このセクションでは、LDAP ネームサービスを使用するための Oracle Directory Server Enterprise Edition の構成におけるさまざまな側面の例を示します。この例では、全国に支店を持つExample, Inc.という会社を取り上げます。これらの例では特に、会社の西海岸部門 (ドメイン名は west.example.com) の LDAP 構成に焦点を当てます。
次の表には、west.example.com のサーバー情報を示します。
|
次の表には、クライアントプロファイル情報を示します。
|
# usr/lib/ldap/idsconfig It is strongly recommended that you BACKUP the directory server before running idsconfig. Hit Ctrl-C at any time before the final confirmation to exit. Do you wish to continue with server setup (y/n/h)? [n] y Enter the JES Directory Server's hostname to setup: myserver Enter the port number for DSEE (h=help): [389] Enter the directory manager DN: [cn=Directory Manager] Enter passwd for cn=Directory Manager : Enter the domainname to be served (h=help): [west.example.com] Enter LDAP Base DN (h=help): [dc=west,dc=example,dc=com] Checking LDAP Base DN ... Validating LDAP Base DN and Suffix ... No valid suffixes were found for Base DN dc=west,dc=example,dc=com Enter suffix to be created (b=back/h=help): [dc=west,dc=example,dc=com] Enter ldbm database name (b=back/h=help): [west] sasl/GSSAPI is not supported by this LDAP server Enter the profile name (h=help): [default] WestUserProfile Default server list (h=help): [192.168.0.1] Preferred server list (h=help): Choose desired search scope (one, sub, h=help): [one] The following are the supported credential levels: 1 anonymous 2 proxy 3 proxy anonymous 4 self Choose Credential level [h=help]: [1] 2 The following are the supported Authentication Methods: 1 none 2 simple 3 sasl/DIGEST-MD5 4 tls:simple 5 tls:sasl/DIGEST-MD5 6 sasl/GSSAPI Choose Authentication Method (h=help): [1] 2
Current authenticationMethod: simple Do you want to add another Authentication Method? n Do you want the clients to follow referrals (y/n/h)? [n] Do you want to modify the server timelimit value (y/n/h)? [n] y Enter the time limit for DSEE (current=3600): [-1] Do you want to modify the server sizelimit value (y/n/h)? [n] y Enter the size limit for DSEE (current=2000): [-1] Do you want to store passwords in "crypt" format (y/n/h)? [n] y Do you want to setup a Service Authentication Methods (y/n/h)? [n] Client search time limit in seconds (h=help): [30] Profile Time To Live in seconds (h=help): [43200] Bind time limit in seconds (h=help): [10] Do you want to enable shadow update (y/n/h)? [n] Do you wish to setup Service Search Descriptors (y/n/h)? [n]
Summary of Configuration
1 Domain to serve : west.example.com
2 Base DN to setup : dc=west,dc=example,dc=com
Suffix to create : dc=west,dc=example,dc=com
Database to create : west
3 Profile name to create : WestUserProfile
4 Default Server List : 192.168.0.1
5 Preferred Server List :
6 Default Search Scope : one
7 Credential Level : proxy
8 Authentication Method : simple
9 Enable Follow Referrals : FALSE
10 DSEE Time Limit : -1
11 DSEE Size Limit : -1
12 Enable crypt password storage : TRUE
13 Service Auth Method pam_ldap :
14 Service Auth Method keyserv :
15 Service Auth Method passwd-cmd:
16 Search Time Limit : 30
17 Profile Time to Live : 43200
18 Bind Limit : 10
19 Enable shadow update : FALSE
20 Service Search Descriptors Menu
Enter config value to change: (1-20 0=commit changes) [0] Enter DN for proxy agent: [cn=proxyagent,ou=profile,dc=west,dc=example,dc=com] Enter passwd for proxyagent: Re-enter passwd: WARNING: About to start committing changes. (y=continue, n=EXIT) y
1. Changed timelimit to -1 in cn=config. 2. Changed sizelimit to -1 in cn=config. 3. Changed passwordstoragescheme to "crypt" in cn=config. 4. Schema attributes have been updated. 5. Schema objectclass definitions have been added. 6. Database west successfully created. 7. Suffix dc=west,dc=example,dc=com successfully created. 8. NisDomainObject added to dc=west,dc=example,dc=com. 9. Top level "ou" containers complete. 10. automount maps: auto_home auto_direct auto_master auto_shared processed. 11. ACI for dc=west,dc=example,dc=com modified to disable self modify. 12. Add of VLV Access Control Information (ACI). 13. Proxy Agent cn=proxyagent,ou=profile,dc=west,dc=example,dc=com added. 14. Give cn=proxyagent,ou=profile,dc=west,dc=example,dc=com read permission for password. 