nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

TeamSite LDAP integration

ts_user

I am in the process of gathering all the requirements for using LDAP for TeamSite authentication. We are planning to upgrade to TeamSite 6.1 or else go with TeamSite 5.5.2 implementation on Solaris 2.8. I will be working with the LDAP team for the integration. I wanted to check some questions and see if any of you have a better input on how best to do the integration.
*We are trying to find an optimal solution where we do not have to create local user accounts on Solaris and have all user/group accounts in LDAP. Is it required to create dummy user accounts on Solaris server (even though the user exists in LDAP) to have TeamSite authenticate users against LDAP? Or is it possible to have TeamSite authenticate users directly with LDAP with no local user accounts created?
* Has any company used solutions like NDS for authentication against Novell LDAP tree? I guess this solution would also require for us to have to create local user accounts (and with /dev/null to prevent users telnet to the server)?
* We plan to have all groups maintained in LDAP instead of having them locally on Solaris TeamSite server as it helps us to avert the Solaris restriction of 16 or max 32 groups limit which we are bound to reach quickly due to pace at which we are growing branches. Has anyone found a way to work around this restriction? One solution I can think of is to dynamically change the groups the user belongs to, but it soon becomes an administrative nightmare.

Thanks in advance.

Find more posts tagged with

Comments

nipper

Note, these answers are for 552 on Solaris, though I do not think they are different for 6.1:

>*We are trying to find an optimal solution where we do not have to create local user accounts on Solaris and
> have all user/group accounts in LDAP. Is it required to create dummy user accounts on Solaris server (even though the
> user exists in LDAP) to have TeamSite authenticate users against LDAP? Or is it possible to have TeamSite authenticate
> users directly with LDAP with no local user accounts created?

Currently you need local accounts, though they do not require shell access. So we use a shell of /bin/false to
prevent someone from telneting in, though there is an entry in /etc/passwd for andy...

>* We plan to have all groups maintained in LDAP instead of having them locally on Solaris TeamSite server as it helps us
> to avert the Solaris restriction of 16 or max 32 groups limit which we are bound to reach quickly due to pace at which we
> are growing branches. Has anyone found a way to work around this restriction? One solution I can think of is to dynamically
>change the groups the user belongs to, but it soon becomes an administrative nightmare.

It is a pain. I am not too confident that LDAP groups would help, since the filesystem activity is managed through
Solaris and that still has a 16 group limit.

There are reportedly some enhancements in 6.5 that make this much easier, but you will need to talk to a
sales critter about that.

HTH

Andy

ts_user

Thanks Andy for your reply.

The problem we find with having to create local users is the problem of getting the buyoff from Security group and also the administrative nightmare of maintaining users ( about 500+) . We instead were planning to have LDAP be our central repository of user information. If this can not be achieved so be it.

We have a lot many branches and we control user access to files with branch level security. The problem of working with 16 groups would restrict our ability of controlling branch level access to users as we have some users who need to belong to multiple groups.

Regards,
ts_user

gzevin

at my current client we maintain all the users and groups in iPlanet directory server and authentication happens transparent to TeamSite. My scripts then query the server using LDAP to figure out users group memberships.

about 16 groups - using directory will not help to solve you this, as the nipper has just said

Greg Zevin, Ph.D. Comp. Sc.
Independent Interwoven Consultant/Architect
Sydney, AU

Edited by gzevin on 07/12/04 10:02 PM (server time).

smenon

We are planning to release a fix to address the 16-group limitation on Solaris by providing the ability to create user defined non-OS groups. Barring any major unforseen issues, this feature should be released as part of TeamSite 6.5 due at the end of October this year.

--Sunil Menon
Product Manager
Interwoven, Inc.

gzevin

well, I heard such promises so many times, I have to see it to believe it!

and.. then we'd have to wait till 6.5.2 to implement this into production

Greg Zevin, Ph.D. Comp. Sc.
Independent Interwoven Consultant/Architect
Sydney, AU

nipper

>at my current client we maintain all the users and groups in iPlanet directory server and authentication happens transparent to
>TeamSite. My scripts then query the server using LDAP to figure out users group memberships.

Greg, are you able to go without any entry in /etc/passwd ? We use LDAP for password verification, but the
login info (uid, etc) is still kept in the local passwd file)

Adam Stoller

I haven't dealt with LDAP stuff too much - but a quick search on this site I found article 49181 which seems to indicate that it is possible to configure things such that you don't need to have accounts on the local system - but it seems to be an all-or-nothing kind of deal.

Hope that helps.

--fish
Senior Consultant, Quotient Inc.
http://www.quotient-inc.com

iwovGraduate

Not sure how your LDAP/solaris is set up, but if Solaris is set up for native LDAP authentication, you don't need duplicate entries in local /etc/passwd.

ts_user

>at my current client we maintain all the users and groups in iPlanet directory server and authentication happens transparent to TeamSite.

Greg, How do you manage the groups for sharing for sharing branches and restricting user access? I would think that you would still require having local groups on the server and users sharing the branches defined in /etc/group file.

>We are planning to release a fix to address the 16-group limitation on Solaris by providing the ability to create user defined non-OS groups. Barring any major >unforseen issues, this feature should be released as part of TeamSite 6.5 due at the end of October this year.

Sunil, I heard similar information in one of the user groups that there is going to be a change in Teamsite security model. The problem is that we are planning for a Solaris upgrade with the current ( 5.5.2) version or may be 6.1. So we are trying to find a way or workaround of addressing that issue before we will be on 6.5.

gzevin

In reply to:

>at my current client we maintain all the users and groups in iPlanet directory server and authentication happens transparent to TeamSite.

Greg, How do you manage the groups for sharing for sharing branches and restricting user access? I would think that you would still require having local groups on the server and users sharing the branches defined in /etc/group file.

my answer to you an nipper -

yes, we *do not* have either users or groups on the server itself - everything is fetched from the iPlanet directory server. Our sysadmins handle that, but in initial stages I kinda got involved, so I believe it's still done using native Solaris LDAP methods.

Another thing that I was hoping to get all the info from a single central directory server in the organisation (that is supposed to keep all the info), but since I found that the data from that server is not consistent or complete, we opted for our own little server (and we, in fact, are using a number of directory servers with TeamSite - e.g. I am just about to finish a CGI callout for MDCT and DCTs that does search aother X.500 directory server...)

Greg Zevin, Ph.D. Comp. Sc.
Independent Interwoven Consultant/Architect
Sydney, AU