Procedures:New LDAP Client/Solaris 10 Setup

This was a ton of fun to figure out and debug. It works almost exactly as expected, and supports the full nss_ldap/pam_ldap feature set as available on linux with the same configuration file syntax. It also supports start_tls, which the Solaris LDAP libraries do not. The only drawback is a lack of support for the Name Service Cache daemon, as it expects to talk to Sun's ldap_cachemgr. If NSCd is enabled, LDAP passwd and group information will not be available.

Build and install OpenLDAP

Build 64 bit

 CFLAGS="-m64" ./configure --enable-tls --disable-slapd --prefix=/usr/local --libdir=/usr/local/lib/amd64
 make depend
 make -j5
 make install

Clean up for next install

 make clean

Build 32 bit

 ./configure --enable-tls --disable-slapd --prefix=/usr/local
 make depend
 make -j5
 make install 

Build and install nss_ldap using OpenLDAP

We must temporarily remove the Solaris SASL headers; for some reason they break compilation of recent versions of nss_ldap.

 mv /usr/include/sasl /usr/include/sasl.OLD

Build and install 64 bit

 declare -x LD_LIBRARY_PATH="/usr/local/lib/amd64:/usr/sfw/lib/amd64"
 declare -x CFLAGS="-m64 -DHAVE_SASL_AUXPROP_REQUEST"
 declare -x LDFLAGS="-L/usr/local/lib/amd64 -R/usr/local/lib/amd64"
 ./configure
 make
 cp nss_ldap.so /lib/amd64/nss_ldap.so.1
 ln -sf /lib/amd64/nss_ldap.so.1 /usr/lib/amd64/

Clean up for next install

 make clean

Build and install 32 bit

 declare -x LD_LIBRARY_PATH="/usr/local/lib:/usr/sfw/lib"
 declare -x CFLAGS="-DHAVE_SASL_AUXPROP_REQUEST"
 declare -x LDFLAGS="-L/usr/local/lib/amd -R/usr/local/lib/amd"
 ./configure
 make
 cp nss_ldap.so /lib/nss_ldap.so.1
 ln -sf /lib/nss_ldap.so.1 /usr/lib/

Configure Name Service Switch

Make sure /etc/nsswitch.conf contains the following lines:

 passwd:     files ldap
 group:      files ldap

Restore SASL headers

 mv /usr/include/sasl.old /usr/include/sasl

Build and install pam_ldap using OpenLDAP

We must temporarily remove the Solaris SASL headers; for some reason they break compilation of recent versions of nss_ldap.

 mv /usr/include/sasl /usr/include/sasl.OLD

Build and install 64 bit

 declare -x LD_LIBRARY_PATH="/usr/local/lib/amd64:/usr/sfw/lib/amd64"
 declare -x CFLAGS="-m64 -DHAVE_SASL_AUXPROP_REQUEST"
 declare -x LDFLAGS="-L/usr/local/lib/amd64 -R/usr/local/lib/amd64"
 ./configure
 make
 cp pam_ldap.so /usr/lib/security/amd64/pam_ldap.so.1
 ln -sf /usr/lib/security/amd64/pam_ldap.so.1 /usr/lib/security/amd64/pam_ldap.so

Clean up for next install

 make clean

Build and install 32 bit

 declare -x LD_LIBRARY_PATH="/usr/local/lib/amd:/usr/sfw/lib"
 declare -x CFLAGS="-DHAVE_SASL_AUXPROP_REQUEST"
 declare -x LDFLAGS="-L/usr/local/lib -R/usr/local/lib"
 ./configure
 make
 cp pam_ldap.so /usr/lib/security/pam_ldap.so.1
 ln -sf /usr/lib/security/pam_ldap.so.1 /usr/lib/security/pam_ldap.so

Add directories to linker path

crle     -u -l /lib:/usr/lib:/usr/local/lib             -s /lib/secure:/usr/lib/secure:/usr/local/lib
crle -64 -u -l /lib/64:/usr/lib/64:/usr/local/lib/amd64 -s /lib/secure/64:/usr/lib/secure/64:/usr/local/lib/amd64