15. Generated client profile and loaded on server. 16. Processing eq,pres indexes: uidNumber (eq,pres) Finished indexing. ipNetworkNumber (eq,pres) Finished indexing. gidnumber (eq,pres) Finished indexing. oncrpcnumber (eq,pres) Finished indexing. automountKey (eq,pres) Finished indexing. 17. Processing eq,pres,sub indexes: ipHostNumber (eq,pres,sub) Finished indexing. membernisnetgroup (eq,pres,sub) Finished indexing. nisnetgrouptriple (eq,pres,sub) Finished indexing. 18. Processing VLV indexes: west.example.com.getgrent vlv_index Entry created west.example.com.gethostent vlv_index Entry created west.example.com.getnetent vlv_index Entry created west.example.com.getpwent vlv_index Entry created west.example.com.getrpcent vlv_index Entry created west.example.com.getspent vlv_index Entry created west.example.com.getauhoent vlv_index Entry created west.example.com.getsoluent vlv_index Entry created west.example.com.getauduent vlv_index Entry created west.example.com.getauthent vlv_index Entry created west.example.com.getexecent vlv_index Entry created west.example.com.getprofent vlv_index Entry created west.example.com.getmailent vlv_index Entry created west.example.com.getbootent vlv_index Entry created west.example.com.getethent vlv_index Entry created west.example.com.getngrpent vlv_index Entry created west.example.com.getipnent vlv_index Entry created west.example.com.getmaskent vlv_index Entry created west.example.com.getprent vlv_index Entry created west.example.com.getip4ent vlv_index Entry created west.example.com.getip6ent vlv_index Entry created idsconfig: Setup of DSEE server myserver is complete. Note: idsconfig has created entries for VLV indexes. For DS5.x, use the directoryserver(1m) script on myserver to stop the server. Then, using directoryserver, follow the directoryserver examples below to create the actual VLV indexes. For DSEE6.x, use dsadm command delivered with DS on myserver to stop the server. Then, using dsadm, follow the dsadm examples below to create the actual VLV indexes.使用例 2 idsconfig 設定の完了
directoryserver -s <server-instance> vlvindex -n west -T west.example.com.getgrent directoryserver -s <server-instance> vlvindex -n west -T west.example.com.gethostent directoryserver -s <server-instance> vlvindex -n west -T west.example.com.getnetent directoryserver -s <server-instance> vlvindex -n west -T west.example.com.getpwent directoryserver -s <server-instance> vlvindex -n west -T west.example.com.getrpcent directoryserver -s <server-instance> vlvindex -n west -T west.example.com.getspent directoryserver -s <server-instance> vlvindex -n west -T west.example.com.getauhoent directoryserver -s <server-instance> vlvindex -n west -T west.example.com.getsoluent directoryserver -s <server-instance> vlvindex -n west -T west.example.com.getauduent directoryserver -s <server-instance> vlvindex -n west -T west.example.com.getauthent directoryserver -s <server-instance> vlvindex -n west -T west.example.com.getexecent directoryserver -s <server-instance> vlvindex -n west -T west.example.com.getprofent directoryserver -s <server-instance> vlvindex -n west -T west.example.com.getmailent directoryserver -s <server-instance> vlvindex -n west -T west.example.com.getbootent directoryserver -s <server-instance> vlvindex -n west -T west.example.com.getethent directoryserver -s <server-instance> vlvindex -n west -T west.example.com.getngrpent directoryserver -s <server-instance> vlvindex -n west -T west.example.com.getipnent directoryserver -s <server-instance> vlvindex -n west -T west.example.com.getmaskent directoryserver -s <server-instance> vlvindex -n west -T west.example.com.getprent directoryserver -s <server-instance> vlvindex -n west -T west.example.com.getip4ent directoryserver -s <server-instance> vlvindex -n west -T west.example.com.getip6ent
install-path/bin/dsadm reindex -l -t west.example.com.getgrent \ directory-instance-path dc=west,dc=example,dc=com install-path/bin/dsadm reindex -l -t west.example.com.gethostent \ directory-instance-path dc=west,dc=example,dc=com . . . install-path/bin/dsadm reindex -l -t west.example.com.getip6ent \ directory-instance-path dc=west,dc=example,dc=com使用例 3 idsconfig の使用によるシャドウ更新の有効化
