Simpler Navigation for Servers and Operating Systems - Please Update Your Bookmarks
Completed: a much simpler Servers and Operating Systems section of the Community. We combined many of the older boards, so you won't have to click through so many levels to get at the information you need. Check the consolidated boards here as many sub-forums are now single boards.
If you have bookmarked forums or discussion boards in Servers and Operating Systems, we suggest you check and update them as needed.
System Administration
Showing results for 
Search instead for 
Did you mean: 

HP-UX Authentication thru Windows AD

Go to solution
walter crasto_1
Frequent Advisor

HP-UX Authentication thru Windows AD


I have a HPUX Itanium system wanted to authenticate it thru Windows Active Directory server. Can someone advice me on this.
Thanks in advance.

Duncan Edmonstone
Honored Contributor

Re: HP-UX Authentication thru Windows AD

you need to use LDAP/UX - manuals are available here:




Fabio Ettore
Honored Contributor

Re: HP-UX Authentication thru Windows AD


you need to install and configure LDAP-UX services on HP-UX system. From the manual already mentioned (which is the best point to start) check also for Windows requirements, for example it asks for SFU utilities on Windows system.


Best regards,
eric roseme
Respected Contributor

Re: HP-UX Authentication thru Windows AD

I have a whitepaper that lists cookbook style how to configure your system for "Unified Login" to AD. I have just updated it for Windows 2008R2 and the latest CIFS/Samba version on 11.31. All the setup steps for krb5, ldap-ux, and pam-kerberos are included.

Don Mallory
Trusted Contributor

Re: HP-UX Authentication thru Windows AD

Hi there,

You don't need MS SFU if your AD is 2003 R2 or above, the schema changes are already present. You will need it if you don't, however, you would be better off delaying until you upgrade to AD 2003R2, than you would to deploy LDAP-UX, then upgrade.

Technically Kerberos is the authentication method.

PAM_authz provides authorization (are you in the right group, and allowed to log into this host? Otherwise >ALL< AD users can log in...)

The LDAP-UX piece provides users and groups from the AD.

That step-by-step guide that Eric posted is pretty good (it's also very new). I wish it was around when I originally implemented.

The Instalilng and Configuring guide is also quite good and covers a lot of the possible issues, specific to many different environments. For Kerberos, I really like this test resource:

This doc: DOC ID: PAMKKBAN00000983 - A Basic Step-by-Step Summary of Kerberos v5.1 Setup on HPUX platform.

A copy of which is at the link below:

I actually worked with the author on backline support issues once. Very bright fellow.

Interestingly enough, I was forced to temporarily disable the LDAP client daemon temporarily for a short time. As long as the users and group data is sychronised to the host in some way, the users can fully log in using Kerberos only. The trick is, if there's no naming service (LDAP-UX to provide user and group data, /etc/files, etc.) you can't log in.

Remember, LDAP is only a directory, it only provides identity, not authentications (Kerboeros), or authorization (pam_authz, sudo, etc.).

Steven E. Protter
Exalted Contributor

Re: HP-UX Authentication thru Windows AD

Shalom Walter,

Understand that in the Windows 2003 integration, only R2 will work for LDAP integration. Substantial patching is required on the windows side for this to work.

So work with the windows team and see that it is properly patched.

Part of the setup requires admin rights on the windows domain controller, so you'll need to work with the windows admins closely to get this done.

it is not easy. Budget some time to get this done.

Steven E Protter
Owner of ISN Corporation
Don Mallory
Trusted Contributor

Re: HP-UX Authentication thru Windows AD

Stephen is completely accurate about the domain admin rights wrt installing and configuring LDAP-UX, it's required to implement the schema change that comes with the ldapuxprofile (the schema is called DUAConfigProfile), which is how the LDAP entries are mapped to UX style files (group, passwd,, netgroup, etc.)

The one additional note is that basic domain admin privileges are not enough, you also need to have Schema Admin enabled on the domain admin account during the first install.

Your Windows administrators will be very skittish about enabling any changes to the schema.

This one is pretty benign, however updating it, which includes enabling SSL or SASL style encryption, or changing the LDAP server search order will require you to use ADSIEdit (windows, from the ResKit) or ldapmodify (comes with LDAP-UX) to implement the changes. At this point, you are directly editing the schema.