Some body know how to debug the pam_mkhomedir.so for Solaris?

I followed this http://www.keutel.de/pam_mkhomedir/index.html to compile the pam_mkhomedir.so and the compilation is fine
I put this line into /etc/pam.conf :
other session required pam_mkhomedir.so.1 skel=/etc/skel umask=0022 debug

But nothing work. The user of openldap base can logon but no directory create. Is it normal ? How can i debug it ?
Thanks by advance for you answer.

I had the same problem - ForestDnsZones.xxxxx.xxx did not resolve. It seems I had forgotten to add the adequate ‘dns’ entries in ‘nsswitch.conf’ after running the ‘ldapclient’ utility…

——————
hosts files dns
——————

//Henrik

The domain_realm section isn’t about multiple AD domains, it’s about multiple DNS domains, and mapping those DNS domains to the corresponding Kerberos realm (or AD domain). In the example configuration, systems from both the example.com and subdomain.example.com DNS domains will authenticate against the EXAMPLE.COM Kerberos realm (or AD domain). I haven’t found a way to authenticate against multiple AD domains, although I’m sure there is a way.

Good luck!

You have multiple domains listed in the realms section
[domain_realm]
.example.com = EXAMPLE.COM
.subdomain.example.com = EXAMPLE.COM
Which would seem to indicate that both users from example.com and subdomain.example.com should be able to authenticate. Is this the case in your testing, or were you testing strictly against a single domain structure?

I know in LDAP is we actually had UNIX hosts acting ad KDC’s we can do cross realm authentication (both heirarchical and non) but as of yet, since the AD servers act as the KDC’s and trust is setup within AD, we have not been able to find a definitive answer.

The only thing we can think of, and we will be trying today, is to create the machine in both domains and merge the keytabs so that the machine essentially exists in both domains.

Oh yes, of course we have to use the GC port (3268) and there was a specific patch level we had to be on for the follow referrers for the GC port to work, but that is as far as we have gotten so far. Any ideas are welcome.

Thanks

AFAIK, you can’t authenticate against multiple AD domains.

I’ve been excited by the possibilities of Single Sign On and *NIX/AD integration since I first learned that Micro$oft had elected to implement LDAP and Kerberos. Fantastic to see the state of the technology on this so far along now.

You have performed quite a service to the tech community by pulling all this together, thank you.

Can you or anyone here give us all a sense of what the sizes are of the environments where *NIX/AD integration is being used?

How many *NIX systems?
How many users?

What *NIX variants have been successfully integrated besides Solaris & Linux? HP-UX? AIX? *BSD?

How about if we all agree to keep our organizations anonymous, but some quantification of where we are all at would be great.

Thank you all for working to move the world forward.

Warm regards,

Bart

Try this:

-a serviceSearchDescriptor=passwd:dc=mani,dc=com?sub \
-a serviceSearchDescriptor=group:dc=mani,dc=com?sub

See if that helps. Good luck!

ldapclient manual \
-a credentialLevel=proxy \
-a authenticationMethod=simple \
-a proxyDN=cn=test,cn=users,dc=mani,dc=com \
-a proxyPassword=Admin123 \
-a defaultSearchBase=dc=mani,dc=com \
-a domainName=mani.com \
-a “defaultServerList=192.168.1.89″ \
-a attributeMap=group:userpassword=msSFU30Password \
-a attributeMap=group:memberuid=msSFU30MemberUid \
-a attributeMap=group:gidnumber=msSFU30GidNumber \
-a attributeMap=passwd:gecos=msSFU30Gecos \
-a attributeMap=passwd:gidnumber=msSFU30GidNumber \
-a attributeMap=passwd:uidnumber=msSFU30UidNumber \
-a attributeMap=passwd:uid=sAMAccountName \
-a attributeMap=passwd:homedirectory=msSFU30HomeDirectory \
-a attributeMap=passwd:loginshell=msSFU30LoginShell \
-a attributeMap=shadow:shadowflag=msSFU30ShadowFlag \
-a attributeMap=shadow:userpassword=msSFU30Password \
-a attributeMap=shadow:uid=sAMAccountName \
-a objectClassMap=group:posixGroup=group \
-a objectClassMap=passwd:posixAccount=user \
-a objectClassMap=shadow:shadowAccount=user \
-a serviceSearchDescriptor=passwd:dc=mani,dc=com? \
-a serviceSearchDescriptor=group:dc=mani,dc=com?

“newall.sh” 26 lines, 1104 characters
bash-3.00#
bash-3.00# sh newall.sh
System successfully configured
bash-3.00# cp /opt/nsswitch.conf /etc
bash-3.00# id test
id: invalid user name: “test”
bash-3.00# id test01
id: invalid user name: “test01″
bash-3.00#

Please help Thanks
Hayat

-a serviceSearchDescriptor=passwd:ou=UNIX-OU?sub \
-a serviceSearchDescriptor=group:ou=UNIX-OUsub