ldap(1) (man pages section 1: User Commands)

man pages section 1: User Commands

ldap(1)

NAME

ldap- LDAP as a naming repository

DESCRIPTION

LDAP refers to Lightweight Directory Access Protoco,l which is emerging as an industry standard for accessing directory servers. By using the keyword ldap in the name service switch file, /etc/nsswitch.conf, Solaris clients can obtain naming information from an LDAP server. Information such as usernames, hostnames, and passwords are stored on the LDAP server in the form of a tree called Directory Information Tree or DIT. The DIT consists of entries which in turn are composed of attributes. Each attribute has a type and one or more values.

Solaris LDAP clients use LDAP v3 protocol to access naming information from LDAP servers. The LDAP server must support the object classes and attributes defined in RFC2307bis (draft), which maps the Naming Information Service model onto LDAP. Refer to the Solaris Naming Administration Guide for more details.

The ldapclient(1M) utility can make a Solaris machine an ldap client by setting up the appropriate directories and configuration information. The LDAP clients cache this configuration information in local cache files. This configuration information is accessed through the ldap_cachemgr(1M) daemon. This daemon also refreshes the information in the configuration files from the LDAP server, providing better performance and security.

A client Profile is stored in the LDAP server and is used by the ldapclient utility to initialize an LDAP client. Using the client profile is the easiest way to configure a client machine. See ldapclient(1M).

There are two types of configuration information: client and domain.

Domain information contains server-specific parameters that are required by all clients to locate the servers for the desired LDAP domain. This information could be the server's IP address and the search base DN, for instance, and is configured on the client (from the default profile, for example) during client initialization and is periodically updated by the ldap_cachemgr daemon when the expiration time has elapsed.

Client information contains client-specific parameters that are used only by a client. This information could be the Bind DN of the client and the password. These parameters are defined during the initialization either manually through ldapclient(1M) or by having been stored in the client profile on the LDAP server.

The Naming information is stored in containers on the LDAP server. A container is a non-leaf entry in the Directory Information Tree (DIT) that contains naming service information. Containers are similar to maps in NIS and tables in NIS+. A mapping between the Network Information Service (NIS) databases and the containers in LDAP is presented below:

Database	Object Class	Container
passwd	posixAccount	shadowAccount
	shadowAccount
group	posixGroup	ou=Group,dc=...
services	ipService	ou=Services,dc=...
protocols	ipProtocol	ou=Protocols,dc=...
rpc	oncRpc	ou=Rpc,dc=...
hosts	ipHost	ou=Hosts,dc=...
ipnodes
ethers	ieee802Device	ou=Ethers,dc=...
bootparams	bootableDevice	ou=Ethers,dc=...
networks	ipNetwork	ou=Networks,dc=...
netmasks
netgroup	nisNetgroup	ou=Netgroup,dc=...
alias	mailGroup	ou=Aliases,dc=...
generic	nisObject	nisMapName=...,dc=...

Clients can authenticate to the LDAP server using three types of authentication mechanisms: Anonymous, Simple, and CRAM-MD5. More protection is provided in the form of access control, allowing the server to grant access for certain containers and/or entries. Access control is specified in the form of access control lists (ACLs). Each ACL specifies one or more directory objects ( for example, the cn attribute in a specific container), one or more clients you grant or deny access, and one or more access rights that determine what the clients can do to or with the objects. Clients could be users or applications. Access rights could be specified as read and write, for example. Refer to the Solaris Naming Administration Guide for some restrictions on ACLs when using ldap as a Naming repository.

A new nsswitch.conf(4) file named nsswitch.ldap is available when riding the ldapclient utility. This file uses ldap as a repository for the different databases in the nsswitch.conf file.

The following is a list of the user commands related to ldap:

ldapclient(1M): Intialize ldap clients.
ldaplist(1): List the contents of the ldap naming space.

FILES

/var/ldap/ldap_client_cache: contains a list of servers, their transport addresses, and the security method used to access them.
/var/ldap/ldap_client_cred: contains Bind Distinguished Name and the encrypted password. This file is normally only readable by root (uid 0) and is only modified and read by ldap_cachemgr(1M).
/etc/nsswitch.conf: configuration file for the name-service switch
/etc/nsswitch.ldap: configuration file for the name-service switch configured with ldap

ldap(1)

NAME

DESCRIPTION

FILES

SEE ALSO