LDAP (NDS + ldapux) question

[M.J.P. Benschop]

Hi all,

I'm currently testing a configuration in which I consolidate 2 NIS domains into one single LDAP Directory using NDS 6.11 and ldapux 3.30 which i both took from the HPUX 11i Application Cdroms.
After importing the passwd, group and services data, logging in and everything works fine.
I put the 2 NIS domains together into the same passwd, group and services ou's, since this is easier to administer.

I'v read somewhere that it is possible (not sure if that was about NDS 6.11 and/or ldapux ) to allow/disallow users to login on defined groups of systems.
I suppose that one can assign a certain attribute to a user which the server that's logged into checks on for a specific value...

Does anyone know if that's possible whit NDS 6.11 in combination whith ldapux 3.30 ?
I can't find it in the documentation anywhere.

Thanks for helping out !

Greetings,
Mark

[Steven E. Protter]

Sounds like something that should be set up in /etc/group and user group membership prior to importing /etc/passwd et all into ldap database.

It might also be an openldap feature, but I think my first try more likely.

SEP

[Bob Neal-Joslin · Accepted solution]

LDAP-UX includes pam_authz, which allows selective access control. Version B.03.30 only allows specification of users with the netgroup +/- syntax in the /etc/passwd file. Version B.04.00 includes a more advanced policy description syntax. See page 97 of the B.04.00 administrator's guide: http://docs.hp.com/en/J4269-90048/J4269-90048.pdf. See http://docs.hp.com/en/internet.html#LDAP-UX%20Integration for other LDAP-UX documentation.

Note that it's also possbile to speicify an LDAP search filter for the "pam" service in the LDAP-UX configuration profile that can be used to restrict login from the libpam_ldap.so library, using specific attributes as defined in user's entries inthe directory. Reply if you need more details on this.