man pages section 7: Standards, Environments, Macros, Character Sets, and Miscellany

ad(7)

Name

ad - Active Directory as a naming repository

Description

Solaris clients can obtain naming information from Active Directory (AD) servers, allowing the use of Windows-style name@domain names for users and groups with no corresponding UNIX user or group.

The Solaris system must first join an AD domain and then add the ad keyword to the appropriate entries in the nsswitch.conf(5) file. The Solaris system joins the AD domain by using the smbadm(8) utility. The AD name service only supports the naming databases for passwd and group.

Windows users are not able to log in. The user_attr(5) database has no entries for Windows users, and the passwd(1) command does not support the synchronization of user passwords with AD.

The AD server schema requires no modification because the AD client works with native AD schema. The Solaris AD client uses the idmap(8) service to map between Windows security identifiers (SIDs) and Solaris user identifiers (UIDs) and group identifiers (GIDs). User names and group names are taken from the sAMAccountName attribute of the AD user and group objects and then tagged with the domain where the objects reside. The domain name is separated from the user name or group name by the @ character.

Files

/etc/nsswitch.conf

Configuration file for the name-service switch.

/etc/nsswitch.ad

Sample configuration file for the name-service switch configured with ad, dns and files.

/usr/lib/nss_ad.so.1

Name service switch module for AD.

See Also

passwd(1), svcs(1), nsswitch.conf(5), user_attr(5), smf(7), idmap(8), idmapd(8), smbadm(8), svcadm(8), svccfg(8)