cn=%s))

netByAddr

(&(objectClass=ipNetwork)(ipNetworkNumber=%s))

nisgroupMember

(membernisnetgroup=%s)

maskByNet

(&(objectClass=ipNetwork)(ipNetworkNumber=%s))

printerByName

(& (objectClass=sunPrinter)(|(printer-name=%s)(printer-aliases=%s)))

projectByName

(&(objectClass=SolarisProject)(SolarisProjectName=%s))

projectByID

(&(objectClass=SolarisProject)(SolarisProjectID=%ld))

protoByName

(&(objectClass=ipProtocol)(cn=%s))

protoByNumber

(&(objectClass=ipProtocol)(ipProtocolNumber=%d))

passwordByName

(&(objectClass=posixAccount)(uid=%s))

passwordByNumber

(&(objectClass=posixAccount)(uidNumber=%ld))

rpcByName

(&(objectClass=oncRpc)(cn=%s))

rpcByNumber

(&(objectClass=oncRpc)(oncRpcNumber=%d))

serverByName

(&(objectClass=ipService)(cn=%s))

serverByPort

(&(objectClass=ipService)(ipServicePort=%ld))

serverByNameAndProto

(&(objectClass=ipService)(cn=%s)(ipServiceProtocol=%s))

specialByNameserver

(ipServiceProtocol=%s))

ByPortAndProto

(&(objectClass=shadowAccount)(uid=%s))

netgroupByTriple

(&(objectClass=nisNetGroup)(nisnetgrouptriple=(%s,%s,%s)))

netgroupByMember

(&(objectClass=nisNetGroup)(|(membernisnetgroup=%s)

authName

(&(objectClass=SolarisAuthAttr)(cn=%s))

auditUserByName

(&(objectClass=SolarisAuditUser)(uid=%s))

execByName

(&(objectClass=SolarisExecAttr)(cn=%s) (SolarisKernelSecurityPolicy=%s)(SolarisProfileType=%s))

execByPolicy

(&(objectClass=SolarisExecAttr)(SolarisProfileId=%s) (SolarisKernelSecurityPolicy=%s)(SolarisProfileType=%s))

profileByName

(&(objectClass=SolarisProfAttr)(cn=%s))

userByName

(&(objectClass=SolarisUserAttr)(uid=%s))

下表列出了 getent 属性过滤器。

表 14–5 getent 属性过滤器

过滤器 

定义 

aliases

(objectClass=rfc822MailGroup)

auth_attr

(objectClass=SolarisAuthAttr)

audit_user

(objectClass=SolarisAuditUser)

exec_attr

(objectClass=SolarisExecAttr)

group

(objectClass=posixGroup)

hosts

(objectClass=ipHost)

networks

(objectClass=ipNetwork)

prof_attr

(objectClass=SolarisProfAttr)

protocols

(objectClass=ipProtocol)

passwd

(objectClass=posixAccount)

printers

(objectClass=sunPrinter)

rpc

(objectClass=oncRpc)

services

(objectClass=ipService)

shadow

(objectclass=shadowAccount)

project

(objectClass=SolarisProject)

usr_attr

(objectClass=SolarisUserAttr)