Procedures:New LDAP Client/Solaris 10 Setup

Build and install OpenLDAP

• 64 bit

 CFLAGS="-m64" ./configure --enable-tls --disable-slapd --prefix=/usr/local --libdir=/usr/local/lib/amd64
 make depend
 make -j5
 make install

• Clean up for next install

 make clean

• 32 bit

 ./configure --enable-tls --disable-slapd --prefix=/usr/local
 make depend
 make -j5
 make install 

Build and install nss_ldap using OpenLDAP

We must temporarily remove the Solaris SASL headers; for some reason they break compilation of recent versions of nss_ldap.

 mv /usr/include/sasl /usr/include/sasl.OLD

• Build and install 64 bit:

 declare -x LD_LIBRARY_PATH="/usr/local/lib/amd64:/usr/sfw/lib/amd64"
 declare -x CFLAGS="-m64"
 declare -x LDFLAGS="-L/usr/local/lib/amd64 -R/usr/local/lib/amd64"
 ./configure
 make
 cp nss_ldap.so /lib/amd64/nss_ldap.so.1
 ln -sf /lib/amd64/nss_ldap.so.1 /usr/lib/amd64/

• Build and install 32 bit:

 declare -x LD_LIBRARY_PATH="/usr/local/lib:/usr/sfw/lib"
 declare -x CFLAGS=""
 declare -x LDFLAGS="-L/usr/local/lib/amd -R/usr/local/lib/amd"
 ./configure
 make
 cp nss_ldap.so /lib/nss_ldap.so.1
 ln -sf /lib/nss_ldap.so.1 /usr/lib/

• Configure Name Service Switch

Make sure /etc/nsswitch.conf contains the following lines:

 passwd:     files ldap
 group:      files ldap

• Restore SASL headers

 mv /usr/include/sasl.old /usr/include/sasl

Build and install pam_ldap using OpenLDAP

We must temporarily remove the Solaris SASL headers; for some reason they break compilation of recent versions of nss_ldap.

 mv /usr/include/sasl /usr/include/sasl.OLD

• Build and install 64 bit:

 declare -x LD_LIBRARY_PATH="/usr/local/lib/amd64:/usr/sfw/lib/amd64"
 declare -x CFLAGS="-m64"
 declare -x LDFLAGS="-L/usr/local/lib/amd64 -R/usr/local/lib/amd64"
 ./configure
 make
 cp pam_ldap.so /usr/lib/security/amd64/pam_ldap.so.1
 ln -s /usr/lib/security/amd64/pam_ldap.so.1 /usr/lib/security/amd64/pam_ldap.so

• Build and install 32 bit:

 declare -x LD_LIBRARY_PATH="/usr/local/lib/amd64:/usr/sfw/lib"
 declare -x CFLAGS=""
 declare -x LDFLAGS="-L/usr/local/lib -R/usr/local/lib"
 ./configure
 make
 cp pam_ldap.so /usr/lib/security/pam_ldap.so.1
 ln -s /usr/lib/security/pam_ldap.so.1 /usr/lib/security/pam_ldap.so

• Configure /etc/pam.conf

# PAM configuration
#
# Unless explicitly defined, all services use the modules
# defined in the "other" section.
#
# Modules are defined with relative pathnames, i.e., they are
# relative to /usr/lib/security/$ISA. Absolute path names, as
# present in this file in previous releases are still acceptable.
#
# Authentication management
#
# login service (explicit because of pam_dial_auth)
#
login   auth requisite          pam_authtok_get.so.1
login   auth required           pam_dhkeys.so.1
login   auth required           pam_unix_cred.so.1
login   auth sufficient         pam_unix_auth.so.1
login   auth required           pam_ldap.so.1 use_first_pass ignore_unknown_user ignore_authinfo_unavail
#
# rlogin service (explicit because of pam_rhost_auth)
#
rlogin  auth sufficient         pam_rhosts_auth.so.1
rlogin  auth requisite          pam_authtok_get.so.1
rlogin  auth required           pam_dhkeys.so.1
rlogin  auth required           pam_unix_cred.so.1
rlogin  auth sufficient         pam_unix_auth.so.1
rlogin  auth required           pam_ldap.so.1 use_first_pass ignore_unknown_user ignore_authinfo_unavail
#
# Default definitions for Authentication management
# Used when service name is not explicitly mentioned for authentication
#
other   auth requisite          pam_authtok_get.so.1
other   auth required           pam_dhkeys.so.1
other   auth required           pam_unix_cred.so.1
other   auth sufficient         pam_unix_auth.so.1
other   auth required           pam_ldap.so.1 use_first_pass ignore_unknown_user ignore_authinfo_unavail
#
# passwd command (explicit because of a different authentication module)
#
passwd  auth sufficient         pam_passwd_auth.so.1
passwd  auth required           pam_ldap.so.1 use_authtok
#
# cron service (explicit because of non-usage of pam_roles.so.1)
#
cron    account required        pam_unix_account.so.1
#
# Default definition for Account management
# Used when service name is not explicitly mentioned for account management
#
other   account sufficient      pam_ldap.so.1 ignore_unknown_user ignore_authinfo_unavail
other   account requisite       pam_roles.so.1
other   account required        pam_unix_account.so.1


#
# Default definition for Session management
# Used when service name is not explicitly mentioned for session management
#
other   session required        pam_unix_session.so.1
#
# Default definition for  Password management
# Used when service name is not explicitly mentioned for password management
#
other   password required       pam_dhkeys.so.1
other   password requisite      pam_authtok_get.so.1
other   password requisite      pam_authtok_check.so.1
other   password required       pam_authtok_store.so.1
#