ldap-ux support for posixAccount host attribute

[Martin Harte]

Hey,
Is there anyway I can get ldap-ux to check the posixAccount host attribute when it's authenticating users?

All of the documentation seems to refer to pam_authz for this kind of use. That requires using netgroups though and I want to avoid it if I can.

Thanks,

Martin Harte

[Doug Lamoureux_2]

Use a modified search descriptor in the LDAP-UX configuration profile. Using search descriptors is pretty flexible so it will depend on your configuration. Here is one example:

Add an attribute "host" to every users object that idetifies the host(s) that user can login to. This is a multivalued attribute so you can add multiple "hosts".

If you want to allow a user (admin) to login to all hosts add the value "ALL" to the host attribute. You will need to create a custom profile for each ldap-ux host. Modify the passwd and pam search descriptor as follows (replacing HOSTNAME with your ldap-ux client):

servicesearchdescriptor: passwd:ou=people,dc=acme,dc=com?sub?
(&(objectclass=posixaccount)(|(host=ALL)(host=))

servicesearchdescriptor: pam:ou=people,dc=acme,dc=com?sub?
(&(objectclass=posixaccount)(|(host=ALL)(host=))