topic Re: Singlre Sign on Username and password in Operating System - HP-UX

Singlre Sign on Username and password

Brian Duthie — Tue, 05 Jun 2007 02:54:32 GMT

I have a customer who has 3 HP rp8400 HP-UX 11i machines. Each run +- 30 Oracle databases.

The Application is a Terminal based app requiring System Usernames and passwords.(Local on each machine at this time)

They wish to cluster these machines. How do they syncronise usernames and passwords between the 3 machines? To ensue the user can login after the DB is failed over.

Regards
Brian

Re: Singlre Sign on Username and password

S Plunkett — Tue, 05 Jun 2007 03:37:52 GMT

Have you looked at Kerberos(5) ?

Regards,
Sarah Plunkett

Re: Singlre Sign on Username and password

Steven E. Protter — Tue, 05 Jun 2007 04:14:59 GMT

Shalom,

You could install the Red Hat or Netscape LDAP server for HP-UX http://software.hp.com and have centralized authentication based on your Unix host.

If you have a windows domain, you can install samba CIFS/9000 from the above site and integrate the systems into an ADS domain and let Windows do it (arrrhg).

SEP

Re: Singlre Sign on Username and password

Robert Fritz — Wed, 06 Jun 2007 12:58:14 GMT

Also, you may want to consider SelectAccess, though that may be for a scale beyond what you want here.

http://www.openview.hp.com/products/select/index.html

-R

Re: Singlre Sign on Username and password

John Kittel — Wed, 06 Jun 2007 13:26:24 GMT

As already suggested, LDAP (ADS) may be "best"...

But if you don't want to or can't do that for some reason, - possibly easier to accomplish(?) is the way I have done it. Initially make sure the regular ux accounts uids and gids (and group info) are the same on all systems. If they aren't already, then you'll have to make them so (usermod, or remove and recreate accounts if necessary, which can be quite a hassle if they are way out of sync). Then make sure whenever you make a change on one system you make the same changes on the other systems ( add, modify accts, etc.). Keeping in sync is manual process, but I have a nightly cron job that checks and reminds me if I forget anything. Then the last piece is the passwords, - I have a twice daily cron job that copies the user's tcb files (not system accounts) from the node that has the application package active, to the other node. We have a simple two node active-active cluster, and I have had no problems over the past 3 years doing it this way.

(probably) other responders will comment further on the deficiencies of this method...

Re: Singlre Sign on Username and password

Brian Duthie — Thu, 07 Jun 2007 01:37:12 GMT

Good Day All

Thank you for the tips and comments .

We are going to install LDAP and see how that goes.

Thanks again
Brian