Authenticate unix to NT (Win2K)

[Jim Butler]

We are looking at the best way to handle authentication to Win2K (ldap) from a collection of *ix workstations

Primarily, HP, Sun, and linux.

I see the links on the Howtos.

How far back do the OS' support these implementations (i.e., I want to communicate to mgmt that "we will do this for HP-UX 11.00 and beyond, and will not modify 10.20 and older, those baselines will be frozen"

Do you have a feel for where the cutoff is?

[Florian Heigl (new acc)]

hi,

I think this mostly depends on if it is acceptable to take the effort of integrating PAM/LDAP into Your 10.20 systems - I don't think it is too advisable, but if it works with a week or so of effort then: why not - 10.20 is unsupported anyway :)

Linux and Solaris come with PAM support for a long time, even tough there might be some rough edges in older versions (SunOS 2.6?...) everything should be solveable.

As a fallback do some testing with the Microsoft Services for UNIX (SFU) NIS integration tool, in the worst case this will help You get systems that won't talk OpenLDAP/SSL/PAM auth to use NIS instead with the AD accounts and passwords.

(Some larger universities in the US found a better way by extending OpenLDAPs schemes and replicating the AD out of an OpenLDAP server cluster. Better performance, better availability and overall deeper sleep :)

[Jim Butler]

Florian,

Thanks for the input. I appreciate it, and welcome any other input from other sources. Points will be assigned - will leave thread open for a couple of days.