新しいプロファイルの DIT を構築するときにシャドウ更新を有効にするには、idsconfig ユーティリティーを使用できます。シャドウ更新を有効にするには、Do you want to enable shadow update (y/n/h)? [n] と表示されたら y を入力する必要があります。Enter passwd for the administrator: と表示されたら、管理者のパスワードを入力する必要があります。詳細は、シャドウデータ更新の有効化を参照してください。
# usr/lib/ldap/idsconfig It is strongly recommended that you BACKUP the directory server before running idsconfig. Hit Ctrl-C at any time before the final confirmation to exit. Do you wish to continue with server setup (y/n/h)? [n] y Enter the JES Directory Server's hostname to setup: myserver Enter the port number for DSEE (h=help): [389] Enter the directory manager DN: [cn=Directory Manager] Enter passwd for cn=Directory Manager : Enter the domainname to be served (h=help): [west.example.com] Enter LDAP Base DN (h=help): [dc=west,dc=example,dc=com] Checking LDAP Base DN ... Validating LDAP Base DN and Suffix ... No valid suffixes were found for Base DN dc=west,dc=example,dc=com Enter suffix to be created (b=back/h=help): [dc=west,dc=example,dc=com] Enter ldbm database name (b=back/h=help): [west] sasl/GSSAPI is not supported by this LDAP server Enter the profile name (h=help): [default] WestUserProfile Default server list (h=help): [192.168.0.1] Preferred server list (h=help): Choose desired search scope (one, sub, h=help): [one] The following are the supported credential levels: 1 anonymous 2 proxy 3 proxy anonymous 4 self Choose Credential level [h=help]: [1] 2 The following are the supported Authentication Methods: 1 none 2 simple 3 sasl/DIGEST-MD5 4 tls:simple 5 tls:sasl/DIGEST-MD5 6 sasl/GSSAPI Choose Authentication Method (h=help): [1] 2
Current authenticationMethod: simple Do you want to add another Authentication Method? n Do you want the clients to follow referrals (y/n/h)? [n] Do you want to modify the server timelimit value (y/n/h)? [n] y Enter the time limit for DSEE (current=3600): [-1] Do you want to modify the server sizelimit value (y/n/h)? [n] y Enter the size limit for DSEE (current=2000): [-1] Do you want to store passwords in "crypt" format (y/n/h)? [n] y Do you want to setup a Service Authentication Methods (y/n/h)? [n] Client search time limit in seconds (h=help): [30] Profile Time To Live in seconds (h=help): [43200] Bind time limit in seconds (h=help): [10] Do you want to enable shadow update (y/n/h)? [n] y Do you wish to setup Service Search Descriptors (y/n/h)? [n]
Summary of Configuration
1 Domain to serve : west.example.com
2 Base DN to setup : dc=west,dc=example,dc=com
Suffix to create : dc=west,dc=example,dc=com
Database to create : west
3 Profile name to create : WestUserProfile
4 Default Server List : 192.168.0.1
5 Preferred Server List :
6 Default Search Scope : one
7 Credential Level : proxy
8 Authentication Method : simple
9 Enable Follow Referrals : FALSE
10 DSEE Time Limit : -1
11 DSEE Size Limit : -1
12 Enable crypt password storage : TRUE
13 Service Auth Method pam_ldap :
14 Service Auth Method keyserv :
15 Service Auth Method passwd-cmd:
16 Search Time Limit : 30
17 Profile Time to Live : 43200
18 Bind Limit : 10
19 Enable shadow update : TRUE
20 Service Search Descriptors Menu
Enter config value to change: (1-20 0=commit changes) [0] Enter DN for proxy agent: [cn=proxyagent,ou=profile,dc=west,dc=example,dc=com] Enter passwd for proxyagent:proxy-password Re-enter passwd:proxy-password Enter DN for the administrator: [cn=admin,ou=profile,dc=west,dc=example,dc=com] Enter passwd for the administrator:admin-password Re-enter passwd:admin-password WARNING: About to start committing changes. (y=continue, n=EXIT) y
1. Changed timelimit to -1 in cn=config.
2. Changed sizelimit to -1 in cn=config.
3. Changed passwordstoragescheme to "crypt" in cn=config.
4. Schema attributes have been updated.
5. Schema objectclass definitions have been added.
6. Database west successfully created.
7. Suffix dc=west,dc=example,dc=com successfully created.
8. NisDomainObject added to dc=west,dc=example,dc=com.
9. Top level "ou" containers complete.
10. automount maps: auto_home auto_direct auto_master auto_shared processed.
