sknauf at chipxonio
Aug 1, 2012, 8:20 AM
Post #10 of 10
(1946 views)
Permalink
|
You're right the empty attributes are there. But still the same Problem:
Wed Aug 1 17:11:05 CEST [chip1:
auth.trace.authenticateUser.loginTraceMsg:info]: AUTH: User from
192.168.62.41 authenticated by DC.
Wed Aug 1 17:11:05 CEST [chip1: auth.trace.mapNTToUnix:info]: AUTH: Mapping
Windows user sknauf to Unix user sknauf.
Wed Aug 1 17:11:05 CEST [chip1:
auth.trace.authenticateUser.loginTraceMsg:info]: AUTH: User sknauf CIFS home
directory is set to /vol/vol3/users/sknauf.
Wed Aug 1 17:11:05 CEST [chip1: auth.trace.mapNTToUnix:info]: AUTH: Mapping
Windows user sknauf to Unix user pcuser.
Wed Aug 1 17:11:12 CEST [chip1:
auth.trace.authenticateUser.loginTraceMsg:info]: AUTH: sknauf not found in
passwd database during login from 0.0.0.0.
Wed Aug 1 17:11:12 CEST [chip1:
auth.trace.authenticateUser.loginTraceMsg:info]: AUTH: Using default UNIX
name pcuser for login from 0.0.0.0.
--------------------------------------
rdfile /etc/nsswitch.conf
#Auto-generated by LDAP Mon Jul 30 10:42:32 CEST 2012
hosts: files nis dns
passwd: files ldap
netgroup: files ldap
group: files ldap
shadow: files ldap nis
--------------------------------------
greets
Steffen
Von: Jeremy Page [mailto:jeremy.page [at] gilbarco]
Gesendet: Mittwoch, 1. August 2012 15:55
An: Steffen Knauf
Cc: toasters [at] teaparty
Betreff: Re: AW: LDAP Options
The attributes are there, they may not have values assigned to them though.
Installign SFU will add *additional* custom attributes, extending the AD
schema.
On 08/01/2012 09:39 AM, Steffen Knauf wrote:
hi,
thanks for your ldap options @Jeremy!
With ssl enable i got a sll error. I think there are some problems with the
self signed Certificate. That's my fault.
But without ssl i got an established connection:
chip1.29634 dc1.ad.cxo.name.389 65280 0 8760 0
ESTABLISHED
......with the same result.
I'll install the unix Services Role (Identity Management for unix), because
lot's of attributes are missing. I'll give you an update if it works.
thanks for your help!
Steffen
Von: toasters-bounces [at] teaparty [mailto:toasters-bounces [at] teaparty] Im
Auftrag von Jeremy Page
Gesendet: Dienstag, 31. Juli 2012 15:20
An: toasters [at] teaparty
Betreff: Re: AW: LDAP Options
SFU was needed before 2003R2. With 2003R2 schema or later you can just use
the normal RFC2307 attributes and objects (regular UNIX posix stuff like
UID).
Do you have an ldap.conf file from a Linux box that works with your Windows
domain? There are a lot of different things that can cause issues. This is
quite tricky, I am pretty comfortable with LDAP on both the AD and *nix side
but it took me quite a while to get this working properly.
Below is my LDAP config. Please note that it is using the Global Catalog
port to support name service lookups for accounts across our forest.
ldap.ADdomain company.com
ldap.base dc=company,dc=com
ldap.base.group
ldap.base.netgroup
ldap.base.passwd
ldap.enable on
ldap.minimum_bind_level simple
ldap.name
cn=ldap-auth-svc,ou=ldap,ou=services,dc=site,dc=company,dc=com
ldap.nssmap.attribute.gecos gecos
ldap.nssmap.attribute.gidNumber gidNumber
ldap.nssmap.attribute.groupname cn
ldap.nssmap.attribute.homeDirectory UnixHomeDirectory
ldap.nssmap.attribute.loginShell loginShell
ldap.nssmap.attribute.memberNisNetgroup memberNisNetgroup
ldap.nssmap.attribute.memberUid memberUid
ldap.nssmap.attribute.netgroupname cn
ldap.nssmap.attribute.nisNetgroupTriple nisNetgroupTriple
ldap.nssmap.attribute.uid sAMAccountName
ldap.nssmap.attribute.uidNumber uidNumber
ldap.nssmap.attribute.userPassword unixUserPassword
ldap.nssmap.objectClass.nisNetgroup nisNetgroup
ldap.nssmap.objectClass.posixAccount user
ldap.nssmap.objectClass.posixGroup group
ldap.passwd ******
ldap.port 3268
ldap.servers ldap.company.com
ldap.servers.preferred
ldap.ssl.enable off
ldap.timeout 20
ldap.usermap.attribute.unixaccount sAMAccountName
ldap.usermap.attribute.windowsaccount sAMAccountName
ldap.usermap.base
ldap.usermap.enable on
On 07/31/2012 04:44 AM, Steffen Knauf wrote:
hi,
I found a Knowledgebase Entry for LDAP Configuration:
https://kb.netapp.com/support/index?page=content
<https://kb.netapp.com/support/index?page=content&id=1010909> &id=1010909
They installed SFU or "Identity Management for unix". So i'm a confused,
what's the right way. I still get no LDAP connection. It's a little bit
strange that i see nothing in the error Logfiles.
greets
Steffen
Von: toasters-bounces [at] teaparty [mailto:toasters-bounces [at] teaparty] Im
Auftrag von Jeremy Page
Gesendet: Montag, 30. Juli 2012 16:36
An: toasters [at] teaparty
Betreff: Re: AW: LDAP Options
With Windows 2003R2 or later you do not need to (and should not) install
SFU. The rfc2307 NIS schema is part of AD - although not all the attributes
will be populated by default (i.e. you will not have a UID unless you
explicitly set it).
On 07/30/2012 09:41 AM, Steffen Knauf wrote:
Hi, sorry that was my fault. The correct entry should be:
ldap.ADdomain ad.cxo.name
But still with the same result: Could not get passwd entry for name = sknauf
I don't have much experience with windows 2008 R2 Server. It is necessary to
install SFU (Subsystem for unix-based Application) on the Windows Server?
duction of a manual signature that is included in any attachment.
_______________________________________________
Toasters mailing list
Toasters [at] teaparty
http://www.teaparty.net/mailman/listinfo/toasters
Please be advised that this email may contain confidential information. If
you are not the intended recipient, please notify us by email by replying to
the sender and delete this message. The sender disclaims that the content of
this email constitutes an offer to enter into, or the acceptance of, any
agreement; provided that the foregoing does not invalidate the binding
effect of any digital or other electronic reproduction of a manual signature
that is included in any attachment.
Please be advised that this email may contain confidential information. If
you are not the intended recipient, please notify us by email by replying to
the sender and delete this message. The sender disclaims that the content of
this email constitutes an offer to enter into, or the acceptance of, any
agreement; provided that the foregoing does not invalidate the binding
effect of any digital or other electronic reproduction of a manual signature
that is included in any attachment.
|
