Go to main content

Working With Oracle® Solaris 11.3 Directory and Naming Services: DNS and NIS

Exit Print View

Updated: October 2017

How to Configure the nss_ad Module

The nss_ad module requires that the Oracle Solaris client use DNS for host resolution.

  1. Configure the DNS service.

    See How to Enable a DNS Client for instructions.

    Note -  The AD domain name must be specified either by means of the domain directive or as the first item in the list specified by the search directive.

    If both directives are specified, then whichever is last takes precedence in order for the idmap auto-discovery feature to work properly.

  2. Use the dig command to verify that the AD server can be resolved by using its name and IP address.
    # dig -x +short
    # dig myserver.ad.example +short
  3. Add dns to the list of naming services for hosts.
    # svccfg -s svc:/system/name-service/switch:default
    svc:/system/name-service/switch:default> setprop config/host = astring: "files dns"
    svc:/system/name-service/switch:default> refresh
    svc:/system/name-service/switch:default> quit

    Note -  To include additional naming services such as nis or ldap for host resolution, add them after dns.
  4. Verify whether the DNS service is enabled and online.

    For example:

    # svcs svc:/network/dns/client
    online Oct_14 svc:/network/dns/client:default
  5. Use the kclient utility to join the system to the AD domain.

    For example:

    # /usr/sbin/kclient -T ms_ad
  6. Add ad to the list of naming services for password and group.
    # svccfg -s svc:/system/name-service/switch:default
    svc:/system/name-service/switch:default> setprop config/password = astring: "files nis ad"
    svc:/system/name-service/switch:default> setprop config/group = astring: "files nis ad"
    svc:/system/name-service/switch:default> refresh
    svc:/system/name-service/switch:default> quit
  7. Enable the idmap service.
    # svcadm enable idmap:default
  8. Update the SMF repository for the name service switch service.
    # svcadm refresh name-service/switch:default

    Note -  The nscd module automatically restarts whenever name service switch is refreshed.
  9. Verify whether you can access user and group information from AD.

    For example:

    # getent passwd 'test_user@example'
    # getent passwd 2154266625