11. ACI for dc=west,dc=example,dc=com modified to disable self modify.
12. Add of VLV Access Control Information (ACI).
13. Proxy Agent cn=proxyagent,ou=profile,dc=west,dc=example,dc=com added.
14. Administrator identity cn=admin,ou=profile,dc=west,dc=example,dc=com added.
15. Give cn=admin,ou=profile,dc=west,dc=example,dc=com read/write access to\
shadow data.
16. Non-Admin access to shadow data denied.
17. Generated client profile and loaded on server.
18. Processing eq,pres indexes:
uidNumber (eq,pres) Finished indexing.
ipNetworkNumber (eq,pres) Finished indexing.
gidnumber (eq,pres) Finished indexing.
oncrpcnumber (eq,pres) Finished indexing.
automountKey (eq,pres) Finished indexing.
19. Processing eq,pres,sub indexes:
ipHostNumber (eq,pres,sub) Finished indexing.
membernisnetgroup (eq,pres,sub) Finished indexing.
nisnetgrouptriple (eq,pres,sub) Finished indexing.
20. Processing VLV indexes:
west.example.com.getgrent vlv_index Entry created
west.example.com.gethostent vlv_index Entry created
west.example.com.getnetent vlv_index Entry created
west.example.com.getpwent vlv_index Entry created
west.example.com.getrpcent vlv_index Entry created
west.example.com.getspent vlv_index Entry created
west.example.com.getauhoent vlv_index Entry created
west.example.com.getsoluent vlv_index Entry created
west.example.com.getauduent vlv_index Entry created
west.example.com.getauthent vlv_index Entry created
west.example.com.getexecent vlv_index Entry created
west.example.com.getprofent vlv_index Entry created
west.example.com.getmailent vlv_index Entry created
west.example.com.getbootent vlv_index Entry created
west.example.com.getethent vlv_index Entry created
west.example.com.getngrpent vlv_index Entry created
west.example.com.getipnent vlv_index Entry created
west.example.com.getmaskent vlv_index Entry created
west.example.com.getprent vlv_index Entry created
west.example.com.getip4ent vlv_index Entry created
west.example.com.getip6ent vlv_index Entry created
idsconfig: Setup of DSEE server myserver is complete.
Note: idsconfig has created entries for VLV indexes.
For DS5.x, use the directoryserver(1m) script on myserver
to stop the server. Then, using directoryserver, follow the
directoryserver examples below to create the actual VLV indexes.
For DSEE6.x, use dsadm command delivered with DS on myserver
to stop the server. Then, using dsadm, follow the
dsadm examples below to create the actual VLV indexes.
シャドウ更新を有効にするために LDAP クライアントを初期化する方法については、LDAP クライアントの初期化を参照してください。LDAP クライアントを初期化するときには、DIT の構築時に指定した管理者の DN およびパスワードと同じものを使用する必要があります。
Example, Inc. 社の以前の LDAP 構成では、ディレクトリツリーの ou=Users コンテナにユーザー情報が格納されていました。この Oracle Solaris リリースでは、ユーザーエントリは ou=People コンテナに格納されると見なされます。したがって、passwd サービスが検索され、クライアントが ou=People コンテナを検索する場合は、情報を取得できません。
会社の既存のディレクトリ情報ツリーを再作成する際の複雑さと、ほかの操作への影響を避けるために、代わりに SSD を作成できます。これらの SSD は、デフォルトコンテナではなく、ou=Users コンテナ内でユーザー情報を検索するように LDAP クライアントに指示します。
検索記述子については、サービス検索記述子とスキーママッピングを参照してください。
idsconfig コマンドを使用して SSD を作成します。SSD を参照するプロンプトは、次のように表示されます。
Do you wish to setup Service Search Descriptors (y/n/h? y A Add a Service Search Descriptor D Delete a SSD M Modify a SSD P Display all SSD's H Help X Clear all SSD's Q Exit menu Enter menu choice: [Quit] a Enter the service id: passwd Enter the base: service ou=user,dc=west,dc=example,dc=com Enter the scope: one[default] A Add a Service Search Descriptor D Delete a SSD M Modify a SSD P Display all SSD's H Help X Clear all SSD's Q Exit menu Enter menu choice: [Quit] p Current Service Search Descriptors: ================================== Passwd:ou=Users,ou=west,ou=example,ou=com? Hit return to continue. A Add a Service Search Descriptor D Delete a SSD M Modify a SSD P Display all SSD's H Help X Clear all SSD's Q Exit menu Enter menu choice: [Quit] q