new to LDAP

[Joseph Hoh]

I am investigating LDAP and I have some questions:

1 - I use NIS for groups, logins, passwords, mail aliases, and homedirs. Can LDAP replace NIS an all of these functions?
2 - If it can replace all of these how does it work? Or where is a good place to look.
3 - How do I keep everyone with an LDAP entry from logging into my servers?
4 - How does HP-UX work with LDAP logins longer than 8 characters?

Thanks.

[Steve Steel]

Hi


Try

http://www.padl.com/hpux/

To get you going


steve Steel

[harry d brown jr]

http://docs.hp.com/hpux/onlinedocs/J4269-90006/00/00/1-con.html

live free or die
harry

[Zeev Schultz]

Jeff,
AFAIK,HP supplies only NIS-LDAP gateway (a NIS
server modified to store its information in LDAP Database instead of NIS maps) and LDAP clients software.What I guess is that NIS-LDAP
gateway requires LDAP (Directory) Server and
acts as translator rpc-to-ldap.
If you need a Directory server you can try OpenLDAP - http://www.openldap.org/
or Sun/Netscape (which isn't free).
For general info try :
http://www.openldap.org/doc/admin21/
Another,hp specific white paper:
http://docs.hp.com/hpux/onlinedocs/internet/uxint.html
Zeev

[Bob Neal-Joslin]

1. Yes. However LDAP-UX does not directly support mail aliases. Instead you can configure sendmail to look directly in an LDAP directory.

2. Information specific to Unix is stored in the LDAP directory under a unix schema (RFC 2307.) The LDAP protocol is used to retrive and present this information to the HP-UX OS and applications through the name service APIs like getpwnam(). A name service switch /etc/nsswitch.conf configures which backends, like NIS, files or LDAP should be used.

3. Several ways: First, only users with unix attributes (unix user id numbers, etc..) are visible to HP-UX. In addition, you can configure pam_ldap search filters to control which users may login. Or with netgroups (in ldap or nis) you can limit logins the more traditional NIS-way, using the pam_authz library (part of LDAP-UX.)


4. Login names greater than 8 characters don't work properly on HP-UX. The alternatives are to use a separate attributue in the directory for an HP-UX account name, or to assure that all uid names are 8 characters or less (sorry.)


Aside from the other recommended readings, start by looking at http://docs.hp.com/hpux/internet. Look for LDAP-UX Integration.

Bob

[Bob Neal-Joslin]

1. Yes. However LDAP-UX does not directly support mail aliases. Instead you can configure sendmail to look directly in an LDAP directory.

2. Information specific to Unix is stored in the LDAP directory under a unix schema (RFC 2307.) The LDAP protocol is used to retrive and present this information to the HP-UX OS and applications through the name service APIs like getpwnam(). A name service switch /etc/nsswitch.conf configures which backends, like NIS, files or LDAP should be used.

3. Several ways: First, only users with unix attributes (unix user id numbers, etc..) are visible to HP-UX. In addition, you can configure pam_ldap search filters to control which users may login. Or with netgroups (in ldap or nis) you can limit logins the more traditional NIS-way, using the pam_authz library (part of LDAP-UX.)


4. Login names greater than 8 characters don't work properly on HP-UX. The alternatives are to use a separate attributue in the directory for an HP-UX account name, or to assure that all uid names are 8 characters or less (sorry.)


Aside from the other recommended readings, start by looking at http://docs.hp.com/hpux/internet. Look for LDAP-UX Integration.

Bob

[Bob Neal-Joslin]

1. Yes. However LDAP-UX does not directly support mail aliases. Instead you can configure sendmail to look directly in an LDAP directory.

2. Information specific to Unix is stored in the LDAP directory under a unix schema (RFC 2307.) The LDAP protocol is used to retrive and present this information to the HP-UX OS and applications through the name service APIs like getpwnam(). A name service switch /etc/nsswitch.conf configures which backends, like NIS, files or LDAP should be used.

3. Several ways: First, only users with unix attributes (unix user id numbers, etc..) are visible to HP-UX. In addition, you can configure pam_ldap search filters to control which users may login. Or with netgroups (in ldap or nis) you can limit logins the more traditional NIS-way, using the pam_authz library (part of LDAP-UX.)


4. Login names greater than 8 characters don't work properly on HP-UX. The alternatives are to use a separate attributue in the directory for an HP-UX account name, or to assure that all uid names are 8 characters or less (sorry.)


Aside from the other recommended readings, start by looking at http://docs.hp.com/hpux/internet. Look for LDAP-UX Integration.

Bob