LDAP and Kerberos Auth Against Active Directory.

[GlennBroSitel]

I have HP-UX boxes that I want to integrate into our Active Directory (R2 Schema).

I know this can be done rather easily with just a simple domain in AD, however I am looking for help with doing it in a multiple domain forest.

Basically I want to be able to get to these two trusted domains to allow auth for my nix systems...

NA.COMPANY.NET
NAC.COMPANY.NET

Has anyone ever accomplished this using just straight kerberos and ldap.

Supposedly Samba with adex (3.3 and higher) suppports it but it might be difficult to get a custom install of samba on all boxes.

The other option I suppose is Likewise Enterprise

[Steven E. Protter]

Shalom,

Best bet here:
If windows is the domain controller:

Use ADS and LDAP on Windows.

Use LDAP and Samba, highest version possible.

Develop a good smb.conf configuration.

Do a net join commmand, make sure it works.

Use that smb.conf file as a template, changing the name for other servers.

SEP

[GlennBroSitel]

My problem is I need to auth against multiple trusted domains in the forest, ldap idmap backend in samba doesn't do that. The ad idmap backup also doesn't do it.

Recently the adex backup was added and supposedly works for cross forest trusted auth.

[global]
workgroup = NA
security = ads
realm = NA.CL-WORLD.NET
;use kerberos keytab = true
password server = *
encrypt passwords = yes
idmap backend = adex
idmap uid = 10000 - 29999
idmap gid = 10000 - 29999
idmap config NAC:backend = adex
idmap config NAC:uid = 30000 - 39999
idmap config NAC:gid = 30000 - 39999
lanman auth = no
ntlm auth = no
winbind enum users = yes
winbind enum groups = yes
winbind separator = +
winbind nss info = adex
;winbind use default domain = yes
winbind offline logon = true
winbind normalize names = yes
client use spnego = yes

That is a sample configuration.