Skip Navigation Links | |
Exit Print View | |
System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP) Oracle Solaris 11 Express 11/10 |
Part I About Naming and Directory Services
1. Naming and Directory Services (Overview)
2. The Name Service Switch (Overview)
Part II DNS Setup and Administration
3. DNS Setup and Administration (Reference)
Part III NIS Setup and Administration
4. Network Information Service (NIS) (Overview)
5. Setting Up and Configuring NIS Service
Part IV LDAP Naming Services Setup and Administration
8. Introduction to LDAP Naming Services (Overview/Reference)
9. LDAP Basic Components and Concepts (Overview)
10. Planning Requirements for LDAP Naming Services (Tasks)
11. Setting Up Sun Java System Directory Server With LDAP Clients (Tasks)
12. Setting Up LDAP Clients (Tasks)
13. LDAP Troubleshooting (Reference)
14. LDAP General Reference (Reference)
15. Transitioning From NIS to LDAP (Overview/Tasks)
Part V Active Directory Naming Service
16. Setting Up Oracle Solaris Active Directory Clients
Overview of the nss_ad Naming Service Module
Configuring the nss_ad Naming Service Module
The following section describes how the nss_ad module resolves naming service requests for the passwd, shadow, and group files by retrieving corresponding data from AD.
The following syntax shows the proper form of a passwd entry:
username:password:uid:gid:gecos:home-directory:login-shell
See the passwd(4) man page for more information.
The nss_ad module retrieves passwd information from AD as follows:
username – Field uses the value of the samAccountName AD attribute and is qualified by the domain name in which the object resides, for example, terryb@example.com.
password – Field uses the value of x because the user password is not available in the AD object.
uid – Field uses the Windows user's SID from the objectSID AD attribute, which is mapped to the UID by using the idmap service.
gid – Field uses the Windows user's primary group SID, which is mapped to the GID by using the idmap service. The group SID is obtained by appending the value of the primaryGroupID AD attribute to the domain SID. For users in AD, the primaryGroupID attribute is an optional attribute, so it might not exist. If the attribute does not exist, nss_ad uses the idmap diagonal mapping facility to map the user SID from the objectSID attribute.
gecos – Value of the CN AD attribute.
home-directory – Value of the homeDirectory AD attribute, if a value exists. Otherwise, the field is left empty.
login-shell – Field is left empty because there is no login shell attribute in the native AD schema.
The following syntax shows the proper form of a shadow entry:
username:password:lastchg:min:max:warn:inactive:expire:flag
See the shadow(4) man page for more information.
The nss_ad module retrieves shadow information from AD as follows:
username – Field uses the value of the samAccountName AD attribute and is qualified by the domain name in which the object resides, for example, terryb@example.com.
password – Field uses the value of *NP* because the user password is not available in the AD object.
The rest of the shadow fields are left empty because shadow fields are irrelevant with AD and Kerberos v5.
The following syntax shows the proper form of a group entry:
groupname:password:gid:user-list
See the group(4) for man page for more information.
The nss_ad module retrieves information from AD as follows:
groupname – Field uses the value of the samAccountName AD attribute and is qualified by the domain name in which the object resides, for example, admins@example.
password – Field is left empty because the Windows groups do not have passwords.
gid – Field uses the Windows group's SID from the objectSID AD attribute, which is mapped to the GID by using the idmap service.
user-list – Field is left empty.