Operating System - HP-UX
1748269 Members
3720 Online
108760 Solutions
New Discussion юеВ

HP-UX Authentication thru Windows AD

 
SOLVED
Go to solution
walter crasto_1
Frequent Advisor

HP-UX Authentication thru Windows AD

Hi,

I have a HPUX Itanium system wanted to authenticate it thru Windows Active Directory server. Can someone advice me on this.
Thanks in advance.

Regards
Walter
7 REPLIES 7

Re: HP-UX Authentication thru Windows AD

you need to use LDAP/UX - manuals are available here:

http://docs.hp.com/en/internet.html#LDAP-UX%20Integration

HTH

Duncan

I am an HPE Employee
Accept or Kudo
Fabio Ettore
Honored Contributor

Re: HP-UX Authentication thru Windows AD

Hi,

you need to install and configure LDAP-UX services on HP-UX system. From the manual already mentioned (which is the best point to start) check also for Windows requirements, for example it asks for SFU utilities on Windows system.

HTH.

Best regards,
Fabio
WISH? IMPROVEMENT!
eric roseme
Respected Contributor
Solution

Re: HP-UX Authentication thru Windows AD

I have a whitepaper that lists cookbook style how to configure your system for "Unified Login" to AD. I have just updated it for Windows 2008R2 and the latest CIFS/Samba version on 11.31. All the setup steps for krb5, ldap-ux, and pam-kerberos are included.

http://www.docs.hp.com/en/16322/CIFSUnifiedLoginV2.pdf

Eric
Don Mallory
Trusted Contributor

Re: HP-UX Authentication thru Windows AD

Hi there,

You don't need MS SFU if your AD is 2003 R2 or above, the schema changes are already present. You will need it if you don't, however, you would be better off delaying until you upgrade to AD 2003R2, than you would to deploy LDAP-UX, then upgrade.

Technically Kerberos is the authentication method.

PAM_authz provides authorization (are you in the right group, and allowed to log into this host? Otherwise >ALL< AD users can log in...)

The LDAP-UX piece provides users and groups from the AD.

That step-by-step guide that Eric posted is pretty good (it's also very new). I wish it was around when I originally implemented.

The Instalilng and Configuring guide is also quite good and covers a lot of the possible issues, specific to many different environments. For Kerberos, I really like this test resource:

This doc: DOC ID: PAMKKBAN00000983 - A Basic Step-by-Step Summary of Kerberos v5.1 Setup on HPUX platform.

A copy of which is at the link below:
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1043163

I actually worked with the author on backline support issues once. Very bright fellow.


Interestingly enough, I was forced to temporarily disable the LDAP client daemon temporarily for a short time. As long as the users and group data is sychronised to the host in some way, the users can fully log in using Kerberos only. The trick is, if there's no naming service (LDAP-UX to provide user and group data, /etc/files, etc.) you can't log in.

Remember, LDAP is only a directory, it only provides identity, not authentications (Kerboeros), or authorization (pam_authz, sudo, etc.).

Steven E. Protter
Exalted Contributor

Re: HP-UX Authentication thru Windows AD

Shalom Walter,

Understand that in the Windows 2003 integration, only R2 will work for LDAP integration. Substantial patching is required on the windows side for this to work.

So work with the windows team and see that it is properly patched.

Part of the setup requires admin rights on the windows domain controller, so you'll need to work with the windows admins closely to get this done.

it is not easy. Budget some time to get this done.

SEP
Steven E Protter
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
Don Mallory
Trusted Contributor

Re: HP-UX Authentication thru Windows AD

Stephen is completely accurate about the domain admin rights wrt installing and configuring LDAP-UX, it's required to implement the schema change that comes with the ldapuxprofile (the schema is called DUAConfigProfile), which is how the LDAP entries are mapped to UX style files (group, passwd, auto.direct, netgroup, etc.)

The one additional note is that basic domain admin privileges are not enough, you also need to have Schema Admin enabled on the domain admin account during the first install.

Your Windows administrators will be very skittish about enabling any changes to the schema.

This one is pretty benign, however updating it, which includes enabling SSL or SASL style encryption, or changing the LDAP server search order will require you to use ADSIEdit (windows, from the ResKit) or ldapmodify (comes with LDAP-UX) to implement the changes. At this point, you are directly editing the schema.

Don
uxbeginner22
Trusted Contributor

Re: HP-UX Authentication thru Windows AD

The document is now 404

I have a problem with integrating hp-ux 11.31 with latest samba4.9

on fedora 29

I run from hpux this command

cd /opt/ldapux/config

./setup

I follow the "guide" and all works fine but..at the moment of run extended schema

exit with this error

PFMERR 43: Can't extend LDAP-UX Configuration profile schema on the Directory Server 
           samba4.blu.priv = 192.168.0.48
           with user CN=Administrator,CN=Users,DC=blu,DC=priv
           Please check the /tmp/ldapux_schema.log file for errors.

schema.log said

 

ldap_add: Already exists
ldap_add: additional info: Entry CN=serviceauthenticationMethod,CN=Schema,CN=Configuration,DC=blu,DC=priv already exists
adding new entry CN=serviceauthenticationMethod,CN=Schema,CN=Configuration,DC=blu,DC=priv

ldapmodify: no attributes to change or add (entry DC=blu,DC=priv)
modifying entry 

ldap_add: Invalid syntax
ldap_add: additional info: 0000200B: objectclass_attrs: attribute 'mayContain' on entry 'CN=DUAConfigProfile,CN=Schema,CN=Configuration,DC=blu,DC=priv' contains at least one invalid value!
adding new entry CN=DUAConfigProfile,CN=Schema,CN=Configuration,DC=blu,DC=priv

modifying entry 

 

server samba said

[2019/04/07 20:10:54.368845,  0] ../source4/dsdb/schema/schema_syntax.c:1431(_dsdb_syntax_OID_validate_numericoid)
  ber_write_OID_String() failed for 2.5.5.8 
[2019/04/07 20:10:56.348827,  0] ../source4/dsdb/schema/schema_syntax.c:1277(_dsdb_syntax_OID_attr_ldb_to_drsuapi)
  Unable to find attribute followreferrals in the schema
[2019/04/07 20:10:59.379196,  0] ../source4/dsdb/schema/schema_syntax.c:1277(_dsdb_syntax_OID_attr_ldb_to_drsuapi)
  Unable to find attribute automountMapName in the schema
[2019/04/07 20:10:59.432561,  0] ../source4/dsdb/schema/schema_syntax.c:1277(_dsdb_syntax_OID_attr_ldb_to_drsuapi)
  Unable to find attribute automountKey in the schema

Any suggestion?Thanks