Configure /etc/pam.conf

# PAM configuration
#
# Unless explicitly defined, all services use the modules
# defined in the "other" section.
#
# Modules are defined with relative pathnames, i.e., they are
# relative to /usr/lib/security/$ISA. Absolute path names, as
# present in this file in previous releases are still acceptable.
#
# Authentication management
#
# login service (explicit because of pam_dial_auth)
#
login   auth requisite          pam_authtok_get.so.1
login   auth required           pam_dhkeys.so.1
login   auth required           pam_unix_cred.so.1
login   auth sufficient         pam_unix_auth.so.1
login   auth required           pam_ldap.so.1 use_first_pass ignore_unknown_user ignore_authinfo_unavail
#
# rlogin service (explicit because of pam_rhost_auth)
#
rlogin  auth sufficient         pam_rhosts_auth.so.1
rlogin  auth requisite          pam_authtok_get.so.1
rlogin  auth required           pam_dhkeys.so.1
rlogin  auth required           pam_unix_cred.so.1
rlogin  auth sufficient         pam_unix_auth.so.1
rlogin  auth required           pam_ldap.so.1 use_first_pass ignore_unknown_user ignore_authinfo_unavail
#
# Default definitions for Authentication management
# Used when service name is not explicitly mentioned for authentication
#
other   auth requisite          pam_authtok_get.so.1
other   auth required           pam_dhkeys.so.1
other   auth required           pam_unix_cred.so.1
other   auth sufficient         pam_unix_auth.so.1
other   auth required           pam_ldap.so.1 use_first_pass ignore_unknown_user ignore_authinfo_unavail
#
# passwd command (explicit because of a different authentication module)
#
passwd  auth sufficient         pam_passwd_auth.so.1
passwd  auth required           pam_ldap.so.1 use_authtok
#
# cron service (explicit because of non-usage of pam_roles.so.1)
#
cron    account required        pam_unix_account.so.1
#
# Default definition for Account management
# Used when service name is not explicitly mentioned for account management
#
other   account sufficient      pam_ldap.so.1 ignore_unknown_user ignore_authinfo_unavail
other   account requisite       pam_roles.so.1
other   account required        pam_unix_account.so.1


#
# Default definition for Session management
# Used when service name is not explicitly mentioned for session management
#
other   session required        pam_unix_session.so.1
#
# Default definition for  Password management
# Used when service name is not explicitly mentioned for password management
#
other   password required       pam_dhkeys.so.1
other   password requisite      pam_authtok_get.so.1
other   password requisite      pam_authtok_check.so.1
other   password required       pam_authtok_store.so.1
#

Configure autofs

Add a line to /etc/auto_master:

/mnt/netapp     auto_netapp 

Create and link network home directory

mkdir /mnt/netapp
ln -sf /mnt/netapp/home/users /home/

Create /etc/auto_netapp with the following contents:

home       -fstype=nfs,hard,intr,async,rsize=32768,wsize=32768,nfsvers=3,udp     172.17.8.63:/vol/home
research   -fstype=nfs,hard,intr,async,rsize=32768,wsize=32768,nfsvers=3,udp     172.17.8.64:/vol/research

Enable/reload autofs

svcadm disable autofs
svcadm enable autofs

Configure LDAP Environment

Link things to places we're likely to look for them later on

ln -sf /usr/share/etc/openldap  /etc/openldap
ln -sf /usr/share/etc/ldap.conf /etc/ldap.conf

Copy files over from a preconfigured host

scp p655-1:/etc/openldap/ldap.conf /usr/share/etc/openldap/
scp p655-1:/etc/ldap.conf /usr/share/etc/

Fix SSL paths in both ldap.conf files to reference the correct SSL cert dir path:

TLS_CACERTDIR /etc/sfw/openssl/certs
<pre>

Install the root CA cert:
<pre>
/home/users/brandond/scripts/install_nic_cacert.sh /etc/sfw/openssl/certs

Disable NSCd, as it doesn't understand how to talk to PADL's nss_ldap

svcadm disable /system/name-service-cache