Procedures:New LDAP Client/Solaris 10 Setup

Build and install OpenLDAP

Build 64 bit

 CFLAGS="-m64" ./configure --enable-tls --disable-slapd --prefix=/usr/local --libdir=/usr/local/lib/amd64
 make depend
 make -j5
 make install

Clean up for next install

 make clean

Build 32 bit

 ./configure --enable-tls --disable-slapd --prefix=/usr/local
 make depend
 make -j5
 make install 

Build and install nss_ldap using OpenLDAP

We must temporarily remove the Solaris SASL headers; for some reason they break compilation of recent versions of nss_ldap.

 mv /usr/include/sasl /usr/include/sasl.OLD

Build and install 64 bit

 declare -x LD_LIBRARY_PATH="/usr/local/lib/amd64:/usr/sfw/lib/amd64"
 declare -x CFLAGS="-m64"
 declare -x LDFLAGS="-L/usr/local/lib/amd64 -R/usr/local/lib/amd64"
 ./configure
 make
 cp nss_ldap.so /lib/amd64/nss_ldap.so.1
 ln -sf /lib/amd64/nss_ldap.so.1 /usr/lib/amd64/

Clean up for next install

 make clean

Build and install 32 bit

 declare -x LD_LIBRARY_PATH="/usr/local/lib:/usr/sfw/lib"
 declare -x CFLAGS=""
 declare -x LDFLAGS="-L/usr/local/lib/amd -R/usr/local/lib/amd"
 ./configure
 make
 cp nss_ldap.so /lib/nss_ldap.so.1
 ln -sf /lib/nss_ldap.so.1 /usr/lib/

Configure Name Service Switch

Make sure /etc/nsswitch.conf contains the following lines:

 passwd:     files ldap
 group:      files ldap

Restore SASL headers

 mv /usr/include/sasl.old /usr/include/sasl

Build and install pam_ldap using OpenLDAP

We must temporarily remove the Solaris SASL headers; for some reason they break compilation of recent versions of nss_ldap.

 mv /usr/include/sasl /usr/include/sasl.OLD

Build and install 64 bit

 declare -x LD_LIBRARY_PATH="/usr/local/lib/amd64:/usr/sfw/lib/amd64"
 declare -x CFLAGS="-m64"
 declare -x LDFLAGS="-L/usr/local/lib/amd64 -R/usr/local/lib/amd64"
 ./configure
 make
 cp pam_ldap.so /usr/lib/security/amd64/pam_ldap.so.1
 ln -s /usr/lib/security/amd64/pam_ldap.so.1 /usr/lib/security/amd64/pam_ldap.so

Clean up for next install

 make clean

Build and install 32 bit

 declare -x LD_LIBRARY_PATH="/usr/local/lib/amd64:/usr/sfw/lib"
 declare -x CFLAGS=""
 declare -x LDFLAGS="-L/usr/local/lib -R/usr/local/lib"
 ./configure
 make
 cp pam_ldap.so /usr/lib/security/pam_ldap.so.1
 ln -s /usr/lib/security/pam_ldap.so.1 /usr/lib/security/pam_ldap.so

Configure /etc/pam.conf

# PAM configuration
#
# Unless explicitly defined, all services use the modules
# defined in the "other" section.
#
# Modules are defined with relative pathnames, i.e., they are
# relative to /usr/lib/security/$ISA. Absolute path names, as
# present in this file in previous releases are still acceptable.
#
# Authentication management
#
# login service (explicit because of pam_dial_auth)
#
login   auth requisite          pam_authtok_get.so.1
login   auth required           pam_dhkeys.so.1
login   auth required           pam_unix_cred.so.1
login   auth sufficient         pam_unix_auth.so.1
login   auth required           pam_ldap.so.1 use_first_pass ignore_unknown_user ignore_authinfo_unavail
#
# rlogin service (explicit because of pam_rhost_auth)
#
rlogin  auth sufficient         pam_rhosts_auth.so.1
rlogin  auth requisite          pam_authtok_get.so.1
rlogin  auth required           pam_dhkeys.so.1
rlogin  auth required           pam_unix_cred.so.1
rlogin  auth sufficient         pam_unix_auth.so.1
rlogin  auth required           pam_ldap.so.1 use_first_pass ignore_unknown_user ignore_authinfo_unavail
#
# Default definitions for Authentication management
# Used when service name is not explicitly mentioned for authentication
#
other   auth requisite          pam_authtok_get.so.1
other   auth required           pam_dhkeys.so.1
other   auth required           pam_unix_cred.so.1
other   auth sufficient         pam_unix_auth.so.1
other   auth required           pam_ldap.so.1 use_first_pass ignore_unknown_user ignore_authinfo_unavail
#
# passwd command (explicit because of a different authentication module)
#
passwd  auth sufficient         pam_passwd_auth.so.1
passwd  auth required           pam_ldap.so.1 use_authtok
#
# cron service (explicit because of non-usage of pam_roles.so.1)
#
cron    account required        pam_unix_account.so.1
#
# Default definition for Account management
# Used when service name is not explicitly mentioned for account management
#
other   account sufficient      pam_ldap.so.1 ignore_unknown_user ignore_authinfo_unavail
other   account requisite       pam_roles.so.1
other   account required        pam_unix_account.so.1


#
# Default definition for Session management
# Used when service name is not explicitly mentioned for session management
#
other   session required        pam_unix_session.so.1
#
# Default definition for  Password management
# Used when service name is not explicitly mentioned for password management
#
other   password required       pam_dhkeys.so.1
other   password requisite      pam_authtok_get.so.1
other   password requisite      pam_authtok_check.so.1
other   password required       pam_authtok_store.so.1
#

Configure autofs

Add a line to /etc/auto_master:

/mnt/netapp     auto_netapp 

Create and link network home directory

mkdir /mnt/netapp
ln -sf /mnt/netapp/home/users /home/

Create /etc/auto_netapp with the following contents:

home       -fstype=nfs,hard,intr,async,rsize=32768,wsize=32768,nfsvers=3,udp     172.17.8.63:/vol/home
research   -fstype=nfs,hard,intr,async,rsize=32768,wsize=32768,nfsvers=3,udp     172.17.8.64:/vol/research

Enable/reload autofs

svcadm disable autofs
svcadm enable autofs

Configure LDAP Environment

Link things to places we're likely to look for them later on

ln -sf /usr/share/etc/openldap  /etc/openldap
ln -sf /usr/share/etc/ldap.conf /etc/ldap.conf

Copy files over from a preconfigured host

scp p655-1:/etc/openldap/ldap.conf /usr/share/etc/openldap/
scp p655-1:/etc/ldap.conf /usr/share/etc/

Fix SSL paths in both ldap.conf files to reference the correct SSL cert dir path:

TLS_CACERTDIR /etc/sfw/openssl/certs
<pre>

Install the root CA cert:
<pre>
/home/users/brandond/scripts/install_nic_cacert.sh /etc/sfw/openssl/certs

Disable NSCd, as it doesn't understand how to talk to PADL's nss_ldap

svcadm disable /system/name-service-cache