TeamSite 6.5 LDAP Solaris Local accounts

If TS 6.5 is installed on Solaris, will local accounts still need to be created on the Server?

I tend to remember someone telling me once that when using LDAP in TeamSite on Solaris, local accounts still need to be created on the TeamSite server.

Also, if i use LDAP to authienticate am i forced to store roles in ldap?

Find more posts tagged with

Comments

Bill Klish

local user accounts are not needed. And you have the option to manage roles in ldap or using the standard roles files.

We use the roles files still.

Within iw.cfg we use the pam option for authentication type.

Hope that helps.

Migrateduser

Can someone please elaborate on this? I've seen posts where they say that the local UNIX account must exist and other posts, like this, that say it's not required. I would like to just maintain TeamSite users in LDAP without having to create the local UNIX account.

I'm running TS 6.7.1 on Solaris 9. TS LDAP configuration in iw.cfg:

[authentication]
authenticate_by=ldap
ldap_server=servername.company.com
ldap_port=389
ldap_dnbase=ou=users,ou=accounts,o=company.com
ldap_account=cn=username
ldap_pwd=password
ldap_roles=tsrole
ldap_key=accountname

Here’s the tests I did:
I have an account, joe, that has a local UNIX account and exists in LDAP. As a test, I set joe's password different in LDAP compared to the local UNIX account. When the above "authenticate_by=ldap" is commented out (disabled), joe is able to authenticate using his local UNIX password. And when "authenticate_by=ldap" is uncommented (enabled), I've confirmed that joe authenticates using his LDAP password.

So I setup another user in LDAP (betty), but did not create a local UNIX account. Betty is not able to login to TeamSite. Reviewing my LDAP logs, I see TeamSite binds to LDAP and retrieves the user, but TeamSite returns the error "Wrong username/password". Yet when I add a local UNIX account for Betty with a different password, I am able login as Betty using the LDAP password.

So why are LDAP users unable to authenticate without a local UNIX account? Am I missing a configuration?

Also… I’ve set ldapcache_thread_delay in iw.cfg, yet tsldapuserscache.xml is not populating. Reading the documentation, users should be cached in tsldapuserscache.xml… but they are not. Any thoughts?

Thanks,

-Kurt

Bill Klish

How is the local solaris server setup for authentication? Have you enabled authentication using ldap or have you just kept it the default local accounts?

For this to work, you need to have it setup to authenticate users against your ldap. Then I would just set authenticate_by to pam.

Migrateduser

Kurt,

Just want to know did you get any answers for
1) Why do we need to create local UNIX accounts for LDAP users to work?
2) why tsldapuserscache.xml is not populating even after setting the ldapcache_thread_delay in iw.cfg. ( Infact i have set ldapcache_thread_delay=5 for 5 minutes, but it does not populate tsldapuserscache.xml).

Can you please let me know if you have answers for the above questions? Help is highly appreciated :-)

Thanks !

Adam Stoller

Kurt,

Just want to know did you get any answers for
1) Why do we need to create local UNIX accounts for LDAP users to work?
2) why tsldapuserscache.xml is not populating even after setting the ldapcache_thread_delay in iw.cfg. ( Infact i have set ldapcache_thread_delay=5 for 5 minutes, but it does not populate tsldapuserscache.xml).

Can you please let me know if you have answers for the above questions? Help is highly appreciated :-)

Thanks !

'1' should be optional when 6.7.1SP1 comes out - however, with that option come a number of other change requirements (especially with regard to any Perl scripts and most especially with regard to PTs - which uses Perl on the backend) - so make sure to read the documentation carefully.

chicka

Hi there,

Request you to have a check on nsswitch.conf file.