partial smb authentication? Can this be done?

[Trever Furnish]

Is it possible to allow active directory (or some other ldap database, or even just some other database besides /etc/passwd) to be used for *some* logins, but not for *all* logins?

On most of my systems, there are a few user accounts that I would prefer to offer the benefits of a single sign-on.

However, for most of the accounts on any given system (root, www, nobody, oracle, etc) I want to preclude any possiblity that they can be accessed by authenticating against the single sign-on directory.

I suppose what I'm thinking of might be implemented as an smbauth pam module that was smart enough to check a local list of usernames allowed to be authenticated via smb. Does such a module exist?

Other suggestions are very welcome.

[Simon Hargrave]

If you only add the users you want single-sign-on into your LDAP database or whatever, then your + entry in /etc/passwd will tell authentication to check users against the local password database,then against the LDAP database (or NIS or whatever).

So simply add your single signons to LDAP, and your unique signons to local passwd database.

[Trever Furnish]

Thanks, but that doesn't meet the need. Doing it that way allows the SSO administrator control over which accounts use single sign on.

(Unless I'm misunderstanding you...)

I do not want the presence of a 'root' account in the SSO directory to cause the unix root account to be authenticated against the directory.

Ie I want complete control over which accounts use sso and which accounts don't use sso to remain *only* with the Unix admin, not the SSO admin.

Did I misunderstand? If so, correct me and win more points. :-)

[Sundar_7]

Hi Trever,

This may or may not help.

Look for /etc/pam_user.conf. In this file you can specify the authentication policy on an user basis.

-- Sundar

[Steven E. Protter]

The answer to your question is yes.

Active Directory with LDAP installed will absolutely allow you to have single sign on for Unix servers.

The exception is account such as root and other admin accounts which can not and should not be authenticated this way.

Here are some docs that tell you how to do it:
http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/J4269-90031/J4269-90031_top.html&con=/hpux/onlinedocs/J4269-90031/00/00/13-con.html&toc=/hpux/onlinedocs/J4269-90031/00/00/13-toc.html&searchterms=Directory%7cLDAP%7cintegration%7cActive&queryid=20040625-124636

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/J4269-90031/J4269-90031_top.html&con=/hpux/onlinedocs/J4269-90031/00/00/13-con.html&toc=/hpux/onlinedocs/J4269-90031/00/00/13-toc.html&searchterms=Directory%7cLDAP%7cintegration%7cActive&queryid=20040625-124537

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/J4269-90031/J4269-90031_top.html&con=/hpux/onlinedocs/J4269-90031/00/00/7-con.html&toc=/hpux/onlinedocs/J4269-90031/00/00/7-toc.html&searchterms=Directory%7cLDAP%7cintegration%7cActive&queryid=20040625-124537

SEP

[RAC_1]

I think it should be possible. For some logins which want to authenticate from ldap, do not include them in ldap and others in /etc/passwd. If you ldap installed, you can use directive
passwd : file ldap in /etc/nsswitch.conf.

Refer /etc/nsswitch.ldap for examples.

Anil