LDAP-UX requires cert7.db, Mozilla that ships with 11iV3 creates cert8.db

[Andrew Scott_3]

I'm playing with LDAP-UX, trying to get it to talk to eDirectory over TLS/SSL, and I'm getting stuck at step one, importing our CA into Netscape and copying the cert database into /opt/ldapux.

It appears that LDAP-UX can read, and the documentation directs towards, a cert7.db file as created by old versions of Netscape. Wonderful, if you're running an old version of Netscape.

The version of Mozilla that is boxed with HP-UX 11iV3 creates a cert8.db file, which is a new file format. LDAP-UX won't read it, even if I symlink a cert7.db and point it at cert8.db.

How do I create a cert7.db file? Can LDAP-UX use a normal .cer file somehow?

[Heironimus]

I had to do this dance before. You need to get an old version of Netscape or (better) an older version of the NSS toolkit. I think when I looked in to LDAP-UX it included a compatible version of the NSS tools somewhere under /opt/ldapux. The command you need is "certutil".

[Sameer_Nirmal · Accepted solution]

Refer following documents which show the procedure for using cert8.db, Mozilla and LDAP-UX

http://docs.hp.com/en/J4269-90053/ch02s08.html

[Andrew Scott_3]

Awesome, that worked. Excellent.

I now I have LDAP-UX installed, and made it through the /opt/ldapux/config/setup script with no errors.

Now, when I try to verify using nsquery, I'm getting the messages "This Name Service is currently unavailable".

the ldapux daemon is running, and I've copied the sample pam.ldap and nsswitch.ldap files to pam.conf and nsswitch.conf.

Did I miss something?

[Steven E. Protter]

Shalom,

You may find ldapsearch works as a verification method.

Also take a look at the syslog /var/adm/syslog/syslog.log for further clues.

Taking a look a the logs of the master server would also be helpful.

SEP

[Andrew Scott_3]

ldapsearch works perfectly, unfortunately PAM doesn't use ldapsearch to look users up in the tree.

I'm getting zero entries in syslog when I run nsquery.

The there any way to make the ldap daemon do stuff and error out without having to go through things like nsquery or loggin in/out all the time?

[Sameer_Nirmal]

Refer the document at http://support.novell.com/techcenter/articles/ana20020602.html which is very nice and useful. Specifically note the eDirectory schema (RFC 2307) extension and deleting two attributes.
LDAP: uidNumber NDS: UID
LDAP: gidNumber NDS: GID

Then verify the integration with nsquery,pwget commands and user login.
In case of problems like you see about NSS, I would enable ldap logging and follow the troubleshooting given at http://docs.hp.com/en/J4269-90053/ch02s11.html