Go to main content

Trusted Extensions Configuration and Administration

Exit Print View

Updated: March 2019
 
 

Make the Global Zone an LDAP Client in Trusted Extensions

This procedure establishes the LDAP naming service configuration for the global zone on an LDAP client.

Use the txzonemgr script.


Note -  If you plan to set up a name server in each labeled zone, you are responsible for establishing the LDAP client connection to each labeled zone.

Before You Begin

The LDAP server must be configured and populated with Trusted Extensions databases. This client system must be able to contact the server. So, the LDAP server must have assigned a security template to this client. A specific assignment is not required; a wildcard assignment is sufficient.

You must be in the root role in the global zone.


Note -  The use of pam_ldap on an LDAP client is not an evaluated configuration for Trusted Extensions.
  1. If you are using DNS, add dns to the name-service/switch configuration.

    The standard naming service switch file for LDAP is too restrictive for Trusted Extensions.

    1. Display the current configuration.
      # svccfg -s name-service/switch listprop config
      config                       application
      config/value_authorization   astring       solaris.smf.value.name-service.switch
      config/default               astring       files ldap
      config/netgroup              astring       ldap
      config/printer               astring       "user files ldap"
    2. Add dns to the host property and refresh the service.
      # svccfg -s name-service/switch setprop config/host = astring: "files dns ldap"
      # svccfg -s name-service/switch:default refresh
    3. Verify the new configuration.
      # svccfg -s name-service/switch listprop config
      config                       application
      config/value_authorization   astring       solaris.smf.value.name-service.switch
      config/default               astring       files ldap
      config/host                  astring       files dns ldap
      config/netgroup              astring       ldap
      config/printer               astring       "user files ldap"

      The Trusted Extensions databases use the default configuration files ldap, so are not listed.

  2. To create an LDAP client, run the txzonemgr command without any options.
    # txzonemgr &
    1. Double-click the global zone.
    2. Select Create LDAP Client.
    3. Answer the following prompts and click OK after each answer:
      Enter Domain Name:                   Type the domain name
      Enter Hostname of LDAP Server:       Type the name of the server
      Enter IP Address of LDAP Server servername: Type the IP address
      Enter LDAP Proxy Password:       Type the password to the server
      Confirm LDAP Proxy Password:     Retype the password to the server
      Enter LDAP Profile Name:         Type the profile name
    4. Confirm or cancel the displayed values.
      Proceed to create LDAP Client?

      When you confirm, the txzonemgr script runs the ldapclient init command.

  3. Verify that the information on the server is correct.
    1. Open a terminal window, and query the LDAP server.
      # ldapsearch -x filter

      For more information, see the ldapsearch(1oldap) man page.

    2. Correct any errors.

      If you get an error, redo Step 2 through Step 3. For example, the following error can indicate that the system does not have an entry on the LDAP server:

      LDAP ERROR (91): Can't connect to the LDAP server.
      Failed to find defaultSearchBase for domain domain-name

      To correct this error, you need to check the LDAP server.