What is it that you are trying to do?
Is it just to provide users, groups, authentication against OpenLDAP, or are you trying to include authorization (limit user's ability to log into a particular host), etc?
In my case, I'm going against Windows AD 2k, so there are strange differences since they don't match the RFC2307 POSIX LDAP spec completely, but hey, it's just a guideline right?
If you are looking for authorization, why not use the built-in pam_authz module? There are references for using it around the LDAP-UX docs, but basically, add the pam_authz lines to the /etc/pam.conf, but ONLY in the account section, you aren't proving who they are, only that they are authorized to log in. Example:
# Account management
#
login account required /usr/lib/security/libpam_updbe.1
login account required /usr/lib/security/libpam_authz.1
login account sufficient /usr/lib/security/libpam_krb5.1
login account required /usr/lib/security/libpam_unix.1
You need to repead for su, dtlogin, dtaction , ftp, rcomds and sshd.
updbe is really cool, it enables the pam_user.conf, which lets you disable using particular auth models for particular accounts, such as root, operator, oracle, or other service accounts. KRB is obviously Kerberos, I need it for getting to the AD mostly.
The config of pam_authz is under /etc/opt/ldapux/pam_authz.policy.
It's pretty simple, there is a .template file with examples, but I was never able to get any of the ldap_group or ldap_filters to work, so I just used unix groups. Create group in the directory (hostname_access), give it a GID and some users. If you are in, you log in, if not, too bad.
Example:
allow:unix_group:server2_access,server2_local
server2_local contains root, oracle, operator, etc. sort of accounts that are LOCAL to the host, so this group is in /etc/group.
server2_access is from the directory.
The biggest trouble with LDAP-UX is that you must have the profile schema in your directory, it must be right, and it must point to the right objects to translate. It's also a little finicky about the whole proxy user thing.
If you've got the host under support, give backline a call. It will take about 3 people, but there are some very good people in the team for LDAP-UX. I ended up on the phone with the guy that wrote most of the docs.
Oh, and I know, IT people don't read docs and all that, but in this case, read the docs. They're really good.
