ldapux client setup with ad

[Medavie]

I am new to ldap setup. I am trying to configure hpux 11.23 to use ldap (J4269AA B.04.15.01 LDAP-UX Integration) to authenticate users passwords against AD. I am not interested in keeping group or user information for the unix accounts in AD. What is needed is to have user enter their password at login time and have it be the AD password for our lan and then get access.
I have run the setup program in /opt/ldapux/config and gone through the answers. When attempting to sign on to the hp server after modifing the pamd.conf and nsswitch.conf, the login asks for my password, then the system password (moved the /etc/ldap/trusted.conf into place).
Is ldapux what I need to run od should it be replaced by openldap. I know that AD will work with linux as the RH servers have been configured to use AD for password.
Any help appreciated.

[Steven E. Protter]

Shalom,

I've had the same problems. We believe it is due to configuration problems on the Windows PDC/ADS Master.

The system must be updated to the absolute latest LDAP version in order for the schema extension portion of the ldap-ux setup script to work.

I also tried replacing ldapux with HP's openldap product. That simply did not work. The product is only configurable via a webmin interface and the integration never worked.

Still we believe the root cause of the problem is the inability of the ldapux setup scripts to extend the schema on the Windows ADS server. We're not at the stage where we can be sure that fixing Windows fixes the problem.

We're also studying an ldap free solution that merely uses samba with security=ads for integration. We're not done with that.

I think it likely there are flaws in ldapux. I've yet to meet someone that actually has it working in an ADS/LDAP integration.

SEP

[Heironimus]

If you only need password validation and not naming services you may be able to just use the Kerberos PAM module and leave LDAP-UX out of the mix.