![Solaris 客户端 ldap 和 Samba4 AD ldap 服务器:一些奇怪的事情](https://linux22.com/image/186785/Solaris%20%E5%AE%A2%E6%88%B7%E7%AB%AF%20ldap%20%E5%92%8C%20Samba4%20AD%20ldap%20%E6%9C%8D%E5%8A%A1%E5%99%A8%EF%BC%9A%E4%B8%80%E4%BA%9B%E5%A5%87%E6%80%AA%E7%9A%84%E4%BA%8B%E6%83%85.png)
我已将 Solaris 配置为使用 ldap 用户。 ldap服务器是Samba4 DC,客户端是Solaris 11.4。
我已经用这个命令“加入”服务器
ldapclient manual \
-a credentialLevel=proxy \
-a authenticationMethod=sasl/gssapi \
-a proxyDN=cn=proxyldap,cn=Users,dc=mydom,dc=priv \
-a proxyPassword=******* \
-a defaultSearchBase=dc=mydom,dc=priv \
-a debugLevel=6 \
-a domainName=mydom.priv \
-a "defaultServerList=10.3.0.4" \
-a attributeMap=group:userpassword=unixUserPassword\
-a attributeMap=group:gidnumber=gidNumber \
-a attributeMap=passwd:cn=cn \
-a attributeMap=passwd:gidnumber=gidNumber \
-a attributeMap=passwd:uidnumber=uidNumber \
-a attributeMap=passwd:homedirectory=homeDirectory \
-a attributeMap=passwd:loginshell=loginShell \
-a attributeMap=shadow:userpassword=unixUserPassword \
-a objectClassMap=group:posixGroup=group \
-a objectClassMap=passwd:posixAccount=user \
-a serviceSearchDescriptor=passwd:dc=mydom,dc=priv?sub \
-a serviceSearchDescriptor=group:dc=mydom,dc=priv?sub
配置返回OK
Finger 工作,在 Solaris 上搜索用户“pino”
finger pino
Login name: pino In real life: pino
Directory: /home/pino Shell: /bin/bash
Never logged in.
No unread mail
No Plan.
ldaplist返回错误!
ldaplist passwd
ldaplist: libsldap.so.1 internal error
ldaplist -a sasl/GSSAPI passwd
ldaplist: (standalone auth error)
Configuration syntax error: Unable to set parameter from a client in __ns_ldap_setParam()
getent passwd 可以工作,但只有 50%
getent passwd |grep pino
pino:x:3000014:100:pino:/home/pino:/bin/bash
getent passwd pino
id 不起作用
id pino
id: invalid user name: "pino"
我想念什么?
/etc/nsswitch.conf 没问题
cp /etc/nsswitch.ldap /etc/nsswitch.conf
答案1
已找到解决方案/解决方法,但仅完成 50%
通过此配置(并且 Samba 接受非加密 gssapi 强身份验证),所有命令都可以正常工作(ldaplist ok、id ok、su ok)。
ldapclient -v manual \
-a credentialLevel=proxy \
-a authenticationMethod=simple \
-a proxyDN=cn=proxyldap,cn=Users,dc=mydom,dc=priv \
-a proxyPassword=******* \
-a defaultSearchBase=dc=mydom,dc=priv \
-a debugLevel=6 \
-a domainName=mydom.priv \
-a "defaultServerList=10.3.0.4" \
-a attributeMap=group:userpassword=unixUserPassword\
-a attributeMap=group:gidnumber=gidNumber \
-a attributeMap=passwd:cn=cn \
-a attributeMap=passwd:gidnumber=gidNumber \
-a attributeMap=passwd:uidnumber=uidNumber \
-a attributeMap=passwd:homedirectory=HomeDirectory \
-a attributeMap=passwd:unixhomedirectory=unixHomeDirectory \
-a attributeMap=passwd:loginshell=loginShell \
-a attributeMap=passwd:gecos=gecos \
-a attributeMap=shadow:userpassword=unixUserPassword \
-a objectClassMap=group:posixGroup=group \
-a objectClassMap=passwd:posixAccount=user \
-a objectClassMap=shadow:shadowAccount=user \
-a serviceSearchDescriptor=passwd:dc=mydom,dc=priv?sub \
-a serviceSearchDescriptor=group:dc=mydom,dc=priv?sub
但如果我想在 Samba 上启用强身份验证并在 Solaris 上启用 gssapi 身份验证..
ldapclient -v manual \
-a credentialLevel=proxy \
-a authenticationMethod=sasl/gssapi \
-a proxyDN=cn=proxyldap,cn=Users,dc=mydom,dc=priv \
-a proxyPassword=******* \
-a defaultSearchBase=dc=mydom,dc=priv \
-a debugLevel=6 \
-a domainName=mydom.priv \
-a "defaultServerList=10.3.0.4" \
-a attributeMap=group:userpassword=unixUserPassword\
-a attributeMap=group:gidnumber=gidNumber \
-a attributeMap=passwd:cn=cn \
-a attributeMap=passwd:gidnumber=gidNumber \
-a attributeMap=passwd:uidnumber=uidNumber \
-a attributeMap=passwd:homedirectory=HomeDirectory \
-a attributeMap=passwd:unixhomedirectory=unixHomeDirectory \
-a attributeMap=passwd:loginshell=loginShell \
-a attributeMap=passwd:gecos=gecos \
-a attributeMap=shadow:userpassword=unixUserPassword \
-a objectClassMap=group:posixGroup=group \
-a objectClassMap=passwd:posixAccount=user \
-a objectClassMap=shadow:shadowAccount=user \
-a serviceSearchDescriptor=passwd:dc=mydom,dc=priv?sub \
-a serviceSearchDescriptor=group:dc=mydom,dc=priv?sub
全部返回错误。一个好的解决方案是使用 starttls,但我想使用 sasl。我已经在 samba 服务器上为 proxyldap 用户创建了主体
#!/bin/sh
NAME=proxyldap
SERV=ldap
HOST=solaris11
DOMAIN=mydom.priv
samba-tool user delete $NAME
samba-tool user create $NAME 22unix33AA@@@@
net ads enctypes set $NAME 24
samba-tool spn add $SERV/$DOMAIN $NAME
samba-tool spn add $SERV/$HOST.$DOMAIN $NAME
samba-tool domain exportkeytab $HOST.keytab --principal=$SERV/$DOMAIN
samba-tool domain exportkeytab $HOST.keytab --principal=$SERV/$HOST.$DOMAIN
复制了 solaris 上 krb5.keytab 上的选项卡
(echo rkt solaris1.keytab; echo wkt /etc/krb5/krb5.keytab )|ktutil
644 (echo rkt solaris2.keytab; echo wkt /etc/krb5/krb5.keytab )|ktutil
但没有任何作用。清楚还是什么都没有,我想念什么? ATM 我接受这个悲伤的解决方案,如果有人知道更好的工作解决方案,请提出,我会接受答案作为最终解决方案。