Integrating HPUX 11i with Win2003 AD

[Dan Bolton]

Hi,
I have configured HPUX ldap integration to talk to Active Directory on Win2003 PDC (in 2000 mixed mode). I have gone through the setup script for LDAP_UX based on the "LDAP-UX Client service with Microsoft Windows Guide" and all seemed to work ok.

Lookup for any user fails however:

# nsquery passwd user_name

Using "files ldap" for the passwd policy.

Searching /etc/passwd for user_name
user_name was NOTFOUND

Switch configuration: Allows fallback

Searching ldap for user_name
user_name was NOTFOUND

Switch configuration: Allows fallback

All name services have been searched

Based on this I believe that my proxy user is contacting 2003 AD but not searching properly. Does anyone have any ideas on what may be going wrong?

Any suggestions as to what tool to use to further troubleshoot this or the location of related log/debug files, would be appreciated.

Thanks

[Steven E. Protter]

Shalom,

Check the event logs of the Windows box to see if there has been in fact contact.

Also the HP-UX syslog
/var/adm/syslog/syslog.log

You used these docs:

http://docs.hp.com/en/J4269-90037/ch02s05.html

http://www.docs.hp.com/en/305/intpaper.pdf

SEP

[Aussan]

Hi Dan

How is your ldap.conf configured?

do you have it using ssl connection?


Regards

Aussan

[Dan Bolton]

Steven,

Currently we have eliminated all relevant errors in the Unix syslog.

The only log entries I can find on the AD box are pairs of Successful Network Logon:/User Logoff: (event 540/538) entries in the Security log for the proxy user created for Unix. These occur continuously at approx. 1/2 hr intervals and do not coincide with nsquery commands from the Unix host.

There are no usefully events (neither success nor failures) in the Directory Service log... only logfile backup and defrag entries. !@#*!!


I can successfully query the LDAP (AD) from a Windows2000 PC using the same proxy user.

We have eliminated restrictions imposed through AD ACLs by temporarily making the proxy user a member of the 'Domain Admin' group. (Otherwise the proxy user is a member of the 'Domain Users' and 'Pre-Windows 2000 Compatible Access' groups.)

We have SSL configured and it appears to be working, however we temporarily disabled signed and encrypted LDAP traffic requirements for AD to eliminate SSL as the problem.

The result of nsquery did not deviate from the above example, with any of these changes.


Aussan,
The attachment contains the current config files (sans comments), ldapclientd.conf and ldapux_client.conf

Thanks,
Dan

[Aussan]

the conf files look good

this might sound like a stupid question but it's worth asking

pam.conf are you using ldap or krb ?

did the pamkrbval -v pass or fail?

[Dan Bolton]

I think we may have discovered (at least part of) the problem - the response from nsquery was absolutely correct, user_name was NOTFOUND.

Because our goal was to use EXISTING Windows AD accounts to log into our HPUX server app, the importing into AD of existing HPUX users was skipped. Our expectations were that we could see the existing AD accounts. This is not the case however... from HPUX the nsquery will only match AD users who are in the correct NIS domain - thus we were querying an empty set.

Once we added existing AD users to the appropriate NIS domain (via the UNIX Attributes tab) the query was successful!

# nsquery passwd user_name

Using "files ldap" for the passwd policy.

Searching /etc/passwd for user_name
user_name was NOTFOUND

Switch configuration: Allows fallback

Searching ldap for user_name
User name: user_name
User Id: 10000
Group Id: 20
Gecos:
Home Directory: /home/user_name
Shell: /bin/sh

Switch configuration: Terminates Search

We will continue testing tomorrow, if no further issues develop, I will close the thread.

There is no such thing as a stupid question - possible exception may be repeating one that has already been asked. (Then again, repeating may be required when you know the first answer given by a user cannot possibly be correct!)

[Dan Bolton]

It looks like we are on our way! We can successfully log into our Unix system with a proporly configured LADP (Active Directory) user.

Granted, this is just a test system, and we have plenty of work to do before we can roll this out for our production UX app, but it is good to end the week with some forward progress.

Thank you both for taking time to respond, have a great weekend!

Dan

[Dan Bolton]

Please see previous posts above for details on the solution.

db